7f0c1a4c1422a1532c573fef0a3c7c498ad3e1e683d5cee10ec6ce462ee08dfd

Analysis

max time kernel
294s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

470KB
MD5

ef1f9ff330de70415c306c50e84d1926
SHA1

5b84b24efb6b153fbe9a44c0a66db5f0b41c187d
SHA256

459d2001068a9415aff5759d98b74f342e5099e15c9b7506e23bbb4020fd0009
SHA512

632b35ae2225a15cc7761e48604e16f1aea147263b170482c95ce199065145729de540cf4d3d7b6ff0fdf589494332797a5714294a6df829c2f1c42ce4b4e5cf
SSDEEP

6144:34lnbdrfzE29c3qncF4DJtMMdhq2DHl3JE1XQRK1OeCYwc:QbdrfwJ3UtMKjROn8eCs

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updater = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\aagapj\\change.exe"	pythonw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updater	pythonw.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	windirstat.exe
File opened (read-only)	\??\F:	windirstat.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Oracle\\elezlg\\reset.exe b5LGL2Y0RE5briAXOCaEtVs6OYAjoixLcOlh2uT3Ar6+X6gxKOYaDPLXqP/zRMaeAKbbydtW6PsNo7aUZS+S4hYsLxZJuqTtNYg6Un+DA4KZDF36q3mIre6m3v+7H6CHW+CG7K4eT70C1d5iiMFD6zBV"	pythonw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WinDirStat\windirstat.chm	windirstat1_1_2_setup.exe
File created	C:\Program Files (x86)\WinDirStat\Uninstall.exe	windirstat1_1_2_setup.exe
File created	C:\Program Files (x86)\WinDirStat\windirstat.exe	windirstat1_1_2_setup.exe

Executes dropped EXE 3 IoCs

pid	Process
2364	windirstat1_1_2_setup.exe
1632	pythonw.exe
628	windirstat.exe

Loads dropped DLL 35 IoCs

pid	Process
2364	windirstat1_1_2_setup.exe
2364	windirstat1_1_2_setup.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
1632	pythonw.exe
2364	windirstat1_1_2_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral8/files/0x00050000000227dc-4.dat	nsis_installer_1
behavioral8/files/0x00070000000233ac-1348.dat	nsis_installer_1

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2556	schtasks.exe
3832	schtasks.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe
Token: SeBackupPrivilege	628	windirstat.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
628	windirstat.exe
628	windirstat.exe
628	windirstat.exe
628	windirstat.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 2364	3844	setup.exe	87
PID 3844 wrote to memory of 2364	3844	setup.exe	87
PID 3844 wrote to memory of 2364	3844	setup.exe	87
PID 3844 wrote to memory of 1632	3844	setup.exe	91
PID 3844 wrote to memory of 1632	3844	setup.exe	91
PID 2364 wrote to memory of 628	2364	windirstat1_1_2_setup.exe	99
PID 2364 wrote to memory of 628	2364	windirstat1_1_2_setup.exe	99
PID 2364 wrote to memory of 628	2364	windirstat1_1_2_setup.exe	99
PID 1632 wrote to memory of 2556	1632	pythonw.exe	100
PID 1632 wrote to memory of 2556	1632	pythonw.exe	100
PID 1632 wrote to memory of 3832	1632	pythonw.exe	102
PID 1632 wrote to memory of 3832	1632	pythonw.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Public\Downloads\windirstat1_1_2_setup.exe
  C:\Users\Public\Downloads\windirstat1_1_2_setup.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\WinDirStat\windirstat.exe
    "C:\Program Files (x86)\WinDirStat\windirstat.exe"
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:628
- C:\Users\Admin\AppData\Local\Notepad\pythonw.exe
  C:\Users\Admin\AppData\Local\Notepad\pythonw.exe C:\Users\Admin\AppData\Local\Notepad\test-gpu.py
  2⤵
  - Adds Run key to start application
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /ru SYSTEM /tn "OneDrive Standalone Update Task-S-1-5-21-410893861-335324104-0624946205-1001" /tr "C:\Oracle\elezlg\reset.exe b5LGL2Y0RE5briAXOCaEtVs6OYAjoixLcOlh2uT3Ar6+X6gxKOYaDPLXqP/zRMaeAKbbydtW6PsNo7aUZS+S4hYsLxZJuqTtNYg6Un+DA4KZDF36q3mIre6m3v+7H6CHW+CG7K4eT70C1d5iiMFD6zBV" /sc ONSTART /f
    3⤵
    - Creates scheduled task(s)
    PID:2556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /ru SYSTEM /tn "OneDrive Standalone Update Task-S-1-5-21-757073214-916171523-9655184467-1001" /tr "C:\Oracle\elezlg\reset.exe b5LGL2Y0RE5briAXOCaEtVs6OYAjoixLcOlh2uT3Ar6+X6gxKOYaDPLXqP/zRMaeAKbbydtW6PsNo7aUZS+S4hYsLxZJuqTtNYg6Un+DA4KZDF36q3mIre6m3v+7H6CHW+CG7K4eT70C1d5iiMFD6zBV" /sc MINUTE /mo 720 /f
    3⤵
    - Creates scheduled task(s)
    PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WinDirStat\Uninstall.exe

Filesize
46KB

MD5
a127e6118b9dd2f9d5a7cc4d697a0105

SHA1
9ac17d4dcf0884ceafacf10c42209c0942dfe7a8

SHA256
afc864cfce79b2a6add491a27ea672d958233ed7a97a2cbbce60100d2fa1e670

SHA512
0e57d2856c02c55d477d9b3cc1d4bf5ffa3650d4b20be18b0a9e614d19143aee325c4cd92ff31bbddf6e93cd3ebeb47d8727de6e25faa366341cc71117122065

Download Submit
C:\Program Files (x86)\WinDirStat\windirstat.exe

Filesize
636KB

MD5
24cd9a82fcfc658dd3ae7ba25c958ffb

SHA1
26e14a532e1e050eb20755a0b7a5fea99dd80588

SHA256
cc3ee246f2710dc9ba9e2a88e3192b88f1db4caa2eefb8641642a33df04e585c

SHA512
4de675be1f7d618d133ef24765a027840473e0c5bc93550d5e5fdbf078edc74c2241e6e3cd8753517e2954c7f09b9909028de7b727294d723fb5700658c7979d

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__init__.py

Filesize
2KB

MD5
31c5de18019727c2dbb04f0a9d2b6caf

SHA1
d7efd7e56bdd5cedbbf1b1259726fc13a214e630

SHA256
c33ff384c31cc8a6d095f1708bb2090b38563b3ee0a127a546ace5815a104aec

SHA512
0e28065b3e0727739532fd0d9a7752f76eafa1ac4af8146a9145320f333c57ddc8a89ead94458bef48809f047615c281c058ffa19bf0cd5239f14dc124d1a873

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__pycache__\__init__.cpython-310.pyc

Filesize
1KB

MD5
54ee116de5a8037fa3622dc7f958a3b7

SHA1
7a571b001572c268099fcc973b00655f533272d6

SHA256
ad53b366121536d6c292db923a81791b9b6d37a74bf557704ae516c8287d8421

SHA512
9cea1be18c2e9cb0fcf55cc0061816062e54020213ca330d169a817b2664e963c5b87306ad222dd5eae3d89278915c47bf5bbe70e0d38b4d3453f298fcab0291

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__pycache__\_mode_cbc.cpython-310.pyc

Filesize
7KB

MD5
126c6fcfc71cd0ecdf646ef96c01c497

SHA1
56027b61f2e03f78753d038c6a1546347d05c1ce

SHA256
c15cee14f1fa1aa05034cdeecc7d0cc4cf13ce83052227eca0cc0f730999232d

SHA512
58bb1b20934c3ff0362c75e3f38d306fce434b6dae573947a017a962af29823b3faafd1939914e8e221c979968a08fa610d217e42c51d3d090606ee5df3673dd

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__pycache__\_mode_cfb.cpython-310.pyc

Filesize
7KB

MD5
fc0f6ef65c5a22be8334c06f00407ab1

SHA1
7a36aa2a32b5a28355cab12511c9108c03e5f6cd

SHA256
25b412a79d78b032db4ef252c2df5fd31634f248fccc308ce9248d87ce3aadb7

SHA512
6ff05d584ea165096b3d4a1202a50ce1d85d7a4bd38fd58399ad157d38ff5ad5e0d5e64c50f530da7e581fda65cac7375bb8bf59851ac5c0be1f4652ce8d6823

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__pycache__\_mode_ecb.cpython-310.pyc

Filesize
5KB

MD5
8c4df4a5d33d6011a8e290e2912c974a

SHA1
3cf195dfe459a8740a8beebcaba4931921ab8045

SHA256
5137fad7e10e8efc26d468192fb52de78d4c9bf601d9d9db8fadd6751426a578

SHA512
9b227d381290e1bea0001d21a38773152a6ac17183c47faa58ff9bbe333eee0e0051bb6dc0d171893704f5a58b604da8569f16d97a92374e8c511a8fb6c4bea6

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\__pycache__\_mode_ofb.cpython-310.pyc

Filesize
7KB

MD5
49811f61568e61570e574a2fe06c9de0

SHA1
2aa375f6427446ba5d22cf3c0d972c5af5202f8c

SHA256
75b3086d0281d45c1cf3905f378e2efe37416fb4f322336957a6f90f512e2146

SHA512
6771ed69852253b26d6d393c4c28da58616ae9167ec636c3d050acfcd7bfb814de10f22ca26125f366c2443d6a45460c6dffb3ec4e4bc7f6f674aa52709658b1

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_cbc.py

Filesize
11KB

MD5
845406947584227c6c1f9f1178f604f8

SHA1
5b6dd35315d100a9da74634c72a6a5318da080d7

SHA256
737447b035e06784504ba1de08f37b704b59d3f86e46388842b281860e5ac803

SHA512
9735ba8222b2dfaef6dc33f6c2bc2e9867f5dd497ce4dfd74338d24ea05d11da91cfc918cca317ef8f76afc75f05ead212872f9a0cc99d918928c25245fb31a0

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_cfb.py

Filesize
10KB

MD5
1f99bc4ad70c9d9d823e087b64109d36

SHA1
64b5616367505d67b912b62a2a4137924e0c528a

SHA256
8a1f6035bfa01f6dbfd2dd2610e3bc8bb7d7b4db9bc8bc63d80aa42fc30d1569

SHA512
2ce953170c6f81e047d7b43ac2b5c0ca556197d65f9a2f280a8517f1dd9020741a70c7fb6820ee83e15f66d4473fd9d1d339b937cf03f38d44e34e1e4959a5e9

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_ecb.py

Filesize
8KB

MD5
6cbc08e85c2f37d641be890f91b0c1f3

SHA1
54525c6cfb8431f5249fddde29b1cc27107f1d68

SHA256
d0a75e9cc56230e1c044411a1a6760ff7678d449e1263aeffef7e2752e360ff8

SHA512
89e08b33a85fddfa417cd6d3bf7c1bbec94f280c5d2dd43ae82d9a12c4cc25a9057b0e87f50ff27f1491c18c754aefa7daa190eeb0edd3baccbcfd6a5abe0a96

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_mode_ofb.py

Filesize
10KB

MD5
701bf588bdf378dc9b22376f555a72d5

SHA1
53357492c8df955f5b9511dffa79271753d94495

SHA256
ca448c52d111614036df2c489ca8150c4a6e3d31608ea76ce518d12bd7051524

SHA512
26d7f9f6bcac8f90adc3740c134faa68f7b6f5e34a1eb0a28e849be859d091b91b6d8777588fb1041aea7eb98b040eec30a2b57a6969d736e7f41a2f7242a8e7

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_cbc.pyd

Filesize
22KB

MD5
65c8f7779eb42c0cb8b6f28a59d1cdf5

SHA1
8eee6c791fd709f7cac8b085b8ed0436752468f3

SHA256
67a9dab77636add5b40664715ac5f8e819669d9135f9771399f48a511738f576

SHA512
0badeb94ac9d2e689c09e95d5215cc4c7e0da897aed726abe5286c5386677aa0081b7dc6bc23ec56f5044c97052ac1a9e9c8331702fe18370d8d7106f9b7adf2

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_cfb.pyd

Filesize
23KB

MD5
17327f64191cb4fed9bc1380847d3ff1

SHA1
f139bfb3ae59224c28e12bd7b5fc56e8224a9c27

SHA256
3927a407c7703b0103b93a1cd1e7493f99806407f95cc99a6ed92cbd64a92ab7

SHA512
24082030495fc39864f408df872784940da3bcad96c8948e1e2c9341ec4b08ea10996e32c9698d04f73776631a6344286b6938d02e4b00c23d9eb1a96831be3c

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_ecb.pyd

Filesize
21KB

MD5
a5347fcb730a307e36e78699e6abc030

SHA1
536bbbced6692d63dfa89972310990405207b880

SHA256
261be657b6eb3e70880cb540282f571944798472439c6d37588ba6716fb4226d

SHA512
974628c4122c2962576abebf3fbe9f4a2975c18607c45f9b7099ca798caa1810b7452218bbc7f9be196b99b892ce316f2305357a1cdf6f36743a7ad29c239056

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Cipher\_raw_ofb.pyd

Filesize
22KB

MD5
25500c65641e2b904135e6f75cb4e42b

SHA1
19c9346684a3bca1ecd6d55c9916bd1445854d36

SHA256
bbacc58fdf2872717750a1c7edbac37cbdaa2de73819b2a5011d2c936d626927

SHA512
4cbf2f82f73c64890804ebb3f230ad5e2f28de9576d5686caa912cb44afea2ad8602749c564d9fb931f3a83d97673040e5f4d5beeded4c19f5e5e108aa51f6d7

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Random\__init__.py

Filesize
1KB

MD5
87ae3374b1199d28c142c3d10ee9a49e

SHA1
0bdecb65022283399b0e2972b032a05f7514074f

SHA256
6970818adb817aa3021e624c7bfaeac0ebe70179f38d832ecb8fb82f77f9cf69

SHA512
e76586ef455b723037c0ab07df0e3d2b9317df7b5c98be8bd0270710e03565ef20b084bb10823359f345ec2c8a14d9169d1429c3299a06471490381aaec12044

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Random\__pycache__\__init__.cpython-310.pyc

Filesize
1KB

MD5
5b8d0acba9293c9c57ed25a00d72abad

SHA1
94dc9874f3b8dc31bd6569941a14e5d243ecd0b1

SHA256
91320a065e9a344cf4c1383a5fdb79870957ccab71c00a6dfefddf08c7237b8f

SHA512
79030c929fdac23f79fd2b0ab18b6ea89b0288b43f36e14108a086b26eed579937ca0905d17a9bc24694629c8772cb7feff7c7611f921ffad29d00e66c02c639

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\__init__.py

Filesize
1KB

MD5
34bc84ac54671e8d63783ab7b87550ff

SHA1
fe7255aa8bb0ea5ab3061477f40d96f3a2ce64ea

SHA256
089f8ec508f03dec008884e1824b9793f9f37a486aed7eafef943cc365f8fccd

SHA512
5b11fcab4c1602d3b4b4ab6e38ea94a2c564e6fd514ca89d77c25843bb8b2a865776f36ffff9f23596c9e8df66db91c18bf88761b698384595113132e0dfcf4a

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\__pycache__\__init__.cpython-310.pyc

Filesize
1KB

MD5
3ad163efc8c7954618752123a5feac49

SHA1
df05604ae4123c8743a8daf13d0176cb46b77893

SHA256
d3ef4d41b8958fe5174458754d000be71b51fd664f2f7be71d890f513388bdc9

SHA512
db84070dc7c94dccc7dbebda5b81b0a0b338dc082aaa088cabbe9d0f0c0956c08e10822005e5237c61ff9d54f932270b43ae4c2f141d5d31ad54e45dda2cc033

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\__pycache__\_file_system.cpython-310.pyc

Filesize
867B

MD5
b926620ca9def0890ac3240f1545fb22

SHA1
5211c0f5c22a224e3e72a982f7909e7679af3758

SHA256
b11f5e0b391b91b8c1d36a541e5f74473cc7e0e9dfff9c41ce02a8547606024e

SHA512
d82aa3a5bb6dca89bd9089801c1cf22b5d40640aec511eb7282388dd240941065794c915ae5f9de51e5a7ad750d2355cf58de3382ce926bab3412288b2f904d5

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\__pycache__\_raw_api.cpython-310.pyc

Filesize
8KB

MD5
f087e38bcd3e92954720ae7f4dedce5c

SHA1
8f7e68e58dca46cc796efd8ca22afb48ec5bec89

SHA256
a8ec12ae84f3c79bb454ebd0e60cd207b0dba7572fdbdd28c2cfd986f40f2f04

SHA512
e443f1b59af7f30a192eff801b1ad260257ef7b7d74060fc7e2c67d205067804fb7e6b2adc42b9abae244e2dc4b8aad6a4e7b049eb0a943b71d2c74287fe7423

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\__pycache__\py3compat.cpython-310.pyc

Filesize
4KB

MD5
ec5905c0f1f72bc4b65eebc5b7719d30

SHA1
2a4dbb9cdf33a0c26c58ef6a0a7b0e0032d006c9

SHA256
da10c6f671dfea10a6c52c42383ed0e8822629e6eaf6d8b67b90f807bf816657

SHA512
dd7aec8cdc4b8395b15db060c7abc970357d8f815c14fbd01693f7289baf1b5a2d2d216b913cef38a8ba3d686d45580e3f9589c3a019f265bb3017e2c56a86ca

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\_file_system.py

Filesize
2KB

MD5
eeb607d9ec66ed0d94a36bb9fda8a92b

SHA1
ba9f0f28e184f44c877be831784a4569508ad582

SHA256
33a36137b3f9b3cf48eccd7012dae2ac898e593888b60206ba4c320b13c87573

SHA512
057004f4e0f2980dda6c98e6f8df956454cb0b68eb20fc08bd1faace644b68ba0f385a5453dbe599a5f6a95f94379d31b34ad359d46096e32ae8fa659b1e8594

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\_raw_api.py

Filesize
10KB

MD5
e20b027dd23c16fcde676c244454eb58

SHA1
cbd115d23d907e9bc989afbc634c02d1752b0e7c

SHA256
b3e1026515b5b21dee0efe54e75ab490444735fcf490f6777bff8ee35ec2d178

SHA512
8eeedcde06f7654d63dbb8b619814794e195afd76166cd6c8ec9aef926d95dcd9ea2e8f712dfe359085809fe9a31c4cd378753aaa9201dce540463469ea7dad5

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\Util\py3compat.py

Filesize
5KB

MD5
f09941c682c76ad39c492cb98da81b9b

SHA1
7689df9d679816d7fc70b6e69e99156206c5f649

SHA256
d96866e681038889ea646f6e12c67aa281ed0ac30afb30e51018614f06615e73

SHA512
3e7e27fb35212e26a944e136d403cc91dbb6dd2414472d9cf963d2b375004723cc07b66b8eb6972390299e0441f3ff2a68b78608f518efd62f445ae5ad7cf2fe

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\__init__.py

Filesize
191B

MD5
58d212404cfd4d5825716429c6ae3856

SHA1
a05b981ca0959a397c469f7f033cf4ed5ea999bb

SHA256
43a7d0c9c6f95c2ec78ea30cbe83f1394458c1c1c1782f25e49ad7aabd2f2dc7

SHA512
c54520897e9357c5f20dc605c555238e0bf5dc1c7f0d1728503d85fbab2701150f99303be510bf5d0d9d8fcdfd7eef15d855a518e56187cc57fc7136d732830c

Download Submit
C:\Users\Admin\AppData\Local\Notepad\Cryptodome\__pycache__\__init__.cpython-310.pyc

Filesize
431B

MD5
734ee78c5d1a5c737fd3b33e09af17c9

SHA1
4aa1e7fbc3671b7438ecc2595e0fac287c89fd5b

SHA256
6bc6137223e810dc331fb9e9cda7e9f63144ee45301dbe8069d9bce1838fd20e

SHA512
68e20069a54fa15f4ba1d80835c789aba447de3b0c8a4539e67fea6ae0f198b6f276f6f91b5db858c03564676b4e47aa9c37dfd0a8f4d0eacebe8ba649f6e1d4

Download Submit
C:\Users\Admin\AppData\Local\Notepad\_bz2.pyd

Filesize
81KB

MD5
86d1b2a9070cd7d52124126a357ff067

SHA1
18e30446fe51ced706f62c3544a8c8fdc08de503

SHA256
62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

SHA512
7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

Download Submit
C:\Users\Admin\AppData\Local\Notepad\_ctypes.pyd

Filesize
120KB

MD5
1635a0c5a72df5ae64072cbb0065aebe

SHA1
c975865208b3369e71e3464bbcc87b65718b2b1f

SHA256
1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

SHA512
6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

Download Submit
C:\Users\Admin\AppData\Local\Notepad\_hashlib.pyd

Filesize
63KB

MD5
d4674750c732f0db4c4dd6a83a9124fe

SHA1
fd8d76817abc847bb8359a7c268acada9d26bfd5

SHA256
caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

SHA512
97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

Download Submit
C:\Users\Admin\AppData\Local\Notepad\_lzma.pyd

Filesize
154KB

MD5
7447efd8d71e8a1929be0fac722b42dc

SHA1
6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

SHA256
60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

SHA512
c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

Download Submit
C:\Users\Admin\AppData\Local\Notepad\_socket.pyd

Filesize
77KB

MD5
819166054fec07efcd1062f13c2147ee

SHA1
93868ebcd6e013fda9cd96d8065a1d70a66a2a26

SHA256
e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

SHA512
da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

Download Submit
C:\Users\Admin\AppData\Local\Notepad\_ssl.pyd

Filesize
156KB

MD5
7910fb2af40e81bee211182cffec0a06

SHA1
251482ed44840b3c75426dd8e3280059d2ca06c6

SHA256
d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

SHA512
bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

Download Submit
C:\Users\Admin\AppData\Local\Notepad\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Notepad\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Notepad\libssl-1_1.dll

Filesize
688KB

MD5
bec0f86f9da765e2a02c9237259a7898

SHA1
3caa604c3fff88e71f489977e4293a488fb5671c

SHA256
d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

SHA512
ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

Download Submit
C:\Users\Admin\AppData\Local\Notepad\python3.DLL

Filesize
64KB

MD5
fd4a39e7c1f7f07cf635145a2af0dc3a

SHA1
05292ba14acc978bb195818499a294028ab644bd

SHA256
dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9

SHA512
37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

Download Submit
C:\Users\Admin\AppData\Local\Notepad\python310._pth

Filesize
80B

MD5
0c2d1a15406e669769ac3e7808a815df

SHA1
9cf43b4194501b816dbbb83e2911db48f0a5ae11

SHA256
e9ae01c8efc72ff96484d7f54ae47805a16c0eb842721e6f03e677f356e781e9

SHA512
c88854660cd87c04138efaa867c84a8942272f607e1bc036b10195c154fb2eb339a58739d1388d9c0dcebda094fae47c28106f1da16837e3d817f439d0fcf6e8

Download Submit
C:\Users\Admin\AppData\Local\Notepad\python310.dll

Filesize
1.6MB

MD5
920a2a3de23a9068c9c24856bef27890

SHA1
4364fa2f73b95c026cb59996062c8072ffba8688

SHA256
10239cbc3b3b66367c842500c970fbf926e991410a3bef4877e1e5899e987b4d

SHA512
dbaa299859006866ac89f201fc187c4916d48cc893f5259e7b8f4ae145a6eab9fef688edb7c768f987dc50543c34b9d26e38428dffeb58c0a3304ad60a69273f

Download Submit
C:\Users\Admin\AppData\Local\Notepad\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Notepad\python310.zip

Filesize
2.5MB

MD5
9ff31cf4b81e38e7663eb2db5e51253d

SHA1
e3fc5ebced06321f3d5899eff5353aa0a04a37de

SHA256
785b6e0911beda463342c9ba9eadc1841fcdf318c39c05554649cf9e7fda26ad

SHA512
a61004a15cfe9f283f249871067cabeed119dcb7c6e51c7dd6e9e55517aab5ea77c8cd1814d897a141625b932741f3c7f7a3c7cdf9247f6c12ac3eb67aad684d

Download Submit
C:\Users\Admin\AppData\Local\Notepad\pythonw.exe

Filesize
99KB

MD5
b6c2cf15f7998bbdd36f3c9d7b5e9ec3

SHA1
c85dd8b79f85f1b37003864ca7d150b2d2ae265c

SHA256
81918ea5fa5529f04a00bafc7e3fb54978a0b7790cfc7a5dad9fa9640666560a

SHA512
2799d77cad08ad88d06592044ced6d9b77acf66cbce4c9a0dcaba7c5a9ae6d785532b2803e1a271a603f274f2d794182985c7c3e560f559a6165bea2aa6f456d

Download Submit
C:\Users\Admin\AppData\Local\Notepad\select.pyd

Filesize
29KB

MD5
a653f35d05d2f6debc5d34daddd3dfa1

SHA1
1a2ceec28ea44388f412420425665c3781af2435

SHA256
db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

SHA512
5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

Download Submit
C:\Users\Admin\AppData\Local\Notepad\test-gpu.py

Filesize
566KB

MD5
7e2e595bc5cad4a416fa4e62f41dd8eb

SHA1
d93fc96326ca00e16b5d17625be03ad55c4e0401

SHA256
eb997c05ab4aa2f66758c01acd1e90fe7a0d4404f787ea941d2925b611f7601f

SHA512
13febe1957973133c1c3deceabbc9c795350b7f51bb3dd68cbd3680ba7c83a60f96ccef2a3d92393c09e6742949732f4425e8020d01f172509916366532f1113

Download Submit
C:\Users\Admin\AppData\Local\Notepad\vcruntime140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4373.tmp\InstallOptions.dll

Filesize
14KB

MD5
9b2ad0546fd834c01a3bdcbfbc95da7d

SHA1
4f92f5a6b269d969ba3340f1c1978d337992a62c

SHA256
7e08cb4ff81dbb0573c672301681e31b2042682e9a2204673f811455f823dd37

SHA512
5b374fe7cc8d6ff8b93cfcc8deae23f2313f8240c998d04d3e65c196b33c7d36a33930ffd481cdd6d30aa4c73dd2a1c6fe43791e9bf10bd71b33321a8e71c6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4373.tmp\System.dll

Filesize
10KB

MD5
4125926391466fdbe8a4730f2374b033

SHA1
fdd23034ada72d2537939ac6755d7f7c0e9b3f0e

SHA256
6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5

SHA512
32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4373.tmp\ioSpecial.ini

Filesize
725B

MD5
a8d4966b160e6098d765d370dadf901e

SHA1
ddd5fb8a813c9474911b36ce402edc91539213a5

SHA256
21f259aeb6745ed2e4b1268d4b1946ec62489067db0bf994bc05dfa8ed3c5736

SHA512
d039bbc5ebd83ac6a566158e5da40c03f040ec4e4ee23a043e66935d0f6ad7689b0d066b82b7e25fde4d91872a220a8a944b1ad7e42471934ad448b3b2bec082

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4373.tmp\ioSpecial.ini

Filesize
800B

MD5
34e28d45d15c19eb3c7a7e1bf174153f

SHA1
1a5a23e0f177689483881d804f011a13c8b54b12

SHA256
26040216f30233fdfc5ab1ccd7ddd75af1c8023f99887f926b75807ea477d239

SHA512
5085117bd4902030207913a4bc7d86da7098c9f64db0a657f13c534fbbf4ee306f1643ec3abb3819360db02a01837e23607cd4c02bbdb9862910658ade6987e0

Download Submit
C:\Users\Public\Downloads\windirstat1_1_2_setup.exe

Filesize
630KB

MD5
3abf1c149873e25d4e266225fbf37cbf

SHA1
6fa92dd2ca691c11dfbfc0a239e34369897a7fab

SHA256
370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

SHA512
b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e

Download Submit
memory/1632-1312-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1315-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1316-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1317-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1318-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1319-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1314-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1320-0x00007FF4E68E0000-0x00007FF4E68E3000-memory.dmp

Filesize
12KB

Download
memory/1632-1321-0x00007FF4E68D0000-0x00007FF4E68D1000-memory.dmp

Filesize
4KB

Download
memory/1632-1326-0x00007FF4E6880000-0x00007FF4E6881000-memory.dmp

Filesize
4KB

Download
memory/1632-1327-0x00007FFD9EF30000-0x00007FFD9F1F9000-memory.dmp

Filesize
2.8MB

Download
memory/1632-1325-0x00007FF4E6890000-0x00007FF4E6891000-memory.dmp

Filesize
4KB

Download
memory/1632-1324-0x00007FF4E68A0000-0x00007FF4E68A1000-memory.dmp

Filesize
4KB

Download
memory/1632-1323-0x00007FF4E68B0000-0x00007FF4E68B1000-memory.dmp

Filesize
4KB

Download
memory/1632-1322-0x00007FF4E68C0000-0x00007FF4E68C1000-memory.dmp

Filesize
4KB

Download
memory/1632-1328-0x00007FFD9E440000-0x00007FFD9E458000-memory.dmp

Filesize
96KB

Download
memory/1632-1332-0x00007FF4E68B0000-0x00007FF4E68B1000-memory.dmp

Filesize
4KB

Download
memory/1632-1331-0x00007FF4E68C0000-0x00007FF4E68C1000-memory.dmp

Filesize
4KB

Download
memory/1632-1335-0x00007FF4E6880000-0x00007FF4E6881000-memory.dmp

Filesize
4KB

Download
memory/1632-1333-0x00007FF4E68A0000-0x00007FF4E68A1000-memory.dmp

Filesize
4KB

Download
memory/1632-1329-0x00007FF4E68E0000-0x00007FF4E68E1000-memory.dmp

Filesize
4KB

Download
memory/1632-1336-0x00000204AF0A0000-0x00000204AF0AF000-memory.dmp

Filesize
60KB

Download
memory/1632-1313-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1311-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1310-0x000000033A860000-0x000000033A8D0000-memory.dmp

Filesize
448KB

Download
memory/1632-1305-0x0000000200FA0000-0x000000020199F000-memory.dmp

Filesize
10.0MB

Download
memory/3844-1170-0x00007FFD824F0000-0x00007FFD83A5D000-memory.dmp

Filesize
21.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads