demonware | d92304ada292879d98338d850482ba020ac0f68b93dec492487b897e29d65929

Analysis

max time kernel
81s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
23-03-2021 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de6717de7bd1daa595c0b00887c25f05.exe
Size

8.3MB
MD5

de6717de7bd1daa595c0b00887c25f05
SHA1

f70cc94796e6f89499a3958d7fd2001e50a984f0
SHA256

95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44
SHA512

eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Score

10^/10

demonware ransomware spyware stealer

Malware Config

Extracted

Path

\??\c:\README.txt

Ransom Note

Your files have been uploaded to our server and encrypted! They cannot be decrypted without our key, which was generated individually for your computer. The only thing you can do now is to buy a key and a decoder within 10 hours! If you do not, after 10 hours your private key will be deleted from our server, you will lose your encrypted files forever, and we will publish your files on the internet. Send 0.006 Bitcoin to the BTC address: bc1qhffuqkuwmenevjq6erfkfr043qv2dlgujq4h0g Then send the transaction ID and your ID to the following email address: [email protected] or [email protected] We respond to emails only after receiving the payment. After payment, we will send our decoder and decryption code to your computer within a few hours. You just need to run it and it will ensure that all the files are automatically decrypted (unless you have renamed or changed them)! Don't worry, if the conditions are met, all your data will be restored and deleted from our server. We have no reason to cheat you after payment. < < Where can I buy and send Bitcoins?> > The easiest way to buy Bitcoins is through the LocalBitcoins website. You need to register, click the "buy bitcoin" button and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins or https://bitcoin.org/en/buy https://buy.moonpay.io Here you will also find other places to buy bitcoins and a beginner leader: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ ATTENTION! Antivirus software, third-party services, or any other person cannot decrypt your files, and attempts to change, rename, or move your files may damage them, and even we cannot recover them. YOUR ID:'as2552t'0fd4b'36b40cc95f7bbeefcc32cb01789c6035'

Emails

[email protected]

Wallets

bc1qhffuqkuwmenevjq6erfkfr043qv2dlgujq4h0g

URLs

https://bitcoin.org/en/buy

https://buy.moonpay.io

Signatures

DemonWare
Ransomware first seen in mid-2020.
ransomware demonware

Drops file in Drivers directory 11 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	ioc	Process
File created	\??\c:\Windows\System32\drivers\gmreadme.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\drivers\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\drivers\etc\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\drivers\UMDF\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\drivers\UMDF\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\drivers\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\drivers\gmreadme.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\drivers\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\drivers\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ConnectStart.tiff => \??\c:\Users\Admin\Pictures\ConnectStart.tiff.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\ExportConvertTo.tiff => \??\c:\Users\Admin\Pictures\ExportConvertTo.tiff.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\FindMove.tiff => \??\c:\Users\Admin\Pictures\FindMove.tiff.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\ImportConvertTo.tiff => \??\c:\Users\Admin\Pictures\ImportConvertTo.tiff.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\RepairConfirm.png => \??\c:\Users\Admin\Pictures\RepairConfirm.png.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\StepRead.raw => \??\c:\Users\Admin\Pictures\StepRead.raw.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConnectStart.tiff	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ExportConvertTo.tiff	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Users\Admin\Pictures\FindMove.tiff	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\HideExpand.tif => \??\c:\Users\Admin\Pictures\HideExpand.tif.DEMON	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ImportConvertTo.tiff	de6717de7bd1daa595c0b00887c25f05.exe
File renamed	C:\Users\Admin\Pictures\BlockLock.png => \??\c:\Users\Admin\Pictures\BlockLock.png.DEMON	de6717de7bd1daa595c0b00887c25f05.exe

Drops startup file 2 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	ioc	Process
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt	de6717de7bd1daa595c0b00887c25f05.exe

Loads dropped DLL 28 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

pid	Process
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe
4952	de6717de7bd1daa595c0b00887c25f05.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 64 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	ioc	Process
File created	\??\c:\Windows\System32\Speech_OneCore\common\en-IN\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\netwlan92de.inf_amd64_e48f9eb16b3dd4ad\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\WDI\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\AdvancedInstallers\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\Bthprops\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\developerManagedField.xsd	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Bthprops\@BthpropsNotificationLogo.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_ede380323efcbed0\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\MSDRM\MsoIrmProtector.doc	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\adp80xx.inf_amd64_34edb3ca4931f453\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\wdma_bt.inf_amd64_4b782efaabec37d0\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MX860\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmcommu.inf_amd64_c6bc3a628d9392be\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\InputMethod\JPN\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\F12\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\Setup\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\InstallShield\setupdir\0006\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_b6a660072776cd4f\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnxxcl3.inf_amd64_0fb0ea0c17a53da0\xrBAPSm0-pipelineconfig.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MP270\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_afddbbd6046998bc\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnhpcl2.inf_amd64_17ed6c3130d87c50\amd64\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnxxcl3.inf_amd64_0fb0ea0c17a53da0\xrFFPSc0-pipelineconfig.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\Speech_OneCore\Common\zh-CN\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_01a16e5ddbb3eb7a\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\icsxml\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\spool\drivers\W32X86\{D10F218C-546C-4178-A37D-3243F7CB8BB6}\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Dism\en-US\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\c_processor.inf_amd64_2d9642eafe650480\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnnecl2.inf_amd64_fdd93c90b4633940\nepclbw-pipelineconfig.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\structureTaskExecution.xsd	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\spp\tokens\legacy\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmusrg.inf_amd64_b4db812ecadbbe2b\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prnfxcl2.inf_amd64_f26eeb7da72ee32b\fxhb1-PipelineConfig.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Speech_OneCore\common\zh-CN\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Schemas\PSMaml\inline.xsd	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_e39045a84bf729cf\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmsupr3.inf_amd64_c524b55f6149fcef\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\winusb.inf_amd64_965273be3ff6ea50\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Schemas\PSMaml\developerManagedConstructor.xsd	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Schemas\PSMaml\blockCommon.xsd	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\wgencounter.inf_amd64_bdd64cbba1f77e90\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Licenses\neutral\_Default\Professional\license.rtf	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\spool\drivers\x64\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{78f918bb-500d-41de-a2a8-94409ad35eed}\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\prncacl1.inf_amd64_5cab2573ec016b93\CNN08CL1_bidispm.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_c728b169dea3b397\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MP493\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\cht4sx64.inf_amd64_a14ad2feae124ba7\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_3f5d0d49cfee1d0a\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\pt-PT\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ProviderHelp.xsd	de6717de7bd1daa595c0b00887c25f05.exe

Drops file in Program Files directory 64 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-200.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-200.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\fy\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreSmallTile.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\tripeaks_menu_icon.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-125.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\TriPeaks\Control_1.jpg	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\comment.svg	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\11d.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\ResetCoord.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5601_48x48x32.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6924_40x40x32.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96_altform-unplated.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\SmallTile.scale-125.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\sand.jpg	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\CheckMark.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-200.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\music.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7e3.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-400.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\bandit.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\kh_60x42.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_12c.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\ui-strings.js	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-125.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\PCMobileValueProp.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\AppxManifest.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\logo.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\gt_16x11.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ge_16x11.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-150.png	de6717de7bd1daa595c0b00887c25f05.exe

Drops file in Windows directory 64 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	ioc	Process
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-125.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_10.0.15063.0_none_2f3f1dfd8cb03410\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-c...speechhelp.cortana_31bf3856ad364e35_10.0.15063.0_none_e1bce38acad169f7\SpeechHelp_AssistantEnabled_en-GB.json	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.15063.0_none_224b97ad28ee338b\NewWindowIcon.scale-125.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SystemApps\Microsoft.PPIProjection_cw5n1h2txyewy\Assets\Wide310x150.Scale-180.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_e44623d5eedb9015\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-i..ocale-nls.resources_31bf3856ad364e35_10.0.15063.0_en-us_f86d54402b6fb74b\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.15063.0_none_64b3af92ba4e8a1f\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_ts_wpdmtp.inf_31bf3856ad364e35_10.0.15063.0_none_eb6c5c3b78df7c8f\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.15063.0_en-us_4e8d8691a8aa30cf\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Animation\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-48_altform-unplated.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_dual_c_fssystemrecovery.inf_31bf3856ad364e35_10.0.15063.0_none_c62c4cfc2de59d75\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.15063.0_none_13cc520b866eaf57\hololens.css	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_hyperv-integrationservices.resources_31bf3856ad364e35_10.0.15063.0_en-us_069e7f04d6f17d01\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-d..settingsenvironment_31bf3856ad364e35_10.0.15063.0_none_9c871f3667ce2364\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.15063.0_none_7a7f08f436397aad\SquareTile71x71.scale-400.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-energy-winrt.resources_31bf3856ad364e35_10.0.15063.0_en-us_b9911b2027b47afd\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\inner glow.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\326_24x24x32.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-150.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\x86_netfx4-cfx_extended_sql_files_b03f5f7f11d50a3a_4.0.14917.0_none_d6e79e606cdbbc1c\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\desktop\en-US\doc_offline_getconnected.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_taskschedulersettings.resources_31bf3856ad364e35_10.0.15063.0_en-us_0480e43f66867c79\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Assets\Icons\custom-Cortana\WideTile.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft-windows-s..tebox-isv.resources_31bf3856ad364e35_10.0.15063.0_en-us_7743ebf2f5296130\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-t..erver-adm.resources_31bf3856ad364e35_10.0.15063.0_en-us_ad06aa5f610782a5\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state_perf.h	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030409_31bf3856ad364e35_10.0.15063.0_none_e53d030f7271eed5\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-printrenderapihost_31bf3856ad364e35_10.0.15063.0_none_eb921165fe3353b5\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-p..r-aggregator-events_31bf3856ad364e35_10.0.15063.0_none_34cf344f32c27ce0\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft-windows-difxapi_31bf3856ad364e35_10.0.15063.0_none_bd38db4416a3648f\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\jo_60x42.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\Traffic.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.15063.0_none_07689c20cc7d9d71\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_dc1-controller.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_83583f771f5cbf56\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-s..entication-usermode_31bf3856ad364e35_10.0.15063.0_none_558a46bee183e781\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.15063.0_none_d94f4e4690167e72\AnswerWithVideo.scale-100.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\wow64_windows-id-connecte..-wlidprov.resources_31bf3856ad364e35_10.0.15063.0_en-us_16c0e29726e0f652\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SystemResources\Windows.SystemToast.Calling\Images\Ignore.scale-300.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-winocr-tifffilter_31bf3856ad364e35_10.0.15063.0_none_4436d1662471350e\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.AppTk.NativeDirect3d.UAP\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_dual_c_extension.inf_31bf3856ad364e35_10.0.15063.0_none_6ce375a7a4bb6a11\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_10.0.15063.0_none_a35acfd475d2e0cc\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_prnnecl2.inf_31bf3856ad364e35_10.0.15063.0_none_7c637ba618f8275f\nehb0-PipelineConfig.xml	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_1429b206663d6e79\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-400.png	de6717de7bd1daa595c0b00887c25f05.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\error.aspx	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\Assets\TinyTile.scale-150.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\SplashScreen.scale-400.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5630_32x32x32.png	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\microsoft.system.package.metadata\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\amd64_system.web_b03f5f7f11d50a3a_4.0.15552.17062_none_bec6b5a22a4c6dcb\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft-windows-version_31bf3856ad364e35_10.0.15063.0_none_c9f38ce4d1570426\README.txt	de6717de7bd1daa595c0b00887c25f05.exe
File created	\??\c:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ye_60x42.png	de6717de7bd1daa595c0b00887c25f05.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

de6717de7bd1daa595c0b00887c25f05.exe

description	pid	Process	procid_target
PID 4764 wrote to memory of 4952	4764	de6717de7bd1daa595c0b00887c25f05.exe	71
PID 4764 wrote to memory of 4952	4764	de6717de7bd1daa595c0b00887c25f05.exe	71

C:\Users\Admin\AppData\Local\Temp\de6717de7bd1daa595c0b00887c25f05.exe
"C:\Users\Admin\AppData\Local\Temp\de6717de7bd1daa595c0b00887c25f05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\de6717de7bd1daa595c0b00887c25f05.exe
  "C:\Users\Admin\AppData\Local\Temp\de6717de7bd1daa595c0b00887c25f05.exe"
  2⤵
  - Drops file in Drivers directory
  - Modifies extensions of user files
  - Drops startup file
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:4952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\README.txt

MD5
ce4c458958f8d91f290599d05096ee3c

SHA1
5e219874e27649e9a6927ee42677a23cf83cac44

SHA256
f8a32faeaede3494bf4a3b3979900da0be168e72cf4fc6e36eec64b6ffee295d

SHA512
91bcd6ba88bfa6887e18b5e3197c9e542175451407acd31d05ea50846aa67a3e569f1df8ac4a4292bd15d4eb0902b4631239f0ff6950aa7243baf558a27cda0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_Salsa20.cp39-win_amd64.pyd

MD5
4b2a7333c46b2b9ff31ea051adfbc3e3

SHA1
e70b24eef379174dd1448a224456bd23d029f2da

SHA256
32724cd93515e542b24887c714e825d16f38dfc6c762711f566bf65c816a374c

SHA512
23ae6237349446706c9e32f7422eb709ec0f37e4b65a9d039ec7a593adec42aa15abb4fdd7886dd7c410c9d2597eeb1966bf05b71ff59cd80ba2638132cdeb55

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_aes.cp39-win_amd64.pyd

MD5
a46090cb7d60e16fa522cd6c3f36e9a7

SHA1
593ac9bdbf89e83d9b479a0d5e12ceb45ae3cd12

SHA256
82dc61e6e19ec8a75c8a1efeaf7f49c77585dca8315979f64196a8b974938f7e

SHA512
895731152f48607d690a117127d055865f37a54d8821838dc6f763f688a5e2cbb00c4723366722a1b833f4dcfcacf9d1806ea66d4884700b7a445f596a9a08d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_cbc.cp39-win_amd64.pyd

MD5
f3685f2d6bafab5c239caea7dc7faf67

SHA1
25e90e2c4d2a28391d060b8b842a036afa980c61

SHA256
be805b0cc32419859fbf0fc06c00fb178e49b51d67add736dc43750495fe0d06

SHA512
a502ef565288d4ff14cbbf8ea58f501a15b9565f5d6087e8b4cc2515d23df2b61dea8698562b755051891485acc940be57710799ae0ae75c2bd969d81ff5ffe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_cfb.cp39-win_amd64.pyd

MD5
16c56e3fb3c8b6792aa81fc27e3b3bac

SHA1
52c089d2e970728062d57f127e51638f657f2898

SHA256
cae7b092bf323d5fb9bd97faa8839f9df6e946fe5cc5bf651d04e22b320fd280

SHA512
be1f8152fe5fdb788e73ffddad19b670d50af44ae922d7703351c2677c1068b58c4be5952c95f6fd7a207d5e7433f65a3ee3d8196c5dc7a08f98912600177fb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ctr.cp39-win_amd64.pyd

MD5
5b0ae53ac88cdcc5a8c959b619421f2c

SHA1
13d6bfd61bdaf72b05b070c79e49f0c57d75b49c

SHA256
030ba5b4aafda597cc62c2f340a2b2cdc15280b1f08f52c27a6aca4e34ad3870

SHA512
ad8e6bde4eb75ed921432e8d10ca15b1a6d890875f65e9214694a204a987dbbdc99b669c984df2cc6349f18ccc7f812d573856eddb30d8aa7a3646c7857378ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ecb.cp39-win_amd64.pyd

MD5
f7d18c30f58bb64108955dcbdbd9e767

SHA1
f0678e2a89a18f7b9f777419e1544a2923787fa6

SHA256
ed33378b96f14afd0a181594fc6529c5fad386d62e156975151a2d3df3f3043e

SHA512
7d101bb7ed27b0ab39c159aa4052181f500ac0213d555afc0e3f43fd07cdb62bf95aeb77a124913623d40e7b052bec4842862063e4cbb1f690f2ad92908b9b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ocb.cp39-win_amd64.pyd

MD5
4b12f3f2a5b2ff96b31b239a2ac3fab5

SHA1
6ae8ace50173bb068b25a80b5c4c6c66048e6982

SHA256
194ca4e6d6495a75d5f1480f2533d4f3637571c1b28b8f0fccd090f5d5451784

SHA512
894509da0fc4cf2fb5cab302f827978601d142c6ae3186059c743650866209782bedf14492464973792e7655d49c0fb8101bcf34cb070cfaccd1e1c971db0f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ofb.cp39-win_amd64.pyd

MD5
3605b34ca8944fcf8e3f9195ee19a5be

SHA1
2f55c8a236d5c1894d120b3f1493bc1c71519bc7

SHA256
b7cfa8ff75d2717e1ac01f95fa30def3f50b0661c37326f8081d281881305c21

SHA512
bb45388ec0794e0ea3d1c35afb3ec7ccd29f2c07fd186669f26069fa2b938f7c7200dd94a6cd8d7bdd46ac26527991f75d14f4383ceefe5f4413af7574737897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\README.txt

MD5
ce4c458958f8d91f290599d05096ee3c

SHA1
5e219874e27649e9a6927ee42677a23cf83cac44

SHA256
f8a32faeaede3494bf4a3b3979900da0be168e72cf4fc6e36eec64b6ffee295d

SHA512
91bcd6ba88bfa6887e18b5e3197c9e542175451407acd31d05ea50846aa67a3e569f1df8ac4a4292bd15d4eb0902b4631239f0ff6950aa7243baf558a27cda0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_BLAKE2s.cp39-win_amd64.pyd

MD5
3b0dd732bf6058b1ed797fbb8e3bc9d1

SHA1
3f13a5e708b1b26f670cfc9aa5b3ecd84382abae

SHA256
7d1d5226be5f7e5a64be5c0334d1bc0654f95c4264a4ae188b1f6d3975f7f12d

SHA512
9121c1dfd4094a12ffae1e91069020cc3e8fb23197f3674cf14279200448c12bd6377dbf18479473e139ea22375b09058f052c2db716d59f90a832210d1a4754

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_MD5.cp39-win_amd64.pyd

MD5
0824637de685a4bc801deddd2e519243

SHA1
046f08ad0751b5add4b7b74fbf0247979ddb8432

SHA256
3f56f08f3ceaec70cec7b45bd69c83999446ba0dfddc6636c05f0cde2fb9b1e6

SHA512
968dbd28dfe1d91e3a393a49f0baec2a5663925264cd253ae489e67b92d606c9787049481aee4c3370344f2ea46e9320de5c1ead828f71fae727f45d926d2cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_SHA1.cp39-win_amd64.pyd

MD5
99252cd54dac09c53ada74e50d6d14ef

SHA1
b6e06d8fcecac0f7b48deda17e02fc4874c4f3fc

SHA256
da5a46d672008f2da7e016d47e8d10b8d343e386f5a1ed534d9986b9dc3ab821

SHA512
da6207291d26f201acd2a26131de2846caa7d61f1a48618e8ccf7f3bdb05012bf70fb5bec69320505b5f00e07a4b2bdc6fefc2d00ed22bb6c500d16f270f90ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_SHA256.cp39-win_amd64.pyd

MD5
9928250fbb57d753734ae34b41f6dc28

SHA1
674944db6d4bb0718ab6c5327f6896df01f78470

SHA256
2a1a9df342e7261425e7e83b674b32fc49918b970f147c728ca018cd9f3dffa5

SHA512
799184eab64a273dd4c5d76b780fd8a86bb535557957f360fe8d85254a52c14a461ee9f4fce14dd892faf12235150d8ecd8afebc38fae1222e128ee7b7ba96aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_ghash_portable.cp39-win_amd64.pyd

MD5
f869255edd2c17f103d9330a3daf18d7

SHA1
f1d9e5fc4406685ce966a82c8b7ed33e3520fd95

SHA256
9dacae80d6127546f0ceb0a36bfcaf34ac1cdc12ab30bf6165df15997a91a7c8

SHA512
6194dcf030d5e87cdf6e1a8da0ed2304969279c6dbdecc73baf09ffa5fc65a449a68a233db987507846598c6d97f6acd6165f7a60ec42dcf980b69f830f1a0c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Math\README.txt

MD5
ce4c458958f8d91f290599d05096ee3c

SHA1
5e219874e27649e9a6927ee42677a23cf83cac44

SHA256
f8a32faeaede3494bf4a3b3979900da0be168e72cf4fc6e36eec64b6ffee295d

SHA512
91bcd6ba88bfa6887e18b5e3197c9e542175451407acd31d05ea50846aa67a3e569f1df8ac4a4292bd15d4eb0902b4631239f0ff6950aa7243baf558a27cda0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Protocol\README.txt

MD5
ce4c458958f8d91f290599d05096ee3c

SHA1
5e219874e27649e9a6927ee42677a23cf83cac44

SHA256
f8a32faeaede3494bf4a3b3979900da0be168e72cf4fc6e36eec64b6ffee295d

SHA512
91bcd6ba88bfa6887e18b5e3197c9e542175451407acd31d05ea50846aa67a3e569f1df8ac4a4292bd15d4eb0902b4631239f0ff6950aa7243baf558a27cda0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Protocol\_scrypt.cp39-win_amd64.pyd

MD5
1509827b82033c9497af8b2ab5d2ebdd

SHA1
f8d7ea32b981274136e7bbacdd1b47984cfeb0a7

SHA256
20a9494be4478051f62c18e98bb726be67d2d74df00c66afa754cbebf009616f

SHA512
21c752339467b7478e29d1c4e6b0ec6534dcd5abdabc69189acd3898bef51b823b6a0ca25e9c18599f594e2c2dd0b8a0273f7355737345718f3820ab105a799f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\PublicKey\README.txt

MD5
ce4c458958f8d91f290599d05096ee3c

SHA1
5e219874e27649e9a6927ee42677a23cf83cac44

SHA256
f8a32faeaede3494bf4a3b3979900da0be168e72cf4fc6e36eec64b6ffee295d

SHA512
91bcd6ba88bfa6887e18b5e3197c9e542175451407acd31d05ea50846aa67a3e569f1df8ac4a4292bd15d4eb0902b4631239f0ff6950aa7243baf558a27cda0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Util\_cpuid_c.cp39-win_amd64.pyd

MD5
852d4fb59d01b9d1de79fe3d0f281c03

SHA1
e8a4f36abb041c1928b92fc57f51510a3bac86e3

SHA256
4aee6a9621fe296fd2608364d34bdada63a34f64606623e73466e5183e9b6f8e

SHA512
3f047f90240e54a6b7b289fa740bb02e8fa101fa5d85898b55365eadebc894994c374ccd5da24ff658c98ac740f060a396bc3882e78d2aa36ca3141e398ff207

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Util\_strxor.cp39-win_amd64.pyd

MD5
138500067f9c2e9ff72a108e13b3e182

SHA1
0ffaa57ab0193eb3fdda315e32f41f8dd5c9c649

SHA256
c8da8ad5af56d5d5ba7d338ab23f5f78239229218a6ac2735564b5d08b2da3f3

SHA512
2887553b7358475795d8f7394e60321998355516065b46a436de4e488dbbf6b4104c45def6ad714bdd3105c3602838aab9306cb1742c02512c1056b53ad4fc33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\VCRUNTIME140.dll

MD5
7942be5474a095f673582997ae3054f1

SHA1
e982f6ebc74d31153ba9738741a7eec03a9fa5e8

SHA256
8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

SHA512
49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_bz2.pyd

MD5
499462206034b6ab7d18cc208a5b67e3

SHA1
1cd350a9f5d048d337475e66dcc0b9fab6aebf78

SHA256
6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

SHA512
17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_cffi_backend.cp39-win_amd64.pyd

MD5
f5bf6a2926c1106cc6b72dca1157e04f

SHA1
58875e55b42def38bb748c5f70cd37ae93d44ef2

SHA256
3d3aeb22fd97a8bd2fee53412ce43466c76f22a1fd918b769ab6a58bf859d5a2

SHA512
95610daabc3c150f606184feb66459e30a3a0b509a7adf40806601d83e821c5d5f5afc2af8d0eb1cad92cabf6d3aff21c9a35094fba1cfa8faed5293a8f2c986

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_ctypes.pyd

MD5
b74f6285a790ffd7e9ec26e3ab4ca8df

SHA1
7e023c1e4f12e8e577e46da756657fd2db80b5e8

SHA256
c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

SHA512
3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_hashlib.pyd

MD5
60f420a9a606e2c95168d25d2c1ac12e

SHA1
1e77cf7de26ed75208d31751fe61da5eddbbaf12

SHA256
8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

SHA512
aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_lzma.pyd

MD5
bc118fb4e14de484452bb1be413c082a

SHA1
25d09b7fbc2452457bcf7025c3498947bc96c2d1

SHA256
ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

SHA512
68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_socket.pyd

MD5
0df2287791c20a764e6641029a882f09

SHA1
8a0aeb4b4d8410d837469339244997c745c9640c

SHA256
09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

SHA512
60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\base_library.zip

MD5
0e3b184c123664e2326cfd12517f802b

SHA1
7530b800cbe4d561427ef5a3e5c388603a17172e

SHA256
c2f4ba003df4d932770a3602e6bdf9988b39aa46b48f44433bafe5c80667d135

SHA512
e68fdf902991ddf15803eef01bd3d0b603dcc57c05b723ea533babe1151604fa4414a8ef18545b406e843c9ea7cd20a0374ed723a77c26ea21a62a64b925e6d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\base_library.zip.DEMON

MD5
80bfdea3c1ec779c7211b6ff65bb68db

SHA1
b046a47812cd0ac21ff83655afdcd9062e0e11ad

SHA256
c47cde30e898c32bb8ae2c12dd7a7959c93ceceb55569424bda1d3919968f0ac

SHA512
f24fe4d8a251499d691b0e992852a60d5e66049e28f538941378d990bae723896e4289201e452f093ba128e3b58be6be3829738a2576b336e7fdb6e68e019f1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libcrypto-1_1.dll

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libffi-7.dll

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\pyexpat.pyd

MD5
ed82c3f14a839092d2d9d27092a19640

SHA1
41ffcd82998b003c1e83961c329379d3512c863f

SHA256
2d59ddb10d0fa2516da1e879d2b3f180272160a4325f705d4e71ed21b90438b8

SHA512
1b25165bda699c8e1a37e022d3412a4a6e780c1f93b2880aa67902811b0971fee0b100ad561271d23c4b7dc36eae6ee5af40b19481df75285db35d15c0904bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\python39.dll

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\select.pyd

MD5
a2a4cf664570944ccc691acf47076eeb

SHA1
918a953817fff228dbd0bdf784ed6510314f4dd9

SHA256
b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

SHA512
d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\_MEI47642\Include\pyconfig.h

MD5
d05b864e86c9798e387d0edab3e39add

SHA1
ec4504d65b7df6880acd9193b9d23b42ee65bae8

SHA256
07b81e3acd9a6235fd5ffd40ebf20983dfce021ec1aa6ad0fe65d77c2d85c296

SHA512
e25451280e8270d96bd1ad92426b387b204db05d3147bac565d811c8c7dc69028236a9cab145d87dbd90ec9262aece4d25f0d2afa0686556c265dd86e9b7e476

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_Salsa20.cp39-win_amd64.pyd

MD5
4b2a7333c46b2b9ff31ea051adfbc3e3

SHA1
e70b24eef379174dd1448a224456bd23d029f2da

SHA256
32724cd93515e542b24887c714e825d16f38dfc6c762711f566bf65c816a374c

SHA512
23ae6237349446706c9e32f7422eb709ec0f37e4b65a9d039ec7a593adec42aa15abb4fdd7886dd7c410c9d2597eeb1966bf05b71ff59cd80ba2638132cdeb55

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_aes.cp39-win_amd64.pyd

MD5
a46090cb7d60e16fa522cd6c3f36e9a7

SHA1
593ac9bdbf89e83d9b479a0d5e12ceb45ae3cd12

SHA256
82dc61e6e19ec8a75c8a1efeaf7f49c77585dca8315979f64196a8b974938f7e

SHA512
895731152f48607d690a117127d055865f37a54d8821838dc6f763f688a5e2cbb00c4723366722a1b833f4dcfcacf9d1806ea66d4884700b7a445f596a9a08d7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_cbc.cp39-win_amd64.pyd

MD5
f3685f2d6bafab5c239caea7dc7faf67

SHA1
25e90e2c4d2a28391d060b8b842a036afa980c61

SHA256
be805b0cc32419859fbf0fc06c00fb178e49b51d67add736dc43750495fe0d06

SHA512
a502ef565288d4ff14cbbf8ea58f501a15b9565f5d6087e8b4cc2515d23df2b61dea8698562b755051891485acc940be57710799ae0ae75c2bd969d81ff5ffe9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_cfb.cp39-win_amd64.pyd

MD5
16c56e3fb3c8b6792aa81fc27e3b3bac

SHA1
52c089d2e970728062d57f127e51638f657f2898

SHA256
cae7b092bf323d5fb9bd97faa8839f9df6e946fe5cc5bf651d04e22b320fd280

SHA512
be1f8152fe5fdb788e73ffddad19b670d50af44ae922d7703351c2677c1068b58c4be5952c95f6fd7a207d5e7433f65a3ee3d8196c5dc7a08f98912600177fb1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ctr.cp39-win_amd64.pyd

MD5
5b0ae53ac88cdcc5a8c959b619421f2c

SHA1
13d6bfd61bdaf72b05b070c79e49f0c57d75b49c

SHA256
030ba5b4aafda597cc62c2f340a2b2cdc15280b1f08f52c27a6aca4e34ad3870

SHA512
ad8e6bde4eb75ed921432e8d10ca15b1a6d890875f65e9214694a204a987dbbdc99b669c984df2cc6349f18ccc7f812d573856eddb30d8aa7a3646c7857378ad

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ecb.cp39-win_amd64.pyd

MD5
f7d18c30f58bb64108955dcbdbd9e767

SHA1
f0678e2a89a18f7b9f777419e1544a2923787fa6

SHA256
ed33378b96f14afd0a181594fc6529c5fad386d62e156975151a2d3df3f3043e

SHA512
7d101bb7ed27b0ab39c159aa4052181f500ac0213d555afc0e3f43fd07cdb62bf95aeb77a124913623d40e7b052bec4842862063e4cbb1f690f2ad92908b9b6c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ocb.cp39-win_amd64.pyd

MD5
4b12f3f2a5b2ff96b31b239a2ac3fab5

SHA1
6ae8ace50173bb068b25a80b5c4c6c66048e6982

SHA256
194ca4e6d6495a75d5f1480f2533d4f3637571c1b28b8f0fccd090f5d5451784

SHA512
894509da0fc4cf2fb5cab302f827978601d142c6ae3186059c743650866209782bedf14492464973792e7655d49c0fb8101bcf34cb070cfaccd1e1c971db0f3f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ofb.cp39-win_amd64.pyd

MD5
3605b34ca8944fcf8e3f9195ee19a5be

SHA1
2f55c8a236d5c1894d120b3f1493bc1c71519bc7

SHA256
b7cfa8ff75d2717e1ac01f95fa30def3f50b0661c37326f8081d281881305c21

SHA512
bb45388ec0794e0ea3d1c35afb3ec7ccd29f2c07fd186669f26069fa2b938f7c7200dd94a6cd8d7bdd46ac26527991f75d14f4383ceefe5f4413af7574737897

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_BLAKE2s.cp39-win_amd64.pyd

MD5
3b0dd732bf6058b1ed797fbb8e3bc9d1

SHA1
3f13a5e708b1b26f670cfc9aa5b3ecd84382abae

SHA256
7d1d5226be5f7e5a64be5c0334d1bc0654f95c4264a4ae188b1f6d3975f7f12d

SHA512
9121c1dfd4094a12ffae1e91069020cc3e8fb23197f3674cf14279200448c12bd6377dbf18479473e139ea22375b09058f052c2db716d59f90a832210d1a4754

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_MD5.cp39-win_amd64.pyd

MD5
0824637de685a4bc801deddd2e519243

SHA1
046f08ad0751b5add4b7b74fbf0247979ddb8432

SHA256
3f56f08f3ceaec70cec7b45bd69c83999446ba0dfddc6636c05f0cde2fb9b1e6

SHA512
968dbd28dfe1d91e3a393a49f0baec2a5663925264cd253ae489e67b92d606c9787049481aee4c3370344f2ea46e9320de5c1ead828f71fae727f45d926d2cb9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_SHA1.cp39-win_amd64.pyd

MD5
99252cd54dac09c53ada74e50d6d14ef

SHA1
b6e06d8fcecac0f7b48deda17e02fc4874c4f3fc

SHA256
da5a46d672008f2da7e016d47e8d10b8d343e386f5a1ed534d9986b9dc3ab821

SHA512
da6207291d26f201acd2a26131de2846caa7d61f1a48618e8ccf7f3bdb05012bf70fb5bec69320505b5f00e07a4b2bdc6fefc2d00ed22bb6c500d16f270f90ee

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_SHA256.cp39-win_amd64.pyd

MD5
9928250fbb57d753734ae34b41f6dc28

SHA1
674944db6d4bb0718ab6c5327f6896df01f78470

SHA256
2a1a9df342e7261425e7e83b674b32fc49918b970f147c728ca018cd9f3dffa5

SHA512
799184eab64a273dd4c5d76b780fd8a86bb535557957f360fe8d85254a52c14a461ee9f4fce14dd892faf12235150d8ecd8afebc38fae1222e128ee7b7ba96aa

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Hash\_ghash_portable.cp39-win_amd64.pyd

MD5
f869255edd2c17f103d9330a3daf18d7

SHA1
f1d9e5fc4406685ce966a82c8b7ed33e3520fd95

SHA256
9dacae80d6127546f0ceb0a36bfcaf34ac1cdc12ab30bf6165df15997a91a7c8

SHA512
6194dcf030d5e87cdf6e1a8da0ed2304969279c6dbdecc73baf09ffa5fc65a449a68a233db987507846598c6d97f6acd6165f7a60ec42dcf980b69f830f1a0c8

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Protocol\_scrypt.cp39-win_amd64.pyd

MD5
1509827b82033c9497af8b2ab5d2ebdd

SHA1
f8d7ea32b981274136e7bbacdd1b47984cfeb0a7

SHA256
20a9494be4478051f62c18e98bb726be67d2d74df00c66afa754cbebf009616f

SHA512
21c752339467b7478e29d1c4e6b0ec6534dcd5abdabc69189acd3898bef51b823b6a0ca25e9c18599f594e2c2dd0b8a0273f7355737345718f3820ab105a799f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Util\_cpuid_c.cp39-win_amd64.pyd

MD5
852d4fb59d01b9d1de79fe3d0f281c03

SHA1
e8a4f36abb041c1928b92fc57f51510a3bac86e3

SHA256
4aee6a9621fe296fd2608364d34bdada63a34f64606623e73466e5183e9b6f8e

SHA512
3f047f90240e54a6b7b289fa740bb02e8fa101fa5d85898b55365eadebc894994c374ccd5da24ff658c98ac740f060a396bc3882e78d2aa36ca3141e398ff207

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Util\_strxor.cp39-win_amd64.pyd

MD5
138500067f9c2e9ff72a108e13b3e182

SHA1
0ffaa57ab0193eb3fdda315e32f41f8dd5c9c649

SHA256
c8da8ad5af56d5d5ba7d338ab23f5f78239229218a6ac2735564b5d08b2da3f3

SHA512
2887553b7358475795d8f7394e60321998355516065b46a436de4e488dbbf6b4104c45def6ad714bdd3105c3602838aab9306cb1742c02512c1056b53ad4fc33

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\VCRUNTIME140.dll

MD5
7942be5474a095f673582997ae3054f1

SHA1
e982f6ebc74d31153ba9738741a7eec03a9fa5e8

SHA256
8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

SHA512
49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\_bz2.pyd

MD5
499462206034b6ab7d18cc208a5b67e3

SHA1
1cd350a9f5d048d337475e66dcc0b9fab6aebf78

SHA256
6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

SHA512
17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\_cffi_backend.cp39-win_amd64.pyd

MD5
f5bf6a2926c1106cc6b72dca1157e04f

SHA1
58875e55b42def38bb748c5f70cd37ae93d44ef2

SHA256
3d3aeb22fd97a8bd2fee53412ce43466c76f22a1fd918b769ab6a58bf859d5a2

SHA512
95610daabc3c150f606184feb66459e30a3a0b509a7adf40806601d83e821c5d5f5afc2af8d0eb1cad92cabf6d3aff21c9a35094fba1cfa8faed5293a8f2c986

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\_ctypes.pyd

MD5
b74f6285a790ffd7e9ec26e3ab4ca8df

SHA1
7e023c1e4f12e8e577e46da756657fd2db80b5e8

SHA256
c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

SHA512
3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\_hashlib.pyd

MD5
60f420a9a606e2c95168d25d2c1ac12e

SHA1
1e77cf7de26ed75208d31751fe61da5eddbbaf12

SHA256
8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

SHA512
aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\_lzma.pyd

MD5
bc118fb4e14de484452bb1be413c082a

SHA1
25d09b7fbc2452457bcf7025c3498947bc96c2d1

SHA256
ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

SHA512
68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\_socket.pyd

MD5
0df2287791c20a764e6641029a882f09

SHA1
8a0aeb4b4d8410d837469339244997c745c9640c

SHA256
09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

SHA512
60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\libcrypto-1_1.dll

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\libffi-7.dll

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\pyexpat.pyd

MD5
ed82c3f14a839092d2d9d27092a19640

SHA1
41ffcd82998b003c1e83961c329379d3512c863f

SHA256
2d59ddb10d0fa2516da1e879d2b3f180272160a4325f705d4e71ed21b90438b8

SHA512
1b25165bda699c8e1a37e022d3412a4a6e780c1f93b2880aa67902811b0971fee0b100ad561271d23c4b7dc36eae6ee5af40b19481df75285db35d15c0904bf9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\python39.dll

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47642\select.pyd

MD5
a2a4cf664570944ccc691acf47076eeb

SHA1
918a953817fff228dbd0bdf784ed6510314f4dd9

SHA256
b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

SHA512
d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

Download Submit
memory/4952-2-0x0000000000000000-mapping.dmp

Download