facc0b46f9b02d749b0f2379a32cc3e3d26aa9d790a69b36d33e7ff748b4034a

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AnoklesEmulator (2).exe
Size 13.2MB
Sample260821-1j833sstat
SHA256 facc0b46f9b02d749b0f2379a32cc3e3d26aa9d790a69b36d33e7ff748b4034a
MD5 7f5b5014215701082bfd54d98a174a92
SHA1 3f1c00b90e21638da13cbaabaa8a7d62b801e6fb
SHA512 e5f1895fae08b4dff6081f57cb55b58fdd87230659792244a5d9f0d36ca1cc9d82a3d7910d7e2678ef815ca91e4acd389bf4935b9bd163e5c3c866d77f18ae07
SSDEEP 393216:4ik85vz9yMLunDnGCnGjNeMwBWISvZbnP3+F8bfTMhm:4iH5vz9LLuDnGCnkNeMwMvZzP3O8bLMg
TLSH
T1BAD6338131C408FBD4D647799582A831DAA9FDB36772E04BD7E48C752E273D86A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Loads dropped DLL 31 IoCs

pid	Process
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe
2676	AnoklesEmulator (2).exe

Discovers running processes 1 TTPs 27 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1144	tasklist.exe
1416	tasklist.exe
2416	tasklist.exe
748	tasklist.exe
3312	tasklist.exe
700	tasklist.exe
1316	tasklist.exe
1856	tasklist.exe
2640	tasklist.exe
4872	tasklist.exe
5708	tasklist.exe
760	tasklist.exe
3900	tasklist.exe
5320	tasklist.exe
5088	tasklist.exe
3580	tasklist.exe
4516	tasklist.exe
5296	tasklist.exe
4860	tasklist.exe
1856	tasklist.exe
5668	tasklist.exe
4488	tasklist.exe
1236	tasklist.exe
4064	tasklist.exe
4404	tasklist.exe
1212	tasklist.exe
2200	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Riot Vanguard\Logs\.w	AnoklesEmulator (2).exe

Launches sc.exe 35 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3236	sc.exe
200	sc.exe
1588	sc.exe
5616	sc.exe
1332	sc.exe
4916	sc.exe
1336	sc.exe
3664	sc.exe
2596	sc.exe
3732	sc.exe
2440	sc.exe
3488	sc.exe
4480	sc.exe
3624	sc.exe
4636	sc.exe
2800	sc.exe
6112	sc.exe
4912	sc.exe
6032	sc.exe
2764	sc.exe
5432	sc.exe
588	sc.exe
4084	sc.exe
4540	sc.exe
3740	sc.exe
5236	sc.exe
5964	sc.exe
5716	sc.exe
3676	sc.exe
1136	sc.exe
6076	sc.exe
2336	sc.exe
6140	sc.exe
5832	sc.exe
6020	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4380	powershell.exe
240	powershell.exe
588	powershell.exe
4576	powershell.exe
2196	powershell.exe
2396	powershell.exe
3484	powershell.exe
5440	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2196	powershell.exe
2396	powershell.exe
3484	powershell.exe
5440	powershell.exe
240	powershell.exe
588	powershell.exe
4576	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4768	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2036	wmic.exe
2036	wmic.exe
2036	wmic.exe
2036	wmic.exe
5440	powershell.exe
5440	powershell.exe
5440	powershell.exe
4380	powershell.exe
4380	powershell.exe
240	powershell.exe
240	powershell.exe
240	powershell.exe
588	powershell.exe
588	powershell.exe
588	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
2196	powershell.exe
2196	powershell.exe
2396	powershell.exe
2396	powershell.exe
3484	powershell.exe
3484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2036	wmic.exe
Token: SeSecurityPrivilege	2036	wmic.exe
Token: SeTakeOwnershipPrivilege	2036	wmic.exe
Token: SeLoadDriverPrivilege	2036	wmic.exe
Token: SeSystemProfilePrivilege	2036	wmic.exe
Token: SeSystemtimePrivilege	2036	wmic.exe
Token: SeProfSingleProcessPrivilege	2036	wmic.exe
Token: SeIncBasePriorityPrivilege	2036	wmic.exe
Token: SeCreatePagefilePrivilege	2036	wmic.exe
Token: SeBackupPrivilege	2036	wmic.exe
Token: SeRestorePrivilege	2036	wmic.exe
Token: SeShutdownPrivilege	2036	wmic.exe
Token: SeDebugPrivilege	2036	wmic.exe
Token: SeSystemEnvironmentPrivilege	2036	wmic.exe
Token: SeRemoteShutdownPrivilege	2036	wmic.exe
Token: SeUndockPrivilege	2036	wmic.exe
Token: SeManageVolumePrivilege	2036	wmic.exe
Token: 33	2036	wmic.exe
Token: 34	2036	wmic.exe
Token: 35	2036	wmic.exe
Token: 36	2036	wmic.exe
Token: SeDebugPrivilege	5440	powershell.exe
Token: SeIncreaseQuotaPrivilege	2036	wmic.exe
Token: SeSecurityPrivilege	2036	wmic.exe
Token: SeTakeOwnershipPrivilege	2036	wmic.exe
Token: SeLoadDriverPrivilege	2036	wmic.exe
Token: SeSystemProfilePrivilege	2036	wmic.exe
Token: SeSystemtimePrivilege	2036	wmic.exe
Token: SeProfSingleProcessPrivilege	2036	wmic.exe
Token: SeIncBasePriorityPrivilege	2036	wmic.exe
Token: SeCreatePagefilePrivilege	2036	wmic.exe
Token: SeBackupPrivilege	2036	wmic.exe
Token: SeRestorePrivilege	2036	wmic.exe
Token: SeShutdownPrivilege	2036	wmic.exe
Token: SeDebugPrivilege	2036	wmic.exe
Token: SeSystemEnvironmentPrivilege	2036	wmic.exe
Token: SeRemoteShutdownPrivilege	2036	wmic.exe
Token: SeUndockPrivilege	2036	wmic.exe
Token: SeManageVolumePrivilege	2036	wmic.exe
Token: 33	2036	wmic.exe
Token: 34	2036	wmic.exe
Token: 35	2036	wmic.exe
Token: 36	2036	wmic.exe
Token: SeIncreaseQuotaPrivilege	5440	powershell.exe
Token: SeSecurityPrivilege	5440	powershell.exe
Token: SeTakeOwnershipPrivilege	5440	powershell.exe
Token: SeLoadDriverPrivilege	5440	powershell.exe
Token: SeSystemProfilePrivilege	5440	powershell.exe
Token: SeSystemtimePrivilege	5440	powershell.exe
Token: SeProfSingleProcessPrivilege	5440	powershell.exe
Token: SeIncBasePriorityPrivilege	5440	powershell.exe
Token: SeCreatePagefilePrivilege	5440	powershell.exe
Token: SeBackupPrivilege	5440	powershell.exe
Token: SeRestorePrivilege	5440	powershell.exe
Token: SeShutdownPrivilege	5440	powershell.exe
Token: SeDebugPrivilege	5440	powershell.exe
Token: SeSystemEnvironmentPrivilege	5440	powershell.exe
Token: SeRemoteShutdownPrivilege	5440	powershell.exe
Token: SeUndockPrivilege	5440	powershell.exe
Token: SeManageVolumePrivilege	5440	powershell.exe
Token: 33	5440	powershell.exe
Token: 34	5440	powershell.exe
Token: 35	5440	powershell.exe
Token: 36	5440	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2676	2616	AnoklesEmulator (2).exe	90
PID 2676 wrote to memory of 5440	2676	AnoklesEmulator (2).exe	92
PID 2676 wrote to memory of 6140	2676	AnoklesEmulator (2).exe	94
PID 2676 wrote to memory of 6032	2676	AnoklesEmulator (2).exe	96
PID 2676 wrote to memory of 4636	2676	AnoklesEmulator (2).exe	98
PID 2676 wrote to memory of 3624	2676	AnoklesEmulator (2).exe	100
PID 2676 wrote to memory of 2036	2676	AnoklesEmulator (2).exe	102
PID 2676 wrote to memory of 4768	2676	AnoklesEmulator (2).exe	104
PID 2676 wrote to memory of 5596	2676	AnoklesEmulator (2).exe	105
PID 2676 wrote to memory of 4380	2676	AnoklesEmulator (2).exe	106
PID 2676 wrote to memory of 3488	2676	AnoklesEmulator (2).exe	107
PID 2676 wrote to memory of 1332	2676	AnoklesEmulator (2).exe	108
PID 2676 wrote to memory of 2764	2676	AnoklesEmulator (2).exe	110
PID 2676 wrote to memory of 1136	2676	AnoklesEmulator (2).exe	112
PID 2676 wrote to memory of 748	2676	AnoklesEmulator (2).exe	114
PID 2676 wrote to memory of 4916	2676	AnoklesEmulator (2).exe	116
PID 2676 wrote to memory of 5296	2676	AnoklesEmulator (2).exe	118
PID 2676 wrote to memory of 1336	2676	AnoklesEmulator (2).exe	120
PID 2676 wrote to memory of 4860	2676	AnoklesEmulator (2).exe	122
PID 2676 wrote to memory of 4480	2676	AnoklesEmulator (2).exe	124
PID 2676 wrote to memory of 240	2676	AnoklesEmulator (2).exe	126
PID 2676 wrote to memory of 3312	2676	AnoklesEmulator (2).exe	128
PID 2676 wrote to memory of 3740	2676	AnoklesEmulator (2).exe	130
PID 2676 wrote to memory of 700	2676	AnoklesEmulator (2).exe	133
PID 2676 wrote to memory of 5832	2676	AnoklesEmulator (2).exe	135
PID 2676 wrote to memory of 4872	2676	AnoklesEmulator (2).exe	137
PID 2676 wrote to memory of 5236	2676	AnoklesEmulator (2).exe	139
PID 2676 wrote to memory of 1856	2676	AnoklesEmulator (2).exe	141
PID 2676 wrote to memory of 3664	2676	AnoklesEmulator (2).exe	143
PID 2676 wrote to memory of 588	2676	AnoklesEmulator (2).exe	145
PID 2676 wrote to memory of 5668	2676	AnoklesEmulator (2).exe	147
PID 2676 wrote to memory of 2800	2676	AnoklesEmulator (2).exe	149
PID 2676 wrote to memory of 1316	2676	AnoklesEmulator (2).exe	151
PID 2676 wrote to memory of 6020	2676	AnoklesEmulator (2).exe	153
PID 2676 wrote to memory of 1416	2676	AnoklesEmulator (2).exe	155
PID 2676 wrote to memory of 6076	2676	AnoklesEmulator (2).exe	157
PID 2676 wrote to memory of 1212	2676	AnoklesEmulator (2).exe	159
PID 2676 wrote to memory of 6112	2676	AnoklesEmulator (2).exe	161
PID 2676 wrote to memory of 4576	2676	AnoklesEmulator (2).exe	163
PID 2676 wrote to memory of 2416	2676	AnoklesEmulator (2).exe	165
PID 2676 wrote to memory of 200	2676	AnoklesEmulator (2).exe	167
PID 2676 wrote to memory of 5708	2676	AnoklesEmulator (2).exe	169
PID 2676 wrote to memory of 5964	2676	AnoklesEmulator (2).exe	171
PID 2676 wrote to memory of 760	2676	AnoklesEmulator (2).exe	173
PID 2676 wrote to memory of 5432	2676	AnoklesEmulator (2).exe	175
PID 2676 wrote to memory of 3900	2676	AnoklesEmulator (2).exe	177
PID 2676 wrote to memory of 2336	2676	AnoklesEmulator (2).exe	179
PID 2676 wrote to memory of 2196	2676	AnoklesEmulator (2).exe	181
PID 2676 wrote to memory of 5320	2676	AnoklesEmulator (2).exe	183
PID 2676 wrote to memory of 2596	2676	AnoklesEmulator (2).exe	185
PID 2676 wrote to memory of 5088	2676	AnoklesEmulator (2).exe	187
PID 2676 wrote to memory of 5716	2676	AnoklesEmulator (2).exe	189
PID 2676 wrote to memory of 1856	2676	AnoklesEmulator (2).exe	191
PID 2676 wrote to memory of 3676	2676	AnoklesEmulator (2).exe	193
PID 2676 wrote to memory of 2200	2676	AnoklesEmulator (2).exe	195
PID 2676 wrote to memory of 588	2676	AnoklesEmulator (2).exe	197
PID 2676 wrote to memory of 2396	2676	AnoklesEmulator (2).exe	199
PID 2676 wrote to memory of 2640	2676	AnoklesEmulator (2).exe	201
PID 2676 wrote to memory of 3236	2676	AnoklesEmulator (2).exe	203
PID 2676 wrote to memory of 4488	2676	AnoklesEmulator (2).exe	205
PID 2676 wrote to memory of 1588	2676	AnoklesEmulator (2).exe	207
PID 2676 wrote to memory of 3580	2676	AnoklesEmulator (2).exe	209
PID 2676 wrote to memory of 4084	2676	AnoklesEmulator (2).exe	211
PID 2676 wrote to memory of 1236	2676	AnoklesEmulator (2).exe	213

C:\Users\Admin\AppData\Local\Temp\AnoklesEmulator (2).exe
"C:\Users\Admin\AppData\Local\Temp\AnoklesEmulator (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\AnoklesEmulator (2).exe
  "C:\Users\Admin\AppData\Local\Temp\AnoklesEmulator (2).exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\SYSTEM32\sc.exe
    sc qc vgc
    3⤵
    - Launches sc.exe
    PID:6140
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:6032
- - C:\Windows\SYSTEM32\sc.exe
    sc create vgc type= own start= demand binPath= "\"C:\Program Files\Riot Vanguard\Logs\vgc.exe\" --offline"
    3⤵
    - Launches sc.exe
    PID:4636
- - C:\Windows\SYSTEM32\sc.exe
    sc qc vgc
    3⤵
    - Launches sc.exe
    PID:3624
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='vgc.exe' get ExecutablePath
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4768
- - C:\Windows\SYSTEM32\netsh.exe
    netsh winhttp show proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$cs=Get-CimInstance Win32_ComputerSystem;$b=Get-CimInstance Win32_BIOS;($cs.Manufacturer+'|'+$cs.Model+'|'+$b.SMBIOSBIOSVersion)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4380
- - C:\Windows\SYSTEM32\sc.exe
    sc qc vgc
    3⤵
    - Launches sc.exe
    PID:3488
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:1332
- - C:\Windows\SYSTEM32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:2764
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:1136
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:748
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:4916
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5296
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:1336
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4860
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:240
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:3312
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:3740
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:700
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:5832
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4872
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:5236
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1856
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:3664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:588
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5668
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:2800
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1316
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:6020
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1416
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:6076
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1212
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:6112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4576
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2416
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:200
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5708
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:5964
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:760
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:5432
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:3900
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2196
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5320
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:2596
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:5088
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:5716
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1856
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:3676
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2200
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:2640
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:3236
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4488
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:1588
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:3580
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:4084
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1236
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \"Name='VALORANT-Win64-Shipping.exe'\").CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3484
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:1144
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:4912
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4064
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:3732
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4404
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:2440
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq VALORANT-Win64-Shipping.exe"
    3⤵
    - Discovers running processes
    PID:4516
- - C:\Windows\SYSTEM32\sc.exe
    sc query vgc
    3⤵
    - Launches sc.exe
    PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 46013602eb712487c5c4134afa81694570fd6c71d2be3cad888c81ec079db732
MD5 9dc3d9fead34511b2dbec305d5588559
SHA1 cdf1808f087fa4fd3121660931131ff21e49622f
SHA512 4e2b345e8b973fc2a510152addf5b1e65ee098ddec88bbf5fd274b06658e05c0235d46067aa37bc066f44203f80e726bdfaba858a1e7406607880d6435d9e991
TLSH
T154217633B3DC8214C899403A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

_pkcs1_decode.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Cipher\_pkcs1_decode.pyd
Size 13KB
SHA256 320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc
MD5 b5600245089e36b00e9fb4f4327a9f5f
SHA1 61cd2fbc4f83506001ed4650439f35916a006e0d
SHA512 179698c5c6f568a9f152bfdbef9369d31cc2a4d3355b9a5ba5fe4b4498410124daf890098c15e7b70a60a498c25f11517fb48e8ece55f5a2fd4236241df8cda3
SSDEEP 192:h76XJdfr7i0iNWGO6z0x+/kOn/cqgvVJWC:cJxC0e+QvRg
TLSH
T19252E946F66AEAA8E9674174C62B4B1FB9FDF500635073DB0351C99A1DB33C1327E640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
MD5 d350d601e5716a85f4beeba6e11f54d0
SHA1 8e972659a7867859ca9d36f454e8e2c49634b128
SHA512 a34cbfbdd5a429407d441a5bd163307f18f6af2403b44dc9c0c4365a6a5d8e0b6a3a0a24ef2e272e2e916a3a2a58be0ffe9e90408cfb60e6049fb5b9aa56620c
SSDEEP 192:4Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjW+Hrcqg9K2:BOJ+0QPSfu6Oh+FLkgx/dg9
TLSH
T10A823C94EAAA54FDE625C434C6534A2F9379B11A4B61E3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
MD5 d950a144de4ba6f7834772196b1853b1
SHA1 c949b8ff73436131ea495c37452c2de19b5296b6
SHA512 cf8fed63c95e9f40c2b595e92981e458ae8f587b464e2144c28ab0b2de7c608075140951e496b92ac3c72f4c61d9fcc0b236966fa49e23c8c7ccc5bdb181ebff
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3MzMR7kLqhgZvRv:JP/YtswvbHXM3c3ZkLqKZZv
TLSH
T1EAA20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA512.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Hash\_SHA512.pyd
Size 25KB
SHA256 adab3a8ef9daa73b1e9ca83d66a726c8ad256eed119ab2d7d3fcee10f8f013d1
MD5 41a1d0414de80ad9262567c5960e7edf
SHA1 8b0e74580eb0a99459ee3c766346569aad9b9314
SHA512 bc12bd5386d94834690ea6dcb3b948f32131580531f8bea72df4bbedcc5c060cb5267eebda7168cc8c994fda776a22c58f0eec9d2351a797fc7c9b8f4c820a31
SSDEEP 768:Gtui0gel9soFdkO66MlPGXmXcx409X/HnX7ChlRV:eu/FZ6nPxMF/37kV
TLSH
T1A9C2FB01EC685324DC15533847B9DF3ADAA4B71483E0EAF746E231C53D565C72BB858B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_modexp.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Math\_modexp.pyd
Size 30KB
SHA256 fc122c8e0a1c236c2a0b20009ed710602545577ba34a9fafed71eb84e56a2e76
MD5 2f44dc08973333126ba3daa977c909b5
SHA1 a06d37536df9482b30541a30e799cb02243d5c9b
SHA512 f3bf133f53cf415742125e7d15e7739190d2a96eb7a4a1e54e426d722d1175c80526240a3ffa127dc7118dfdd54c5c5f567191645a51904aeb01a8388f16a059
SSDEEP 384:2+URkXHWlnSr0BX4pMg1X9RecIdFXgS0qcG1SlXX8pYUM+grFI1ej3vOgodAX:2ZRQHCngpMgC0Ew+P1ejDod
TLSH
T171D25B12D6D801ECDEBBC13CD6F6494BEAB67588230143CF93B089790E739E66639B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
MD5 fecc7e50926f0ec3286d9cac0bc3938a
SHA1 e12c70ee106d580a9adb0f81b38734d376266607
SHA512 925cdac89dbb66b8b9f69e9beeda001c4735e16fb1a3e3c0ab94648a7b8915f99469b0bf87e3a0d0ddc39d35a8f66680ae22c96eed22af354aed225b761a25c6
SSDEEP 96:dkEOstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsncZqkSffcX6gi1:dkEXtOzRr+Uj0TsBz178sncwkgcqgi
TLSH
T13322E888FA568CF6E51582B9C9374E4EB175B710972067CF1374CA691E227CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_bz2.pyd
Size 84KB
SHA256 261545bd24f15a783fc0c82568b766a4ab569dde14507a81701cccf5293e6e54
MD5 b18acc96186c2bb1ed0b3256374e4f83
SHA1 e2eb7b2e642de5866b597533d100848d1e1d0644
SHA512 aba2bb8052000bf57f2fbf9ba9859c2678c384ed046d71edc288cd168e288169003a9f7868c3263491c1073e633e4bb187ee0c68fb287f7d454428e406c12a44
SSDEEP 1536:/TVAz72U4OBcir2QVSZZOhcKJsawo8YfsDPYJIqLVfyPs5i9LgfIL2F:7VAz6UAixQjOaSsamYkDPYJIqLVghs
TLSH
T1FF838F97A76471F6F9AF81B5D6800363E730BB560710A3AFB244C3453F12B81AF68369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_ctypes.pyd
Size 131KB
SHA256 9d6dccb4cd84a44a107f9b06b91c0a44e85766d9bf4debb6abbde8fda7494c2c
MD5 f75c30ccf8ecf05a2ba83cb06eeb354f
SHA1 962545549964c61dfbd31ab7d52ed470f7c5a9d6
SHA512 277f113ef07c02c83e7542899104cd8a1e626e84a7b9b0f9d68e8562ac6221413cfac14b84c5db5156bebe80381034273529abadaa01592b11c6d346cf95e24a
SSDEEP 3072:/uZ3aSoXIGagR+lf/FTzy4JxXBUnFIqyPst:Gobqf/FTzyixRUnn
TLSH
T186D37E0B776800AADAA39178C533AF47EFB1B453161097CF02A4C59A2F637966E7F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_hashlib.pyd
Size 67KB
SHA256 79a26289aef0d92545a082507c7021f10e219621d137cb726c4d0fbbfd4b46ae
MD5 4949202690a7f755717b685a99e21092
SHA1 42ad37b620d204a8fcd5bdb2c09609b43639d1ac
SHA512 52172d67a60e79bec735c9b71ccf5c5b558c436391735256a4168a200911c0d7d09d22c86cf8fb75331afc02f9924c395ce1b28c9516c9e9207b9885a9da9894
SSDEEP 1536:eqXn1yAu1lEAXfXEfcV5Tam96CAhIqvICyPs5i9rfIYzWS:z1w1uAcfcym96CAhIqvIQu
TLSH
T11E637C9596894092E92382B5C4A34F83FA75F3521711ABDFA2A8C0CD2F233C78777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_lzma.pyd
Size 155KB
SHA256 ee224aacf5cf9c9974a1b842aac8d89d5d9b7eeebbf4d76619ae0ce4da8ecd96
MD5 9b3c9bae696ae1f89846da9dbb44e5ec
SHA1 91e21fdecb5080d083df18d62b1a44e24929b1e6
SHA512 8150fd33a5a36fe6d541e2fe30c8b716f95eaa65d9355ed23ca40d269547697b21156a023381e5d3c7923bf878447bbc9888916ce51661010868a14e4231a60e
SSDEEP 3072:DK1fxTOfpRnifp5/eNRFcznf59mNoB/ujJIq01Ht0:D6JTOjKsHShYOoj0y
TLSH
T1B8F35B86B794F0E5F7728C38D2624F57E6F5785A0320929A01CC936D2B1FB659E2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_queue.pyd
Size 34KB
SHA256 4404c2569443ffb54e7cfffdca8ddf58c9a609175305970728ec12bc1c147b43
MD5 6866cea9ab3361dcd842ddf31ad35135
SHA1 9a2e70e4106ed0b358ce9625ab1e669ece7242ec
SHA512 a0372f53ef0baedd06558654a2bb8db827e9577674f9731d952661cfb2f9379b2fa340bb3b5566b71ce1d4bb33c2c7552350f64f02a1fb65f278996794283065
SSDEEP 768:S2ZcytiI88FIq9UM6yPsSvPuBL2Ip48C3Txf1mlRaXk6t:RliI88FIq9UHyPs5i9xfIYk4
TLSH
T171F27DCA5B684087E663C670C1F3EE92F535B7D356018AAF2079D28E1E133C29776359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_socket.pyd
Size 84KB
SHA256 ccbd0f83df3784da08147b8e8765e28c978de28b5c0eddcfba5567b59d43fef9
MD5 e9f0b7a679d712b0a5df1a55e02ff60a
SHA1 7c1dca1be48a41344b8eb3a0dc29af3b1d3c60d2
SHA512 3a68fd75a2055427f1674676c423ba9ac692daeac6379330c11313436fe264fe77b34a0c5884e22886564eb33defaeee04e1b3d17f56f9e45d9e15214a0c011d
SSDEEP 1536:YFl/fFBFu9aBvtgYKyNEyJwbQlyJ+i+nzJQw4jxtN388ZFIqywcVyPs5i9hfIYv7:YFR1u9mvPEyJwbQlyJL+nzJQljxrxFIM
TLSH
T13E836B01A66040FAEB73D075C2639E63FB74B1C11395A35F0466C65A2F337C2AF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_ssl.pyd
Size 177KB
SHA256 8d2f51fa1dc929073a2ad8d1c7c0c911e8f695870dcf4dda2846f4b75a7f77fb
MD5 e1da7e7534206b6f2d3d025c847c9df6
SHA1 74585fb3b0f1b46fd3f90d81d5c6bb3cbdc930d7
SHA512 fd8ae255deb3d933e27da712f093d21f8d02c74e57b8044da9a9e8076a5710ea27409ecca4cea6b49f7f0ee9bb6f6a004311d7baa3ef5211452126bc3eee09b7
SSDEEP 3072:S9fZJvjN6U2kGMlfz6CvcyMNdmI7IM/cbPuC/JeJIqL7Og:S9xJrEU2tqz6CviPssT
TLSH
T135047C47B5945AF7D813E4F9C1234903EBB0F1553312479E48D6E64A0F03B4AAEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\_wmi.pyd
Size 38KB
SHA256 db45362354fd4965329cb14bd974e60b26525045d09fb4fdfb1674a93b79d60c
MD5 4d21366851a7369297e81005af82add3
SHA1 79acfadd87dceaf2b222deca398afc1b6807f6d7
SHA512 8f64093b6d7288311d9e352ab569d7c6127b70986df305de9f947f24d0e6d1c4dcfa6730d48672bedc00896452a2fcb20133b9f42c8eed8d60d8d6240287e888
SSDEEP 768:Q2/EEqrVmjsiuM2cruJIqLioyPsSvPuBL2Ip4DTxf1mlRaXn6KVNK:dE9BEeM2cruJIqLioyPs5i9BfIYn/U
TLSH
T1AC037EC6A6680082EB67C674C1A5CD93F575B7D3171187CF32A582990F233D1DB3A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\base_library.zip
Size 1.3MB
SHA256 769bbcca2bc0bf539af5589c7da4282cbe5d88d87d4ffdcccb648bacd2124cee
MD5 35e28c9ebbc4aaee701a4a10cee0a95a
SHA1 b1a78fbd84f3b237592d176241048b3ead32c6b5
SHA512 80bcddac9bc7eca35890b4b28d0990da6e8ca8013c847f184a99febecc0db93f98f63810a9ec418330f8b282a69cec791c1a1bb195deb93e682f2916d0d6e9f2
SSDEEP 12288:CW7Wpw/6ntYzGSmg1plYQfiBgDPtLwjFx278QABQowsEU0L+DuqHwlUKnF7kdxho:b7Wpw1SXg1nowKYpBkdxhYVP05qdZ5
TLSH
T1A5651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgc.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\build\vgc_obj\vgc.exe
Size 1.5MB
SHA256 a0da6c3bd9967e650a099391a179c5df878235f21611fa3164f8879dd3e9e00b
MD5 929b7226c6065ce77b707db45116bb89
SHA1 b3ce1ccfb8e3badfd4ca5a651c8123ea413f90fc
SHA512 200719e361b9d8498483c5c61addf2277d781ea6385cd917cff5edcd3b99c296d32677699a7cda63e387c7c4a12f901446c4f4339d9bfcf4485de81c0c0f35c2
SSDEEP 24576:BF7EYcP9zzVjw0eVGhgT0IgCxTH67D/5nj3gsOlNB9Y6HQnZR7hQ9:BF7EZzzVjwlQhVlZdWYmSG
TLSH
T157754B06A7E5CEEAC89AA73591CB2729F634FC5017639BDB471052312E537D89E3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\python313.dll
Size 5.9MB
SHA256 e820bf024efd2b56bb2b82791e6b6ddc7303f070f8e72cba7637482a8a906238
MD5 e60c200eeefd75110b5801b150f9ff53
SHA1 6e3a63bf17c7c8c4cafe51fb648e4dd767220139
SHA512 b59cda63fce21d571510e373523b7dd4aae18a8f005fe9de39c4f2d66920f37f4d857d4781d43dc141485884a77a2b7d0ce45610e3105fdd7d91296ff09caea2
SSDEEP 98304:XHoJQujBS7z5bCwCG/ytJ1Lff7rexvCHDMiEfVc7Sz1:XHoJQqUn5bCpfWi2c+z1
TLSH
T13D567C16729E41ACD97B8078CA07864BF7B27C053E60834B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\pywin32_system32\pywintypes313.dll
Size 133KB
SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
MD5 53e3a01abb3ed77219a364445b3f2c97
SHA1 4542d5390aa4cd5ec34992da4d7118b52d2f8bf7
SHA512 6605ed1550b8d7fe8b72a6ddb25c17298807f497bcf681c3cac2dcb3b128d4c9da2b5f2b209e345181d276da4729eed313284c807997541f7f4dbc72b0ea0ef1
SSDEEP 3072:0dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTa:04aYlWa9r61LrY/rPbFU4NgOjptI
TLSH
T167D33A47378684DAE96A937DCD771A02D3A2B0100711E3CF46A1C28B6F637E66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\select.pyd
Size 32KB
SHA256 024f955349fe46cf1bb2c22c6b57fcf38cf5755d46166fbf63e7e5b92433b111
MD5 bf9f0f5d76c5676e46a1163ca0ba9498
SHA1 9da39e5b883457c7d7cbeaa6e9bb8a4a81161575
SHA512 a99332dc9786243f06dfc6bfe6a2b7a1290a2e185eedb76da7dbd63b4a6e6a8ad7116a11a6de85253ec80f1446d5ca5190ac40f5c0efc1944133ea6ccd428887
SSDEEP 768:PpX5FZnl8TaPFIq9GWyPsSvPuBL2Ip4zTxf1mlIJMlgPc:RX5F5l8aPFIq9GWyPs5i9RfIkMuc
TLSH
T112E28ECB6B285087EA63C631C5A1DE43F939B3E35621869F30B991C90E177C1A737258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\unicodedata.pyd
Size 696KB
SHA256 111e0fdfeef9887c04f6ebf1972ce1ccbec55b226012e4a288c2d4a0b17b216b
MD5 72aab1c6dd885daa0a94a3701c890b29
SHA1 dbfc6979b9745ac060cc74fa4be8c3872515b488
SHA512 c50fb893096959614319ed8fcae694bbafd5ae28e1ff63b64847bf2d25a7d787d2a6da6e0eda0d0811d77363ac7bd3410a7b9bbc40b29605a7a23c68a1fadbd7
SSDEEP 12288:/egxeYfdLI/X77mvfldCK1ihH32W3cnPSqrUgTc1:/egxeYfW7qNxq3cnPXTc1
TLSH
T198E4F5D5BBCF8D26E68B363948E3710F5171C3B35F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\win32\win32api.pyd
Size 135KB
SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
MD5 be180d10694c90e0b3e477c30b7620c7
SHA1 17dd8031f0008a15f4003d228d0661de5a8ae5ab
SHA512 c69c10c3ac8361ad682111d1f40c13f7736c2422967fdda2e0ade35a1bb970bff5d48bc17d8b6f0341963652425bb36b40a0d02108508b3643c6e9e58533ccb3
SSDEEP 3072:87AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJke:YAF0fu73lRVsPSexhbqyvcGg0
TLSH
T114D30683B35410C6D86AA37C81675F23DB72B8240725A7CF06A0C68A1F63BE97D3D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\win32\win32event.pyd
Size 29KB
SHA256 23201e42d29c91e810ce8f697ed0df0bc48a1dc549af006a610b77aaee5a553e
MD5 b4e9950a85ac70c724acbc2b30b405b1
SHA1 393e9c56778dd9d29af89d46148f698f213d20a8
SHA512 0904375d02503bb72cae08196084c368e44840928723007c9e65259dad80dbc317b393df98cd5c0828c1c9c42c7a090e634dfdc7a6c58e05d9d0605d234cd1c4
SSDEEP 768:4aWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4:48Rc/jhfWddbcH8l/99mku36U4a4
TLSH
T142D2F7C723A46095E56AD13DC8261F07E2B2B53103A1B3DF0262D55A1F732E57B38F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32pipe.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26162\win32\win32pipe.pyd
Size 28KB
SHA256 8095251b9018c130220601d2c0c19b3c84896f0a396cf0a8e7a7bf1a1351ea52
MD5 b77743d5919f24bca86f18a5fdbf976a
SHA1 7a275dc290640d2fb1fd92bb8658cfb152d49f92
SHA512 edac405cddb40d8c22d529fbbea9e2dfdbf461ef22abe86913996293d02564296716e979fc9702fde53c16c300fc483e1d9406795eacd527e2637892d5a8cbd8
SSDEEP 384:Tat2NCx5id8/9+WEg6d7ukgOMUOMCVU5Gz8T8/6NnRVBvya9NeDIkmM/J:Tat2NA5ieF+WTVOiRyNnRD6aWmi
TLSH
T1A2D228A2B34541C5E52BE2B8C0226E1791B1B4390391D3CF8662DA572E773F5BA38F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rrtc3eqq.4er.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrtc3eqq.4er.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2396-236-0x000001B3FE3C0000-0x000001B3FE472000-memory.dmp

Download

memory/4380-202-0x000001A01DD60000-0x000001A01DE12000-memory.dmp

Download

memory/5440-191-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-193-0x000002677DF00000-0x000002677DF2A000-memory.dmp

Download

memory/5440-188-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-189-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-187-0x000002677DAA0000-0x000002677DB52000-memory.dmp

Download

memory/5440-190-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-177-0x000002677DA10000-0x000002677DA32000-memory.dmp

Download

memory/5440-192-0x000002677DB60000-0x000002677DB6A000-memory.dmp

Download

memory/5440-194-0x000002677DF00000-0x000002677DF24000-memory.dmp

Download

memory/5440-186-0x000002677DA80000-0x000002677DA9E000-memory.dmp

Download

memory/5440-196-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-183-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-174-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-181-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-182-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-173-0x00007FFEC7A0F000-0x00007FFEC7A10000-memory.dmp

Download

memory/5440-180-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-179-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download

memory/5440-178-0x00007FFEC7880000-0x00007FFEC8224000-memory.dmp

Download