78b8c51f20fb742cf58350f9295f1ca0ccacbc0b95b96501d6aab216f0e4061e

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BeamNG.Earth-1.5.5-beta.exe
Size 46.6MB
Sample261022-ye7ncae17t
SHA256 78b8c51f20fb742cf58350f9295f1ca0ccacbc0b95b96501d6aab216f0e4061e
MD5 4a9855e2e914e4d9c51fc0a9e66df999
SHA1 61d002ece854578ed6b914c86693d8d9b930f2b4
SHA512 8704e843e31b7bca6ac1c0171d05208706f51c2bc38cd99a51f20ad90feccc6431765fe2e78cd2fd974cd0efe0fb0f8fced33348ad76bbf4e90239e18edc4312
SSDEEP 786432:M04jTHYr9aRTjVS+9j4vGtPAVjBJuikgwVR2KtCRAyjiQ1j9dZ6Cghcq+0LhXia:MPT4r9+VSEGj7uik3ueCmyXVppghFLl8
TLSH
T118B7335742B28CE8ECA2803986F349389B60F8068F53D6FB545406577E77BE92D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 50 IoCs

pid	Process
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3944	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe
3236	BeamNG.Earth-1.5.5-beta.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4092	tasklist.exe
4056	tasklist.exe
3152	tasklist.exe
4852	tasklist.exe
4968	tasklist.exe
2040	tasklist.exe
3308	tasklist.exe
4348	tasklist.exe
5036	tasklist.exe
1908	tasklist.exe
1960	tasklist.exe
3536	tasklist.exe
3884	tasklist.exe
6068	tasklist.exe
2264	tasklist.exe
1620	tasklist.exe
6032	tasklist.exe
4728	tasklist.exe
960	tasklist.exe
6032	tasklist.exe
5632	tasklist.exe
4084	tasklist.exe
5248	tasklist.exe
3244	tasklist.exe
4200	tasklist.exe
4904	tasklist.exe
5872	tasklist.exe
5012	tasklist.exe
4900	tasklist.exe
3552	tasklist.exe
1304	tasklist.exe
5768	tasklist.exe
5616	tasklist.exe
3024	tasklist.exe
2516	tasklist.exe
1328	tasklist.exe
1116	tasklist.exe
5032	tasklist.exe
4276	tasklist.exe
2824	tasklist.exe
2832	tasklist.exe
5180	tasklist.exe
3464	tasklist.exe
5440	tasklist.exe
4304	tasklist.exe
916	tasklist.exe
4152	tasklist.exe
5632	tasklist.exe
4776	tasklist.exe
6012	tasklist.exe
4440	tasklist.exe
3412	tasklist.exe
4840	tasklist.exe
4388	tasklist.exe
1224	tasklist.exe
5172	tasklist.exe
3400	tasklist.exe
572	tasklist.exe
3016	tasklist.exe
4384	tasklist.exe
2636	tasklist.exe
4928	tasklist.exe
2808	tasklist.exe
1292	tasklist.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BeamNG.Earth-1.5.5-beta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BeamNG.Earth-1.5.5-beta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BeamNG.Earth-1.5.5-beta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BeamNG.Earth-1.5.5-beta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	BeamNG.Earth-1.5.5-beta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	tasklist.exe
Token: SeDebugPrivilege	5180	tasklist.exe
Token: SeDebugPrivilege	2040	tasklist.exe
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	3308	tasklist.exe
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	2516	tasklist.exe
Token: SeDebugPrivilege	4348	tasklist.exe
Token: SeDebugPrivilege	5632	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	1960	tasklist.exe
Token: SeDebugPrivilege	6012	tasklist.exe
Token: SeDebugPrivilege	3552	tasklist.exe
Token: SeDebugPrivilege	6032	tasklist.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	4200	tasklist.exe
Token: SeDebugPrivilege	1620	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	416	tasklist.exe
Token: SeDebugPrivilege	572	tasklist.exe
Token: SeDebugPrivilege	3016	tasklist.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	4440	tasklist.exe
Token: SeDebugPrivilege	1328	tasklist.exe
Token: SeDebugPrivilege	1116	tasklist.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	3884	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	3856	tasklist.exe
Token: SeDebugPrivilege	4904	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	5872	tasklist.exe
Token: SeDebugPrivilege	5768	tasklist.exe
Token: SeDebugPrivilege	6068	tasklist.exe
Token: SeDebugPrivilege	5012	tasklist.exe
Token: SeDebugPrivilege	5632	tasklist.exe
Token: SeDebugPrivilege	5172	tasklist.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeDebugPrivilege	5616	tasklist.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	5248	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	6032	tasklist.exe
Token: SeDebugPrivilege	4056	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	3152	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	480	tasklist.exe
Token: SeDebugPrivilege	4900	tasklist.exe
Token: SeDebugPrivilege	2832	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	3412	tasklist.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	4928	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	960	tasklist.exe
Token: SeDebugPrivilege	2808	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3944	1964	BeamNG.Earth-1.5.5-beta.exe	89
PID 3944 wrote to memory of 1908	3944	BeamNG.Earth-1.5.5-beta.exe	91
PID 3944 wrote to memory of 3236	3944	BeamNG.Earth-1.5.5-beta.exe	92
PID 3944 wrote to memory of 5180	3944	BeamNG.Earth-1.5.5-beta.exe	94
PID 3944 wrote to memory of 2040	3944	BeamNG.Earth-1.5.5-beta.exe	95
PID 3944 wrote to memory of 2264	3944	BeamNG.Earth-1.5.5-beta.exe	96
PID 3944 wrote to memory of 3308	3944	BeamNG.Earth-1.5.5-beta.exe	97
PID 3944 wrote to memory of 3464	3944	BeamNG.Earth-1.5.5-beta.exe	98
PID 3944 wrote to memory of 2516	3944	BeamNG.Earth-1.5.5-beta.exe	100
PID 3944 wrote to memory of 4348	3944	BeamNG.Earth-1.5.5-beta.exe	101
PID 3944 wrote to memory of 5632	3944	BeamNG.Earth-1.5.5-beta.exe	102
PID 3944 wrote to memory of 4776	3944	BeamNG.Earth-1.5.5-beta.exe	103
PID 3944 wrote to memory of 5440	3944	BeamNG.Earth-1.5.5-beta.exe	104
PID 3944 wrote to memory of 1960	3944	BeamNG.Earth-1.5.5-beta.exe	105
PID 3944 wrote to memory of 6012	3944	BeamNG.Earth-1.5.5-beta.exe	107
PID 3944 wrote to memory of 3552	3944	BeamNG.Earth-1.5.5-beta.exe	108
PID 3944 wrote to memory of 6032	3944	BeamNG.Earth-1.5.5-beta.exe	109
PID 3944 wrote to memory of 3244	3944	BeamNG.Earth-1.5.5-beta.exe	110
PID 3944 wrote to memory of 4200	3944	BeamNG.Earth-1.5.5-beta.exe	111
PID 3944 wrote to memory of 1620	3944	BeamNG.Earth-1.5.5-beta.exe	112
PID 3944 wrote to memory of 3536	3944	BeamNG.Earth-1.5.5-beta.exe	113
PID 3944 wrote to memory of 416	3944	BeamNG.Earth-1.5.5-beta.exe	114
PID 3944 wrote to memory of 572	3944	BeamNG.Earth-1.5.5-beta.exe	115
PID 3944 wrote to memory of 3016	3944	BeamNG.Earth-1.5.5-beta.exe	116
PID 3944 wrote to memory of 4304	3944	BeamNG.Earth-1.5.5-beta.exe	117
PID 3944 wrote to memory of 4440	3944	BeamNG.Earth-1.5.5-beta.exe	118
PID 3944 wrote to memory of 1328	3944	BeamNG.Earth-1.5.5-beta.exe	119
PID 3944 wrote to memory of 1116	3944	BeamNG.Earth-1.5.5-beta.exe	120
PID 3944 wrote to memory of 4388	3944	BeamNG.Earth-1.5.5-beta.exe	121
PID 3944 wrote to memory of 1224	3944	BeamNG.Earth-1.5.5-beta.exe	122
PID 3944 wrote to memory of 1304	3944	BeamNG.Earth-1.5.5-beta.exe	123
PID 3944 wrote to memory of 3884	3944	BeamNG.Earth-1.5.5-beta.exe	124
PID 3944 wrote to memory of 916	3944	BeamNG.Earth-1.5.5-beta.exe	125
PID 3944 wrote to memory of 3856	3944	BeamNG.Earth-1.5.5-beta.exe	126
PID 3944 wrote to memory of 4904	3944	BeamNG.Earth-1.5.5-beta.exe	127
PID 3944 wrote to memory of 5032	3944	BeamNG.Earth-1.5.5-beta.exe	128
PID 3944 wrote to memory of 5872	3944	BeamNG.Earth-1.5.5-beta.exe	129
PID 3944 wrote to memory of 5768	3944	BeamNG.Earth-1.5.5-beta.exe	130
PID 3944 wrote to memory of 6068	3944	BeamNG.Earth-1.5.5-beta.exe	131
PID 3944 wrote to memory of 5012	3944	BeamNG.Earth-1.5.5-beta.exe	132
PID 3944 wrote to memory of 5632	3944	BeamNG.Earth-1.5.5-beta.exe	133
PID 3944 wrote to memory of 5172	3944	BeamNG.Earth-1.5.5-beta.exe	134
PID 3944 wrote to memory of 4092	3944	BeamNG.Earth-1.5.5-beta.exe	135
PID 3944 wrote to memory of 5616	3944	BeamNG.Earth-1.5.5-beta.exe	136
PID 3944 wrote to memory of 4084	3944	BeamNG.Earth-1.5.5-beta.exe	137
PID 3944 wrote to memory of 5248	3944	BeamNG.Earth-1.5.5-beta.exe	138
PID 3944 wrote to memory of 4276	3944	BeamNG.Earth-1.5.5-beta.exe	139
PID 3944 wrote to memory of 6032	3944	BeamNG.Earth-1.5.5-beta.exe	140
PID 3944 wrote to memory of 4056	3944	BeamNG.Earth-1.5.5-beta.exe	141
PID 3944 wrote to memory of 1124	3944	BeamNG.Earth-1.5.5-beta.exe	142
PID 3944 wrote to memory of 3152	3944	BeamNG.Earth-1.5.5-beta.exe	143
PID 3944 wrote to memory of 3024	3944	BeamNG.Earth-1.5.5-beta.exe	144
PID 3944 wrote to memory of 4384	3944	BeamNG.Earth-1.5.5-beta.exe	145
PID 3944 wrote to memory of 480	3944	BeamNG.Earth-1.5.5-beta.exe	146
PID 3944 wrote to memory of 4900	3944	BeamNG.Earth-1.5.5-beta.exe	147
PID 3944 wrote to memory of 2832	3944	BeamNG.Earth-1.5.5-beta.exe	148
PID 3944 wrote to memory of 4728	3944	BeamNG.Earth-1.5.5-beta.exe	149
PID 3944 wrote to memory of 3412	3944	BeamNG.Earth-1.5.5-beta.exe	150
PID 3944 wrote to memory of 2636	3944	BeamNG.Earth-1.5.5-beta.exe	151
PID 3944 wrote to memory of 4852	3944	BeamNG.Earth-1.5.5-beta.exe	152
PID 3944 wrote to memory of 4928	3944	BeamNG.Earth-1.5.5-beta.exe	153
PID 3944 wrote to memory of 5036	3944	BeamNG.Earth-1.5.5-beta.exe	154
PID 3944 wrote to memory of 2824	3944	BeamNG.Earth-1.5.5-beta.exe	155
PID 3944 wrote to memory of 4840	3944	BeamNG.Earth-1.5.5-beta.exe	156

C:\Users\Admin\AppData\Local\Temp\BeamNG.Earth-1.5.5-beta.exe
"C:\Users\Admin\AppData\Local\Temp\BeamNG.Earth-1.5.5-beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\BeamNG.Earth-1.5.5-beta.exe
  "C:\Users\Admin\AppData\Local\Temp\BeamNG.Earth-1.5.5-beta.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\BeamNG.Earth-1.5.5-beta.exe
    C:\Users\Admin\AppData\Local\Temp\BeamNG.Earth-1.5.5-beta.exe --server --user-dir C:\Users\Admin\AppData\Local\BeamNG\BeamNG.drive\current --deshadow full --near-visual detail --airports on --sea on --trees on --buildings on
    3⤵
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:3236
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5180
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3400
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4152
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1292
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    PID:1700
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq BeamNG.drive.x64.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-22.json.1664.tmp

Path C:\Users\Admin\.cache\beamng-earth\netstats\2026-10-22.json.1664.tmp
Size 353B
SHA256 c90d336ec8eb7c55be9501dc2e2bf175eed4335345e3f755bc8699319de7d803
MD5 30e044679a8a294212074b93ec1c9a7a
SHA1 63a5d35f33f6c9a17c14ca40f95e02c8159fcfd1
SHA512 89e053c6a6a74da241ea019269f21091c21c4fcbf15ccb844e38130bf0d83122d505009a9bae240e3405062229186993b3a6be59f409d3f67efa7a2aedfa6e42
TLSH
T18CE0469248910DBE31BC262E54A62A4AFED0E7224114840B3FF2D4A9DD7718A2086CAE
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VERSION

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\VERSION
Size 12B
SHA256 c081db7e04ac63230c7fbdb7a96def11df2f3e955729d72a140e70c74ba5dc39
MD5 60190c5516c674bca6fcea71844fec36
SHA1 2e72f0c19306f2b2a8b612d417b8c6852da39211
SHA512 2b4843288556bdb00acbbb704beb4b0705c7f55090d7ecfedc0930ff9351f30e3fc3b229323e36a10e08a090c5bd6d6d2b111a6aabbee2df781b139c4bef8d9e
MD5 SHA1 SHA512

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_hashlib.pyd
Size 67KB
SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
MD5 72b2f8cdf8d6b1dbbdd4e0c0bacf849e
SHA1 54d10c68abecefa52f866bd13779544616c6b286
SHA512 827bd7f6aaad7184b3bce810d027055e15818208c8b167ef467bfb21d83103ff24f6d90fe0a500297a93d66d5cddd41eb1cb632f124171b042506a417d5eb15c
SSDEEP 1536:gksa/wmb96DB9qWptC8SBIWOIuytH/9SfIW44z4r:gHH9qWptClBIWOIBW4IQ
TLSH
T1B3639E0AB6944194D9A78175C9A39F53F9F1F28217206BEF4268C0CD2F233C3A77A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_queue.pyd
Size 32KB
SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
MD5 6ffc75670dfed859cc7ca266bcc89816
SHA1 5a39c3fd8fb398234611b91a5da260547442da52
SHA512 d26d74232dce6c6e57c92a0cfae605bbef7036dd848a04ca8b267aeee1aa12b1b06813746466ce186c363b3c89034424ee64681399b8d00f4d4e997abfef475b
SSDEEP 768:eVzlP6rT1wyzklIWQUFOytxJEKrLy2Ip44Cxf1mljr8VMSU:eTST1lzklIWQU4ytH/9pfI38VMJ
TLSH
T164E29FCAAE644047E563CA70C2E7EE93F935B7935601879F2065C18E1F237C1E726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_socket.pyd
Size 83KB
SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
MD5 0106ee3f61a54d922190b3a01c81a453
SHA1 420bd90297b2df30f00813e4ee17177fa0c77c3b
SHA512 393bb603efa2f1fb783f2a9b898911af0882ff5919c2b3cf615845a349662b7b64d276398187b11f2c5c07a022459dd8d8b41c0ce331bc31c5f088056da7083c
SSDEEP 1536:BdcydNg46ARGrwISALqwXV9/s+S+pzgMX49IEuDQ6JnlIWLwhmytH/9hjCfIbp:B6ydCA0c6qwXV9/sT+pzgV9IbDTJnlIR
TLSH
T193835A10A6A051FAEB63D075C2639F63FBB4B6C12395935F1092C65E1F33782AE39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_ssl.pyd
Size 175KB
SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
MD5 ed9242721197fd84231b38e6b42f3f55
SHA1 4333b9d43a120a6528f63cdba798c8153e8bfdfa
SHA512 9b4b94f6bf927c07e2e63bc6ee6140ec090c3063dee920d609dc49cb5ce30653ca2e32f4d6f700969082b79b836a276aa1c2fb17cf53f02c2d4f207a1f0d3552
SSDEEP 3072:l+59j9Gd6wNsBjj903ff6X32RP0o/aC6osf87vOifHZHmziXpIWC7Cz:l+v9Gd6BtGPf6X3fUaC+2Xp
TLSH
T1F2048D47B5841AB7D813E4F9C2234903DBB1F155331257DE48D6E6890F03B4AAEBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\_wmi.pyd
Size 39KB
SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
MD5 c7427027acbd9a0076b598fc71ee45a5
SHA1 cc2ab52f295e588f8bc99f23cc25467d7bfd9732
SHA512 e9ea1748c317b8439425306d44593a1210c552bd28cdbb20df2bf8e18041ea76d1c666e5fd2cc03268d48b5982f01de71136a079f083f4a62cab06d91fd114f4
SSDEEP 768:iEkKOex+l0WgNQqDpIWCiWOytxJEKrLy2Ip44oTxf1mltPRVQgM:iE9OtyNQqDpIWCiJytH/94UfIZReF
TLSH
T1DB037D89E6A80046EA63DBB5C9A6CE53F471B7D35B11D38F365582990F233C0E739329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\base_library.zip
Size 1.3MB
SHA256 e960747c71ef36c0b522b2bd3e6a46b6b0568d028f831733a879a258379d7eb2
MD5 546ff229029e339c015f216b908f45d5
SHA1 cd16e04f42b9c98394c9d51bffc577ca2141d674
SHA512 8922d36fae08f0c449c63571557f06c923058a7c354a58dc696388b17e0de9203f5a3618389433fd4c42fb333ae76718d3293c18bdf40df81ed07786a63359bf
SSDEEP 12288:O2/HRHbP1dmCnVTVihlyixmpvQXMHYR8lJGUmjDNzrmn9Kx/sEbRn9WcIU:O2/HFbP1dmCho8lJGUg69GTl9iU
TLSH
T1B155D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detail_ground.dds

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\art\beamngEarth\detail_ground.dds
Size 1.3MB
SHA256 d89c62cbc0ce0a5f821dc307f87ed6affbf8fb2cfef00e9a4d3f95e8be50999f
MD5 6f781ef6fd8764a81f5201824a9c2bd7
SHA1 1b9b578640a22d84ec79992a35b9909682aaa988
SHA512 507970ad06a551d52706a10cf4cdaf90ec13774aa61f73b0a1c428d97d7f777e7683e1219fe7c2c4247d29851a1fd859862c159a448de5e6a0227d98554c142c
SSDEEP 1536:e+VJs7tUY1hmGWD/tu8tblVGQ2K9fccFHxpAIzNC0YGerdkWwnLf6zxKci/G9Zv8:Ugu4fBRN20iFL1nnwfqh4
TLSH
T19C5516B5C289661ACDC548EAC9267CDE9091A5D35BDCB5E2B01E3E3FC13CE41C71932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.materials.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\runway\main.materials.json
Size 1KB
SHA256 7b18461423a320a23f13ed0a570d6d024d2a3bfc22ab432c5a079db252b66847
MD5 e90065a223d85ccf77476862e83c78f3
SHA1 12736520c506c4e557f0d4919c79f31a5438e46d
SHA512 68a45443a7b06307df4b1d7fa34f1ccdd94157fec105305205300009b99839d00c9128123caa417f8117925f9f72ffcb2bbdef191c3e1f0489cfda8f209e34e3
TLSH
T14831C022D298066F1A3D023C30690146F7084B1FAA3F1D8BF7F7165CDBB15E9960BBA4
MD5 SHA1 SHA512 TLSH

Submit Download

t_paint_white_b.color.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\runway\t_paint_white_b.color.png
Size 184B
SHA256 9f5684d5db858f3a981176aadddb5579146a6f1595abb51959b5ade188bc2049
MD5 2320a2d23808ac3de29710ad877b9b55
SHA1 c05c0291426dfb49184cc502fca5a233601dac15
SHA512 765d93d6d3220f851be63db87783281781ccbfb0286045100143558416681a3fa4b1c6a1a9aab0bb3402b84e54e667f301f3e09682f66e6b217dfa524744a25a
TLSH
T1BAC012DF4B406C75C1F4122310249070DA330425014384C956318439E1343C0D57EE01
MD5 SHA1 SHA512 TLSH

Submit Download

t_paint_yellow_b.color.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\runway\t_paint_yellow_b.color.png
Size 186B
SHA256 36458fb0abdda2132d241790c3e558f078a4161d521d7efae05f3fa6d699b6d8
MD5 39f1eafd704a183aacc1a14f3c3efcb5
SHA1 1d69d3c9b0a1e44e5e1c4fa6b69a99e93bc983dc
SHA512 668d66512e8e23afb9362f2a3988f8ae85269926eb12291f7b909a1accb85e4ab1121ac2e121a295c152ec217d00f9ba362fc1af196003fcb624cbde39ddd825
TLSH
T116C012CF8B455876C68C7177052F7C2CADB3046745019CCC4134D026EC05204C1C8676
MD5 SHA1 SHA512 TLSH

Submit Download

buildings.materials.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\shapes\beamngEarth\buildings.materials.json
Size 12KB
SHA256 8aa86b2797530e525f6e8b6aa5a9f2d43922a90bc724e8cd3f487bec360215ad
MD5 ae182db29cf3fd56ecdabfe8c287ec3d
SHA1 5b011db03f23b752fda6d1761e22f4ae60db46dd
SHA512 33c5fe51f60d86312a3c1fa03d66aca399c26ac6a82bf7bd6838b3e03e7f0f1d3cb0afa9677b538cad0baac3a5742d7eb36ed3af155d07f79f73fea524a44c97
SSDEEP 384:0fRxxAl/xNUVncwlftYV5xX/KcJC/IVFvUnvViywVsfEv8LOQUYYI8oyYnwXs+RS:iRxxW/xNAncCftYPxPzJcUFv+vVFwV6D
TLSH
T14A429A32D9692E7B807AA33E2478C597F514131BB0450C8FB3BC426C9FB34546A9FB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

far_palette.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\shapes\beamngEarth\far_palette.png
Size 2KB
SHA256 236a7ab8a9fc1038c12c12735a1bbfae8eb4c2d8dd98e339895dfd18ee462c19
MD5 5436e1d22a23f3df4c8379e05e571172
SHA1 d13df524756f2ea8858c4cb56f916f71a42dc804
SHA512 7b2f8775ed45b162f85fc717181ac23d7bca0d4fb79e946b0a5121e16a146829de12a156a6ceb3c5ac911e9fb333b667d02f5bac7ff77b646f6532a920b1128d
TLSH
T1CD514D6275012334C9320820DC19A152A5E0DCCA5C3E75679129D4FF50514F48CA20E2
MD5 SHA1 SHA512 TLSH

Submit Download

main.materials.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\shapes\beamngEarth\main.materials.json
Size 455B
SHA256 06ec4178b22ca306904dfec3e31959ac33f3e9b9094488422c999211428c05a9
MD5 4dff0e65c849ccad32d7f898d66be091
SHA1 5c41e662b6d93343082f72947bd09dc69bc1e79d
SHA512 f8647f4b4bebe29f0cfb28b4aadc176bb35a19227ff25be9eae48ccb85417a543d90a9e6a1c2b7f27bd0ae20e17eff932be2850c450aa5d9ae2674951a0f9650
TLSH
T15CF06132C9551EBF927B273C34554643FF40870B46C40E0B77BC512D5F721683985B85
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel.materials.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\shapes\beamngEarth\tunnel.materials.json
Size 11KB
SHA256 5f1bca21d81ef37478f0dd440af55eada44286622ec77a524995224b46fa1166
MD5 2768a67776f78ddcdecefbfccf41b2f6
SHA1 56832a247103cf7b82a2739a9f27d0ff784762a7
SHA512 4fa89d7b0afe1896b2eb8737c8b06cf7139454257df91a792b0bb404cad770aeb9f8251be4b7d814b4c0204531f7a3309ad7404a977606b360b1cb4de1ec187a
SSDEEP 192:srOyNlgFJMtptUAJrnp9ybJ3OxvEqgzEk9b0e205Ske2s7fHe2rtADveqpe2jp8o:srOyNlgFJm/UAJ7PybJ3itgzR9b0F05V
TLSH
T1F6327433C8596EAB95756B3F147C8682F500635BA088084BB7BC46AC8F735A4176FF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beamngEarth_flat_1024.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\beamngEarth_flat_1024.png
Size 2KB
SHA256 68733df894d47a9578e0c3dcd0bbcb38b4675b406c5ea6d059e42e0a7cb6a43b
MD5 05126781e7ee6fea4fa6e0ec67b23dba
SHA1 0574269cdeb89ec52772af61489191bd9bad71fe
SHA512 6a22de58c52fb9c5f080cb192f341879d3f7d415e9c276a40f0f97001767139b80d983bceb2b26d0b7f31e230ad7ca56e8ccb0ebfa8354c8f67f5f20c9570190
TLSH
T1C74124D744C0C434C1D5403FC0D50040DC74301D150103404003CD353DC5314405D305
MD5 SHA1 SHA512 TLSH

Submit Download

beamngEarth_flat_512.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\beamngEarth_flat_512.png
Size 588B
SHA256 5fc7d169d05868cdf69e8e3c37c35bd399ce7198218a1d033bb4fc675cc4a917
MD5 75c26be49f290173906c07482980f774
SHA1 fa6874bffed388888858dc557491e2b0027f58be
SHA512 31fd2c0729d4516278c20b7d726154be617ae9573c2a7ced9e09c60f5f0f469e5346e225c665c3039f907c811462a230b7ad074ef8ea5433763f02ec40a99a15
TLSH
T167F012E9C17E1D31C8CB1132446800105530611006820181030181241D81310005D203
MD5 SHA1 SHA512 TLSH

Submit Download

beamngEarth_layer_1024.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\beamngEarth_layer_1024.png
Size 4KB
SHA256 c98a86e4558781ad0abe9c23ea463ac000cf38d25f2db7860e73661a1224ff46
MD5 9c81538d8f7078c6841abde9674dd37c
SHA1 70d606f63872cb463ccc76cfc255ccd0467b1948
SHA512 c92015d5db567c4efd3a98bbd15fa7eaad762f2ad189150484b11183af6bca54d99906f962034ae1338dd6834441339768919eff7619fcd63af4904656446b36
SSDEEP 24:T17RK6rRK6rRSGrRSGJRSGJRuw7RJRuw7RKq7RK6rRK6rRSGrRSGJRSGJRuw7RJk:TGZXZXZXZj
TLSH
T1D491138282E2AF96C24DA53C40CF1412B81ABF140A02A30F832AFA2B3FF57F08846144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beamngEarth_layer_512.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\beamngEarth_layer_512.png
Size 1KB
SHA256 dcd927b55e091e2eb0d779d6e8d8fa669e6b8c42a7cd76fa300a1413f1568ad6
MD5 1aa8f209454f72a9d48a92fa47b4ea45
SHA1 eaf037756b17726472232f6e4c5e80a7f4f028cc
SHA512 4b21707299d0b09da5adf1cf8cf1d386a18e1529b1cede5b9b41debd013553834319317f4f82cc4b82e2f705563034872dd2e9ed60a3b796328472b12040cc55
TLSH
T1E531128352DBAC20CA23B0F140E42833D32E1D210503430C03016421EDBF3F0D108A41
MD5 SHA1 SHA512 TLSH

Submit Download

bngEarth_base_ao.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\bngEarth_base_ao.png
Size 2KB
SHA256 c55a575af66871a05ec1684c4a5f5b3dfc6fcb4053e339357cc716458784d5f0
MD5 05f0097db115725fe403cba3af8a16bc
SHA1 ec477ffe20a81d83468c4edfdeba5000b7353a66
SHA512 be2667e0f80f524f6bc8b3d1a047c0267fca4acd8b60c6cb6c459248e5f589cddd9b8c319a1bd4915cce6a48a8bca08a3fd74f004d1e9a53f03825a437a1c52a
TLSH
T1AD412BAEF0CF4810C6AC3A3181CB2C63B927E83F860A834883030BD83EB14F6C281180
MD5 SHA1 SHA512 TLSH

Submit Download

bngEarth_base_b.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\bngEarth_base_b.png
Size 4KB
SHA256 5d810cd3c6f9d4fb740323cdeb615d3fa5d6a24ab724a979ea8ad314d4d61d44
MD5 29277814e8e80d8afef7a44e9a172008
SHA1 228394678c60d0eec1ac3d1092c08ba2324dea72
SHA512 137f8d87436849d28b073d6b8f751b90b2481b03264635b36aff06001858167754ea8d12dcc659c7ee39c67bb3facf6a0ebb290b286a96f9b4ade096b65fa7e0
SSDEEP 24:TGfcL/rRSGJRSGJRuw7RJRuw7RKRuw7RK6rRK6rRS2rRSGJRSGJRuw7RJRuw7RKc:TGfcYZmvZmvZmvZmp
TLSH
T19E91139282E6AFD2C209A03D40CF0502781AEF010A07A34B0336EA2F3FF57F48C02054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bngEarth_base_h.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\bngEarth_base_h.png
Size 2KB
SHA256 437b3144834e865860784ee7595ccf49bfabaa9601e0c998304c100ec58857c5
MD5 1243378046b1d137c35e9faadf56965d
SHA1 71bea5956f9ee9a3771e348d14bd599b5450671f
SHA512 09bb5dba53a9aca2ea03153503785c38324c581e3a0c2523c88c11fcc21db4d815bb2558ac52505aa35ea9e5b0a61b354b4842b9db1442d50c7803151e8e4f2c
TLSH
T181414EF25C82C821C3CEF23C8B040313A404F32944B90307C372B9103F83B0A148D293
MD5 SHA1 SHA512 TLSH

Submit Download

bngEarth_base_nm.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\bngEarth_base_nm.png
Size 4KB
SHA256 72f0f964470fea5fbc7b9ba96f8c7fb4825d380934fb8cd843edf8e5f878457e
MD5 3e733b7b00d6658f9de54c67eb5a8dde
SHA1 a67d2d1e952f7103be6c2c31a987f7d97a2ab6b3
SHA512 82db00a8884130c5ad65e29c12dfe10651499ed3df14b330dcf634b35678fa71325d2d69d4afbd8998031608fcd558e81885cd11cb013a8c6db1c47e313d7642
SSDEEP 24:T55g+K6rRS6rRSGJRSGJRuwGJRuw7RKRuw7RK6vK6rRS6rRSGJRSGJRuwGJRuw7l:T55MWm3Wm3Wm3WmTV
TLSH
T13391135342B6AF92C608A43D00CF0413792ABF000A07A30F4326FB2F3FB13E48842041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bngEarth_base_r.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\bngEarth_base_r.png
Size 2KB
SHA256 3c1aa1fd32da47608842213edde7fea75147cae552b96c2cecce02f5956d816d
MD5 f9be63d530b6d1f698fd5c25b646a9a2
SHA1 95aa49869c844fd097a8c811ec1912add1f8f217
SHA512 fc3666d6f5c484ac9542ba975c1b842ed886dae459080b00bfa6f4c6fa6975093deb977ee908543780800f1bdd15b6551b02ab1b4b46fe091ec1e46534308944
TLSH
T178414EF25C82C820C3CEF63E8B0407036415F72544390347C732B8283F82716094D2A3
MD5 SHA1 SHA512 TLSH

Submit Download

bngEarth_flat_h_1024.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\bngEarth_flat_h_1024.png
Size 2KB
SHA256 27653a34f74adf04894200466c2cb44f92f59134ba49b4acdb0a48b7a82ebb3d
MD5 5925a89a747682dacc5ee773d97f8387
SHA1 2f23bf876bf1abbf4597bd2ea42652d3e943e1e4
SHA512 e1a722148b1a1f193047f01a9b4772da2371d950d9ee50b4541f7708eeec0b08df51fbd12b00b978071720bb4527992d4dd4cc217fafc6ae086d2a4f45b364c3
TLSH
T17C41F7EDF0CF88A0C60CB63641DB2C23342BE83F82028388830307E93E314F0E681184
MD5 SHA1 SHA512 TLSH

Submit Download

main.materials.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\art\terrains\main.materials.json
Size 25KB
SHA256 2cd886c1993a6d5bca25cee4add6b3718d92ba6b06a4b3806d9b58c46a47392f
MD5 0802683d314848e85e54829c54fc178c
SHA1 020877d7ef994bb27d13d6565e06f7bd3b90706b
SHA512 7ae31db38a8be7ccc77ef545f4e1de568fa26f3700af7483c2d0442afafc74941b310fd2b1a3f4030c6fd9a04df7da87c2a7e354d635309db621003911427de6
SSDEEP 768:pWPym4jB/WyaPWihP7QQaPWQ8lk4QaPWk8BzGQaPWj8BZ6QaPWzh1pZKaPWahbNO:pWPym4jB/WyaPWihP7QQaPWQ8lk4QaPW
TLSH
T178C21637C7050E9BA6BE1B7C61A9848BDA46535F80410B4B777CAE6CCF339642E93718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beamng_earth_preview.jpg

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\beamng_earth_preview.jpg
Size 143KB
SHA256 4d6f1bca5c9ccf939061b19c94531dd73600daaf9a63fdeae948bb78bb0c6293
MD5 92311394fb294d5b5f60b4b21824a9bf
SHA1 eeeea2c5202d0c895233986ec506f5e979bc5964
SHA512 18cda664a4ecf1a855d40763da7c616b9550c0a8d0512786b398b675b972cc28f089ea65a33848caaaa5e049ecaef3c6fb54012eca65d4cb60124353f4224792
SSDEEP 3072:JPYZQhFhvUWJMEZsWx4OqOeitMuD6mGhiWfBehUPsioG+XWe0AydAm:d8Ohv/9Z+iiuD7GUWfBsUPsHEe0APm
TLSH
T1C2E31236BED33E4AC96D8BB3835C350243B371B0D29FA6D1669E0B605325A3A1D87364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\info.json
Size 1KB
SHA256 e9ed7a201ef9c72129dc3790bc407e8c945a5f1d49d6c10548a1b96a03e3d5a1
MD5 cd8698b8563589df5d270b4573c700fc
SHA1 bda5d60c050ed8c9abd71868caae9f34844510f7
SHA512 979ec2a306c1eb5d0d47da7305d9c049ef11b4554504b10dde576f4397ef6dca23b5f57dcdc11b87934b34df502d8c4b5ba0ee904b5c630bcb978a0ada951eea
TLSH
T1BF210F27A62D493B06F216164D896183F7386B1F11A17E1AF1FED11D2B31E9BE048304
MD5 SHA1 SHA512 TLSH

Submit Download

items.level.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\main\MissionGroup\PlayerDropPoints\items.level.json
Size 346B
SHA256 5b09187b113d185dfbd1d40e5c53c83022c347125616e5337e6ece7ef92cc613
MD5 1a24fecda738b19ea32910ad875c8b68
SHA1 b3e57e32043fc16b15bdf79d7048769b713a1858
SHA512 b23a7b2ade7f77d52fe45958b13315d423102877076b1f09cbf715ad1dedc04a6a4425d94aaeb2569c99c3440465cef2e0d483d1c3cb4b23bcc64c2f5d5f77d9
TLSH
T115E08609F42B62BDA057D386EAA8171535686336E5096644EEE97F8400D815F712B045
MD5 SHA1 SHA512 TLSH

Submit Download

items.level.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\main\MissionGroup\Sky\items.level.json
Size 1KB
SHA256 3f6d9c5eb8fc702acb2b40a251c365d2d8f216adf268323d5342d4a11677e6c2
MD5 11756261250759dc118daded9f985491
SHA1 82a7b733c4ea2aea5032960f890da4c44c8baa32
SHA512 c0445bf6d8c1c1febd5460b0718bbc37d044d1f268aa5653a11c276747d94e3be1c747be0c7cac8aa9858fc6ca52e0466b34b68735f34ea9fc03b70c2514c297
TLSH
T1A531232AB36D1272F03FE2DBF513274D31E9B555C40D6E0199C99B8D87F2B6A11D9048
MD5 SHA1 SHA512 TLSH

Submit Download

items.level.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\main\MissionGroup\Weather\items.level.json
Size 1KB
SHA256 223f3756e56e9d21e6c15ca6451451d70bf4e5691c87b97440a847646c78755b
MD5 9ef321b960e55b32cc612f37ee3a47f7
SHA1 93d132002f5b2a37a7dcd1f13904e8e70a936a1a
SHA512 852c13669210ac39250fc2e5c188e1750fc0b2029683f9621cbcb13734a2208870bd9815e73ff32585bfe8a06e5230ac21d4b5375d066b5de3497caed60f8691
TLSH
T12931030DE23B4B7DF3579355983F370709B5A273ED0E9590E5ED89C48192651620361F
MD5 SHA1 SHA512 TLSH

Submit Download

items.level.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\main\MissionGroup\items.level.json
Size 376B
SHA256 87503505aa5fd3fc20f8bea9c038214353c09570f418c2fa72cf51c9a01ab12d
MD5 11292ec6669e16b051dca2a37354fbc4
SHA1 d52a841363a2df3078b384e44d111b00822e2862
SHA512 621da1982e8a8112a8cf5c153dd52ead23368934eee86139b56f6bc133032d2740ced3983bce0999bc23004fc9066b1e8d11e951e61aa29a37c2eb9c8435d7c9
TLSH
T17DE0489CF31E6578E6DA9B526336B65475701181E5CE3120F1C773D5856874133112FD
MD5 SHA1 SHA512 TLSH

Submit Download

items.level.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\mod\beamng_earth\levels\beamng_earth\main\items.level.json
Size 112B
SHA256 474526d134b8af1bdc9fc8df8540cdbc2ab155237c6d1bcba851e377f0d178db
MD5 a618833960cc9c0e7416c0db7b3cf674
SHA1 07b668d3ef9abb505d39e432bfc314368e77006a
SHA512 9b347bce90649c4404bdc8d8f4a6c7bd007842ebd863fd00112acd983cbaed8e9fba1c55d00c0c99f6cc3be6f36f00e78f96306b0362cd6129996d4188dd56fb
TLSH
T161B0128CE70E3535DCEBD710A33BB15574745591D1CB3230618777E4896854523116BC
MD5 SHA1 SHA512 TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\python3.DLL
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\select.pyd
Size 32KB
SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
MD5 74b93bc6c37d47011f92024f060c6784
SHA1 0e9cd2e881ad58818fc75b1fda765841995a92dd
SHA512 7c92a9c3d676ebf5211b93c7e44cbc77e17925d2ccaba97aa9b52d3fb4050e746ea4a86e82f9553717ddeffade3aaf518563a442578899bc05d65cac57031b58
SSDEEP 768:gFOLHfEDnlIWQGiOytxJEKrLy2Ip4MTxf1mltPRVugwH:gFOL/EDnlIWQG9ytH/9gfIZRsXH
TLSH
T146E27D8AAB245087F963CA7186A2CE43F939B7E3471146CF30A5D2991E237C1B73A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000007ac68627a\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3236-287-0x0000024214EE0000-0x0000024215021000-memory.dmp

Download

memory/3236-286-0x00007FFF667E0000-0x00007FFF67B8D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads