Overview

overview

10

Static

static

10

d4d.exe

windows10-1703-x64

9

d4d.exe

windows10-2004-x64

9

d4d.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    444s
  • max time network
    448s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2024, 23:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d4d.exe
  • Size 56.0MB
  • Sample240118-22sdqaebak
  • SHA256 5eba59d4f103b1f3f8f2b4cd27e6d33ff7cdbe383c7e1a947cf6d8fae1f5dab7
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionpersistenceupx

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4d.exe
    "C:\Users\Admin\AppData\Local\Temp\d4d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\d4d.exe
      "C:\Users\Admin\AppData\Local\Temp\d4d.exe"
      2⤵
      • Enumerates VirtualBox DLL files
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:1232
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\D4D\""
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4616
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\D4D\activate.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2864
    • C:\Windows\system32\attrib.exe
      attrib +s +h .
      1⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:3036
    • C:\Users\Admin\D4D\D4D.exe
      "D4D.exe"
      1⤵
      • Executes dropped EXE
      PID:224
    • C:\Windows\system32\taskkill.exe
      taskkill /f /im "d4d.exe"
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1960

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\_bz2.pyd
          • Size 48KB
          • SHA256 a760d53f6e3fa01fa7aee66a10eb55ad1f10594966c6af97fb0c1c3e16a26a4a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\_ctypes.pyd
          • Size 58KB
          • SHA256 633edc33259db27f9136ffa5ddfb4e824cc3fe0523464ca51aac978f56a6cd8d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\_lzma.pyd
          • Size 85KB
          • SHA256 9f76f430165413110c9b4fa1d10cb37e883b3efa79b840aeedcef3df9e092676
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-console-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-console-l1-1-0.dll
          • Size 21KB
          • SHA256 af0e561bb3b2a13aa5ca9dfc9bc53c852bad85075261af6ef6825e19e71483a6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-datetime-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-datetime-l1-1-0.dll
          • Size 21KB
          • SHA256 956773a969a6213f4685c21702b9ed5bd984e063cf8188acbb6d55b1d6ccbd4e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-debug-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-debug-l1-1-0.dll
          • Size 21KB
          • SHA256 c45034620a5bb4a16e7dd0aff235cc695a5516a4194f4fec608b89eabd63eeef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-errorhandling-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 21KB
          • SHA256 6e6bfdc656f0cf22fabba1a25a42b46120b1833d846f2008952fe39fe4e57ab2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-file-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-file-l1-1-0.dll
          • Size 25KB
          • SHA256 f2f74a801f05ab014d514f0f1d0b3da50396e6506196d8beccc484cd969621a6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-file-l1-2-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-file-l1-2-0.dll
          • Size 21KB
          • SHA256 fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-file-l2-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-file-l2-1-0.dll
          • Size 18KB
          • SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-handle-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-handle-l1-1-0.dll
          • Size 21KB
          • SHA256 3de40a35254e3e0e0c6db162155d5e79768a6664b33466bf603516f3743efb18
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-heap-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-heap-l1-1-0.dll
          • Size 21KB
          • SHA256 4ea8399debe9d3ae00559d82bc99e4e26f310934d3fd1d1f61177342cf526062
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-interlocked-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 21KB
          • SHA256 e2406077621dce39984da779f4d436c534a31c5e863db1f65de5939d962157af
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-libraryloader-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 21KB
          • SHA256 7b8c7e09030df8cdc899b9162452105f8baeb03ca847e552a57f7c81197762f2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-localization-l1-2-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-localization-l1-2-0.dll
          • Size 21KB
          • SHA256 d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-memory-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-memory-l1-1-0.dll
          • Size 21KB
          • SHA256 51b2103e0576b790d5f5fdacb42af5dac357f1fd37afbaaf4c462241c90694b4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-namedpipe-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 21KB
          • SHA256 cdba9dc9af63ebd38301a2e7e52391343efeb54349fc2d9b4ee7b6bf4f9cf6eb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-processenvironment-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 21KB
          • SHA256 5bcc3a2d7d651bb1ecc41aa8cd171b5f2b634745e58a8503b702e43aee7cd8c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-processthreads-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 21KB
          • SHA256 ae56e19da96204e7a9cdc0000f96a7ef15086a9fe1f686687cb2d6fbcb037cd6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-processthreads-l1-1-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 21KB
          • SHA256 a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-profile-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-profile-l1-1-0.dll
          • Size 21KB
          • SHA256 7ecc2e3fe61f9166ff53c28d7cb172a243d94c148d3ef13545bc077748f39267
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-rtlsupport-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 21KB
          • SHA256 cc1bfce8fe6f9973cca15d7dfcf339918538c629e6524f10f1931ae8e1cd63b4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-string-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-string-l1-1-0.dll
          • Size 21KB
          • SHA256 1cb48031891b967e2f93fdd416b0324d481abde3838198e76bc2d0ca99c4fd09
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-synch-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-synch-l1-1-0.dll
          • Size 21KB
          • SHA256 8eccaba9321df69182ee3fdb8fc7d0e7615ae9ad3b8ca53806ed47f4867395ae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-synch-l1-2-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-synch-l1-2-0.dll
          • Size 21KB
          • SHA256 8356f71c5526808af2896b2d296ce14e812e4585f4d0c50d7648bc851b598bef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-sysinfo-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 21KB
          • SHA256 8a1e56bd740806777bc467579bdc070bcb4d1798df6a2460b9fe36f1592189b8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-timezone-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-timezone-l1-1-0.dll
          • Size 21KB
          • SHA256 5ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-util-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-core-util-l1-1-0.dll
          • Size 21KB
          • SHA256 0cbacaccedaf9b6921e6c1346de4c0b80b4607dacb0f7e306a94c2f15fa6d63d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-conio-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-conio-l1-1-0.dll
          • Size 21KB
          • SHA256 91d7a4c39baac78c595fc6cf9fd971aa0a780c297da9a8b20b37b0693bdcd42c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-convert-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-convert-l1-1-0.dll
          • Size 25KB
          • SHA256 8b24823407924688ecafc771edd9c58c6dbcc7de252e7ebd20751a5b9dd7abef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-environment-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-environment-l1-1-0.dll
          • Size 21KB
          • SHA256 a5c8c787c59d0700b5605925c8c255e5ef7902716c675ec40960640b15ff5aca
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-filesystem-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 21KB
          • SHA256 a3ba0ee6a4abc082b730c00484d4462d16bc13ee970ee3eee96c34fc9b6ef8ed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-heap-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-heap-l1-1-0.dll
          • Size 21KB
          • SHA256 a93c8af790c37a9b6bac54003040c283bef560266aeec3d2de624730a161c7dc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-locale-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-locale-l1-1-0.dll
          • Size 21KB
          • SHA256 b9ae70e8f74615ea2dc6fc74ec8371616e57c8eff8555547e7167bb2db3424f2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-math-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-math-l1-1-0.dll
          • Size 29KB
          • SHA256 bfc8ad242bf673bf9024b5bbe4158ca6a4b7bdb45760ae9d56b52965440501bd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-multibyte-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-multibyte-l1-1-0.dll
          • Size 29KB
          • SHA256 e5d3f2f18a33d6c296e64bec7161e961f10d2043bbbdc821610429c5684f34c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-private-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-private-l1-1-0.dll
          • Size 73KB
          • SHA256 68b47c4813f203a47df432f5d5a2848275c239a5cd75d40e921369f1b029d9da
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-process-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-process-l1-1-0.dll
          • Size 21KB
          • SHA256 39e363c47d4d45beda156cb363c5241083b38c395e4be237f3cfeda55176453c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-runtime-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 25KB
          • SHA256 c26540e3099fa91356ee69f5058cf7b8aee63e23d6b58385476d1883e99033c3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-stdio-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 25KB
          • SHA256 db059947ace80d2c801f684a38d90fd0292bdaa1c124cd76467da7c4329a8a32
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-string-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-string-l1-1-0.dll
          • Size 25KB
          • SHA256 eb8fe2778c54213aa2cc14ab8cec89ebd062e18b3e24968aca57e1f344588e74
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-time-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-time-l1-1-0.dll
          • Size 21KB
          • SHA256 fb425bf6d7eb8202acd10f3fbd5d878ab045502b6c928ebf39e691e2b1961454
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-utility-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\api-ms-win-crt-utility-l1-1-0.dll
          • Size 21KB
          • SHA256 ce74a264803d3e5761ed2c364e2196ac1b391cb24029af24aee8ef537ec68738
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\base_library.zip
          • Size 438KB
          • SHA256 0921351d7dbfc577b877f670a0d219a64082a55ae1a2c654be357d1983b8642c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          freetype.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\freetype.dll
          • Size 292KB
          • SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\libcrypto-1_1.dll
          • Size 267KB
          • SHA256 194410cf6a8479a327719eb8bd0d692a403747aeda014861bf1ef1048cabbc11
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\libffi-8.dll
          • Size 29KB
          • SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libjpeg-9.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\libjpeg-9.dll
          • Size 108KB
          • SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libmodplug-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\libmodplug-1.dll
          • Size 117KB
          • SHA256 9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libogg-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\libogg-0.dll
          • Size 16KB
          • SHA256 2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libopus-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\libopus-0.dll
          • Size 181KB
          • SHA256 fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\python3.dll
          • Size 65KB
          • SHA256 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\python311.dll
          • Size 386KB
          • SHA256 2f7457f8ab2107f17186a74ebc06198d628f9cdd0d61a4280e4dbee9dfe46243
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\python311.dll
          • Size 277KB
          • SHA256 a3cea3e6d3f6b11ac35b901fd2a1aa40f02b3afe1f118ee2a1626a2441ebc107
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\ucrtbase.dll
          • Size 348KB
          • SHA256 458f3fddd0a6bd464cf84eb1a3fed5bfbb65a0ffc1c00c004bd5a1b8ba24373d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15442\ucrtbase.dll
          • Size 403KB
          • SHA256 7ba7a2ca0b6df50f19f52b290783007845ded3ffeb527b59ec92f9c805ec6526
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI2242\cryptography-41.0.7.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_2louftxm.qjw.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2louftxm.qjw.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          memory/4324-1303-0x00007FF930A70000-0x00007FF930A7C000-memory.dmp
          Download

          memory/4324-1444-0x00007FF930CF0000-0x00007FF931068000-memory.dmp
          Download

          memory/4324-1285-0x00007FF937930000-0x00007FF93793B000-memory.dmp
          Download

          memory/4324-1284-0x00007FF931EA0000-0x00007FF931EAC000-memory.dmp
          Download

          memory/4324-1283-0x00007FF93A1C0000-0x00007FF93A1CB000-memory.dmp
          Download

          memory/4324-1282-0x00007FF931EB0000-0x00007FF931EE8000-memory.dmp
          Download

          memory/4324-1281-0x00007FF940810000-0x00007FF94081F000-memory.dmp
          Download

          memory/4324-1279-0x00007FF931EF0000-0x00007FF931F16000-memory.dmp
          Download

          memory/4324-1278-0x00007FF940820000-0x00007FF940843000-memory.dmp
          Download

          memory/4324-1274-0x00007FF930C30000-0x00007FF930CE8000-memory.dmp
          Download

          memory/4324-1272-0x00007FF940790000-0x00007FF94079D000-memory.dmp
          Download

          memory/4324-1270-0x00007FF9407A0000-0x00007FF9407B4000-memory.dmp
          Download

          memory/4324-1269-0x00007FF930CF0000-0x00007FF931068000-memory.dmp
          Download

          memory/4324-1288-0x00007FF931E80000-0x00007FF931E8C000-memory.dmp
          Download

          memory/4324-1289-0x00007FF930CF0000-0x00007FF931068000-memory.dmp
          Download

          memory/4324-1291-0x00007FF930AE0000-0x00007FF930AEC000-memory.dmp
          Download

          memory/4324-1262-0x00007FF9407C0000-0x00007FF9407ED000-memory.dmp
          Download

          memory/4324-1292-0x00007FF930AD0000-0x00007FF930ADE000-memory.dmp
          Download

          memory/4324-1293-0x00007FF930AC0000-0x00007FF930ACC000-memory.dmp
          Download

          memory/4324-1294-0x00007FF930AB0000-0x00007FF930ABC000-memory.dmp
          Download

          memory/4324-1295-0x00007FF930AA0000-0x00007FF930AAB000-memory.dmp
          Download

          memory/4324-1296-0x00007FF930A90000-0x00007FF930A9B000-memory.dmp
          Download

          memory/4324-1298-0x00007FF930A40000-0x00007FF930A52000-memory.dmp
          Download

          memory/4324-1299-0x00007FF930A30000-0x00007FF930A3C000-memory.dmp
          Download

          memory/4324-1300-0x00007FF930AF0000-0x00007FF930AFC000-memory.dmp
          Download

          memory/4324-1301-0x00007FF930A80000-0x00007FF930A8C000-memory.dmp
          Download

          memory/4324-1302-0x00007FF931F50000-0x00007FF931F69000-memory.dmp
          Download

          memory/4324-1304-0x00007FF930A10000-0x00007FF930A25000-memory.dmp
          Download

          memory/4324-1305-0x00007FF9309F0000-0x00007FF930A02000-memory.dmp
          Download

          memory/4324-1315-0x00007FF931EB0000-0x00007FF931EE8000-memory.dmp
          Download

          memory/4324-1316-0x00007FF930560000-0x00007FF930589000-memory.dmp
          Download

          memory/4324-1317-0x00007FF930520000-0x00007FF93054E000-memory.dmp
          Download

          memory/4324-1318-0x00007FF9304F0000-0x00007FF930513000-memory.dmp
          Download

          memory/4324-1319-0x00007FF930370000-0x00007FF9304E7000-memory.dmp
          Download

          memory/4324-1321-0x00007FF930360000-0x00007FF93036B000-memory.dmp
          Download

          memory/4324-1322-0x00007FF930850000-0x00007FF93085B000-memory.dmp
          Download

          memory/4324-1323-0x00007FF930840000-0x00007FF93084C000-memory.dmp
          Download

          memory/4324-1324-0x00007FF930830000-0x00007FF93083B000-memory.dmp
          Download

          memory/4324-1325-0x00007FF9309A0000-0x00007FF9309C2000-memory.dmp
          Download

          memory/4324-1327-0x00007FF930980000-0x00007FF930997000-memory.dmp
          Download

          memory/4324-1326-0x00007FF930820000-0x00007FF93082C000-memory.dmp
          Download

          memory/4324-1320-0x00007FF930330000-0x00007FF930348000-memory.dmp
          Download

          memory/4324-1307-0x00007FF9309A0000-0x00007FF9309C2000-memory.dmp
          Download

          memory/4324-1309-0x00007FF930960000-0x00007FF930979000-memory.dmp
          Download

          memory/4324-1310-0x00007FF931F20000-0x00007FF931F4E000-memory.dmp
          Download

          memory/4324-1311-0x00007FF930910000-0x00007FF93095A000-memory.dmp
          Download

          memory/4324-1312-0x00007FF9308F0000-0x00007FF930901000-memory.dmp
          Download

          memory/4324-1314-0x00007FF930860000-0x00007FF9308BD000-memory.dmp
          Download

          memory/4324-1313-0x00007FF9308C0000-0x00007FF9308DE000-memory.dmp
          Download

          memory/4324-1308-0x00007FF930980000-0x00007FF930997000-memory.dmp
          Download

          memory/4324-1306-0x00007FF9309D0000-0x00007FF9309E4000-memory.dmp
          Download

          memory/4324-1297-0x00007FF930A60000-0x00007FF930A6D000-memory.dmp
          Download

          memory/4324-1290-0x00007FF930B00000-0x00007FF930B0B000-memory.dmp
          Download

          memory/4324-1286-0x00007FF931E90000-0x00007FF931E9B000-memory.dmp
          Download

          memory/4324-1280-0x00007FF930B10000-0x00007FF930C2C000-memory.dmp
          Download

          memory/4324-1277-0x00007FF931070000-0x00007FF931659000-memory.dmp
          Download

          memory/4324-1275-0x00007FF940580000-0x00007FF94058D000-memory.dmp
          Download

          memory/4324-1219-0x00007FF9407F0000-0x00007FF940809000-memory.dmp
          Download

          memory/4324-1276-0x00007FF93FCD0000-0x00007FF93FCDB000-memory.dmp
          Download

          memory/4324-1216-0x00007FF940810000-0x00007FF94081F000-memory.dmp
          Download

          memory/4324-1214-0x00007FF940820000-0x00007FF940843000-memory.dmp
          Download

          memory/4324-1442-0x00007FF9407C0000-0x00007FF9407ED000-memory.dmp
          Download

          memory/4324-1443-0x00007FF9407A0000-0x00007FF9407B4000-memory.dmp
          Download

          memory/4324-1287-0x00007FF9407F0000-0x00007FF940809000-memory.dmp
          Download

          memory/4324-1445-0x00007FF931F50000-0x00007FF931F69000-memory.dmp
          Download

          memory/4324-1447-0x00007FF931F20000-0x00007FF931F4E000-memory.dmp
          Download

          memory/4324-1452-0x00007FF931EF0000-0x00007FF931F16000-memory.dmp
          Download

          memory/4324-1495-0x00007FF931EB0000-0x00007FF931EE8000-memory.dmp
          Download

          memory/4324-1556-0x00007FF9309D0000-0x00007FF9309E4000-memory.dmp
          Download

          memory/4324-1592-0x00007FF930960000-0x00007FF930979000-memory.dmp
          Download

          memory/4324-1623-0x00007FF930910000-0x00007FF93095A000-memory.dmp
          Download

          memory/4324-1640-0x00007FF9308C0000-0x00007FF9308DE000-memory.dmp
          Download

          memory/4324-1652-0x00007FF930860000-0x00007FF9308BD000-memory.dmp
          Download

          memory/4324-1679-0x00007FF930520000-0x00007FF93054E000-memory.dmp
          Download

          memory/4324-1731-0x00007FF9304F0000-0x00007FF930513000-memory.dmp
          Download

          memory/4324-1791-0x00007FF9305C0000-0x00007FF9305EB000-memory.dmp
          Download

          memory/4324-1794-0x00007FF92F9D0000-0x00007FF92FA25000-memory.dmp
          Download

          memory/4324-1808-0x00007FF940010000-0x00007FF940026000-memory.dmp
          Download

          memory/4324-1821-0x00007FF93FF30000-0x00007FF93FF45000-memory.dmp
          Download

          memory/4324-1820-0x00007FF93FF50000-0x00007FF93FF60000-memory.dmp
          Download

          memory/4324-1819-0x00007FF93FF60000-0x00007FF93FF76000-memory.dmp
          Download

          memory/4324-1818-0x00007FF93FF80000-0x00007FF93FF8E000-memory.dmp
          Download

          memory/4324-1817-0x00007FF93FF90000-0x00007FF93FF9E000-memory.dmp
          Download

          memory/4324-1816-0x00007FF93FFA0000-0x00007FF93FFAF000-memory.dmp
          Download

          memory/4324-1815-0x00007FF93FFB0000-0x00007FF93FFBE000-memory.dmp
          Download

          memory/4324-1814-0x0000000062E80000-0x0000000062EA8000-memory.dmp
          Download

          memory/4324-1813-0x000000006A880000-0x000000006A8AB000-memory.dmp
          Download

          memory/4324-1812-0x0000000068B40000-0x0000000068B81000-memory.dmp
          Download

          memory/4324-1811-0x00007FF93FFC0000-0x00007FF93FFCE000-memory.dmp
          Download

          memory/4324-1810-0x00007FF93FFD0000-0x00007FF93FFE1000-memory.dmp
          Download

          memory/4324-1809-0x00007FF93FFF0000-0x00007FF940004000-memory.dmp
          Download

          memory/4324-1807-0x00007FF940030000-0x00007FF940074000-memory.dmp
          Download

          memory/4324-1806-0x00007FF940080000-0x00007FF940095000-memory.dmp
          Download

          memory/4324-1805-0x00007FF9400A0000-0x00007FF9400BB000-memory.dmp
          Download

          memory/4324-1804-0x00007FF9400C0000-0x00007FF9400CE000-memory.dmp
          Download

          memory/4324-1803-0x00007FF9400D0000-0x00007FF9400E1000-memory.dmp
          Download

          memory/4324-1802-0x00007FF9400F0000-0x00007FF9400FC000-memory.dmp
          Download

          memory/4324-1801-0x00007FF940100000-0x00007FF94010F000-memory.dmp
          Download

          memory/4324-1800-0x00007FF940110000-0x00007FF940125000-memory.dmp
          Download

          memory/4324-1799-0x00007FF940130000-0x00007FF940146000-memory.dmp
          Download

          memory/4324-1798-0x00007FF940150000-0x00007FF9403C8000-memory.dmp
          Download

          memory/4324-1797-0x00007FF940AA0000-0x00007FF940AB1000-memory.dmp
          Download

          memory/4324-1796-0x00007FF940AC0000-0x00007FF940AFE000-memory.dmp
          Download

          memory/4324-1795-0x00007FF92F9B0000-0x00007FF92F9C6000-memory.dmp
          Download

          memory/4324-1793-0x00007FF92FA30000-0x00007FF93009D000-memory.dmp
          Download

          memory/4324-1792-0x00007FF9300A0000-0x00007FF930323000-memory.dmp
          Download

          memory/4324-1790-0x00007FF930640000-0x00007FF9306FC000-memory.dmp
          Download

          memory/4324-1789-0x00007FF930700000-0x00007FF930735000-memory.dmp
          Download

          memory/4324-1788-0x00007FF930330000-0x00007FF930348000-memory.dmp
          Download

          memory/4324-1737-0x00007FF930370000-0x00007FF9304E7000-memory.dmp
          Download

          memory/4324-1657-0x00007FF930560000-0x00007FF930589000-memory.dmp
          Download

          memory/4324-1273-0x00007FF931F20000-0x00007FF931F4E000-memory.dmp
          Download

          memory/4324-1626-0x00007FF9308F0000-0x00007FF930901000-memory.dmp
          Download

          memory/4324-1589-0x00007FF930980000-0x00007FF930997000-memory.dmp
          Download

          memory/4324-1560-0x00007FF9309A0000-0x00007FF9309C2000-memory.dmp
          Download

          memory/4324-1544-0x00007FF9309F0000-0x00007FF930A02000-memory.dmp
          Download

          memory/4324-1526-0x00007FF930A10000-0x00007FF930A25000-memory.dmp
          Download

          memory/4324-1458-0x00007FF930B10000-0x00007FF930C2C000-memory.dmp
          Download

          memory/4324-1451-0x00007FF93FCD0000-0x00007FF93FCDB000-memory.dmp
          Download

          memory/4324-1449-0x00007FF940580000-0x00007FF94058D000-memory.dmp
          Download

          memory/4324-1448-0x00007FF930C30000-0x00007FF930CE8000-memory.dmp
          Download

          memory/4324-1446-0x00007FF940790000-0x00007FF94079D000-memory.dmp
          Download

          memory/4324-1441-0x00007FF9407F0000-0x00007FF940809000-memory.dmp
          Download

          memory/4324-1440-0x00007FF940810000-0x00007FF94081F000-memory.dmp
          Download

          memory/4324-1439-0x00007FF940820000-0x00007FF940843000-memory.dmp
          Download

          memory/4324-1438-0x00007FF931070000-0x00007FF931659000-memory.dmp
          Download

          memory/4324-1271-0x00007FF931F50000-0x00007FF931F69000-memory.dmp
          Download

          memory/4324-1206-0x00007FF931070000-0x00007FF931659000-memory.dmp
          Download