Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    116s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2024, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    source_prepared.exe
  • Size 77.5MB
  • Sample240206-c8lgbafdel
  • SHA256 ab6adf3a2ee5a9dbd7fe622c9c09759dee6a1c195f9510da44612cd73de9615c
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionpersistenceupx

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 4 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
      "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
      2⤵
      • Enumerates VirtualBox DLL files
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\the\""
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\the\activate.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\system32\attrib.exe
          attrib +s +h .
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:1388
        • C:\Users\Admin\the\gyatt.exe
          "gyatt.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Users\Admin\the\gyatt.exe
            "gyatt.exe"
            5⤵
            • Enumerates VirtualBox DLL files
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\the\""
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4280
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "source_prepared.exe"
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4112
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x530 0x534
    1⤵
      PID:2416
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4788

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\VCRUNTIME140.dll
            • Size 116KB
            • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_bz2.pyd
            • Size 48KB
            • SHA256 8c0571c2d937f8161626bb05acf6db121db399474be107467122b27b350310d8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_ctypes.pyd
            • Size 59KB
            • SHA256 5dc7f9409c83d146586d27c150534db326c52abfb499d6ba09d03f98259fa0a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\_lzma.pyd
            • Size 86KB
            • SHA256 dacc3b750b2c9d961064e3c7c35e46399405d8a2a544a6d243eb79a2b73338f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-console-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-console-l1-1-0.dll
            • Size 20KB
            • SHA256 191e08dea0ad5ac02e7e84669d9fffa5aa67dc696e36077c5fa20d81c80b6a56
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-datetime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-datetime-l1-1-0.dll
            • Size 20KB
            • SHA256 a94b80a5111aabefb1309609abdd300bb626d861cd8e0938b9735ab711a43c22
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-debug-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-debug-l1-1-0.dll
            • Size 20KB
            • SHA256 263e038363527b7bed05110f37f7e5b95f82aab9c0280c9c522cf7bfce10fd7d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-errorhandling-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-errorhandling-l1-1-0.dll
            • Size 20KB
            • SHA256 085968d938ea924827c4740697713674850218a8fe91dd9982e93b0effacc820
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-fibers-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-fibers-l1-1-0.dll
            • Size 20KB
            • SHA256 c86ebc9f48e2db659e80d9c7ad5f29e6b6c850eea58813c041baeff496ae4f18
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-file-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-file-l1-1-0.dll
            • Size 24KB
            • SHA256 120c3afed9ce2a981c61208757fca0665f43926751ec8d0d13e10ef1096a0d48
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-file-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-file-l1-2-0.dll
            • Size 20KB
            • SHA256 0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-file-l2-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-file-l2-1-0.dll
            • Size 20KB
            • SHA256 18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-handle-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-handle-l1-1-0.dll
            • Size 20KB
            • SHA256 7e45a1b997331f4d038f847f205904d6ec703df7a8c5c660435697e318ced8fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-heap-l1-1-0.dll
            • Size 20KB
            • SHA256 dd1e8c77002685629c5cd569ee17f9aa2bcb2e59d41b76ae5bc751cae26d75bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-interlocked-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-interlocked-l1-1-0.dll
            • Size 20KB
            • SHA256 ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-libraryloader-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-libraryloader-l1-1-0.dll
            • Size 20KB
            • SHA256 929298566ba01d1c3e64356a1f8370c1e97f0599f56f823c508cde9ae17f130b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-localization-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-localization-l1-2-0.dll
            • Size 20KB
            • SHA256 dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-memory-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-memory-l1-1-0.dll
            • Size 20KB
            • SHA256 8a4b66cea7b474506fbdbe4c45e78923645f5f0a13f7f4e43449649f50ea38b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-namedpipe-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-namedpipe-l1-1-0.dll
            • Size 20KB
            • SHA256 e8382a73730c2f7f873b40e2fcc5e1cd4847e7cb42fef3c76bea183af5891d65
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-processenvironment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-processenvironment-l1-1-0.dll
            • Size 20KB
            • SHA256 9c1afc7cd0b0e0d136d09b65dd082ace136fc306f8f116f3d13956211ec146c8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-processthreads-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-processthreads-l1-1-0.dll
            • Size 20KB
            • SHA256 6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-processthreads-l1-1-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-processthreads-l1-1-1.dll
            • Size 20KB
            • SHA256 19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-profile-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-profile-l1-1-0.dll
            • Size 20KB
            • SHA256 cc3c609193f2e99f80a6a21064d10c5c591101e386338879326775ccdd77dcb6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-rtlsupport-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-rtlsupport-l1-1-0.dll
            • Size 20KB
            • SHA256 bcb9a6dd2cc0caaa700d95fa3af5163a8246388c2efefbbc4cf6e1fe2687c72e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-string-l1-1-0.dll
            • Size 20KB
            • SHA256 9b071b842445a5dd90148445af148d024674085927d079864f7893807fd1b305
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-synch-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-synch-l1-1-0.dll
            • Size 20KB
            • SHA256 a981a24c9231e0230031bb1cba8f2509565ece1f53ebdb4d0a50efd722ab4330
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-synch-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-synch-l1-2-0.dll
            • Size 20KB
            • SHA256 69dd52caffe1ea6e0900fb9604a57a87618f8468dc68cbb2a9bcefd1265f3f49
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-sysinfo-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-sysinfo-l1-1-0.dll
            • Size 20KB
            • SHA256 3513cffa44c88ec13d6a8c9b63e5d505a131b46746d13ee654144f08a96f20c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-timezone-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-timezone-l1-1-0.dll
            • Size 20KB
            • SHA256 24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-core-util-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-core-util-l1-1-0.dll
            • Size 20KB
            • SHA256 2e1cc12f93837a4e1fe95e0c640b147be29793705628f9c6cd91a0b5c0c50262
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-conio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-conio-l1-1-0.dll
            • Size 20KB
            • SHA256 1368b9af85f186a2b35e2a744eb2103555234b32fdfbfdb94c0f5e525c588e46
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-convert-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-convert-l1-1-0.dll
            • Size 24KB
            • SHA256 2ccb01b62188ddc051a582c128bf880608111c602534e487ec09a7cf67c22d17
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-environment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-environment-l1-1-0.dll
            • Size 20KB
            • SHA256 5a2ae5b270c1eaf467878e7f5dbdc689b71914bdf30293d7d46c01d9dd11bdd4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-filesystem-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-filesystem-l1-1-0.dll
            • Size 20KB
            • SHA256 42a99227775e85ca8c197811a86aad0e2af496bd21623e4c9a2dd747571c8990
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-heap-l1-1-0.dll
            • Size 20KB
            • SHA256 43c80120970be1efed3ea60bf7aa37b46fcce946b94fb11ca6e3ffff2f16bb29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-locale-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-locale-l1-1-0.dll
            • Size 20KB
            • SHA256 6011ece89f4833dcb4cefb02ea366b828725205eae6f25ab704b76fd9e5d86eb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-math-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-math-l1-1-0.dll
            • Size 28KB
            • SHA256 5ba8f9c2842990ccdb447fc6d22023103b03f5387f341d3375809f060b5bb4ef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-private-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-private-l1-1-0.dll
            • Size 72KB
            • SHA256 0e2751637bbeb7ccc2556194fa774ea4bcb937ea803fc955c7f10be0bf38cc77
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-process-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-process-l1-1-0.dll
            • Size 20KB
            • SHA256 cfc12dd7c1deabf35c8e0fbe01248171c49555fe2d1bed72c5fdba2102090870
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-runtime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-runtime-l1-1-0.dll
            • Size 24KB
            • SHA256 698fa887c5b994375c9271222e21d0d4c74810e73d377ad898927549fb69dcb3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-stdio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-stdio-l1-1-0.dll
            • Size 24KB
            • SHA256 c1541ed4dc6879a136bf532393f7cefd3c48ad371d2ed9965e7cbd44c87a1137
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-string-l1-1-0.dll
            • Size 24KB
            • SHA256 4429b8e6707645fb503ebc3bd50ce2a84f559b6a2ed778196835808bdfec2f48
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-time-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-time-l1-1-0.dll
            • Size 20KB
            • SHA256 f3e6f692cec86adb3985b929345c731469777aeaeb088e3ce070957df481f924
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            api-ms-win-crt-utility-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\api-ms-win-crt-utility-l1-1-0.dll
            • Size 20KB
            • SHA256 6c78d4aba91877c5bb33e545b6a69a818f377e07ff62e791b804fa5b4d2bcf02
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\base_library.zip
            • Size 1.3MB
            • SHA256 eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            freetype.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\freetype.dll
            • Size 292KB
            • SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libcrypto-3.dll
            • Size 1.6MB
            • SHA256 3423134795ab8fce58190ae156d4b5d70053bebe6c9a228bea3281855e5357fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libffi-8.dll
            • Size 29KB
            • SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libjpeg-9.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libjpeg-9.dll
            • Size 108KB
            • SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libmodplug-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libmodplug-1.dll
            • Size 117KB
            • SHA256 9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libogg-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libogg-0.dll
            • Size 16KB
            • SHA256 2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libopus-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\libopus-0.dll
            • Size 181KB
            • SHA256 fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\python3.DLL
            • Size 66KB
            • SHA256 a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\python312.dll
            • Size 1.8MB
            • SHA256 b93e682bddb5c3e2af1f0264e83fbc40481fe6abd90c3ab26e94f246c8ce8d7d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI32522\ucrtbase.dll
            • Size 1.1MB
            • SHA256 d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            __PSScriptPolicyTest_nnbtdul3.a1h.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnbtdul3.a1h.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            memory/2900-1310-0x00007FFA378D0000-0x00007FFA378DF000-memory.dmp
            Download

            memory/2900-1392-0x00007FFA328A0000-0x00007FFA328AB000-memory.dmp
            Download

            memory/2900-1361-0x00007FFA324A0000-0x00007FFA324B4000-memory.dmp
            Download

            memory/2900-1360-0x00007FFA32610000-0x00007FFA3263D000-memory.dmp
            Download

            memory/2900-1313-0x00007FFA32640000-0x00007FFA32659000-memory.dmp
            Download

            memory/2900-1307-0x00007FFA32980000-0x00007FFA329A5000-memory.dmp
            Download

            memory/2900-1363-0x00007FFA32940000-0x00007FFA32959000-memory.dmp
            Download

            memory/2900-1364-0x00007FFA32920000-0x00007FFA3292D000-memory.dmp
            Download

            memory/2900-1365-0x00007FFA32000000-0x00007FFA320CD000-memory.dmp
            Download

            memory/2900-1366-0x00007FFA328E0000-0x00007FFA32913000-memory.dmp
            Download

            memory/2900-1367-0x00007FFA328C0000-0x00007FFA328CB000-memory.dmp
            Download

            memory/2900-1368-0x00007FFA31FD0000-0x00007FFA31FF7000-memory.dmp
            Download

            memory/2900-1369-0x00007FFA328D0000-0x00007FFA328DD000-memory.dmp
            Download

            memory/2900-1370-0x00007FFA31DF0000-0x00007FFA31F0B000-memory.dmp
            Download

            memory/2900-1371-0x00007FFA23010000-0x00007FFA236E8000-memory.dmp
            Download

            memory/2900-1372-0x00007FFA328B0000-0x00007FFA328BD000-memory.dmp
            Download

            memory/2900-1373-0x00007FFA32780000-0x00007FFA3278B000-memory.dmp
            Download

            memory/2900-1374-0x00007FFA32600000-0x00007FFA3260C000-memory.dmp
            Download

            memory/2900-1375-0x00007FFA32490000-0x00007FFA3249B000-memory.dmp
            Download

            memory/2900-1376-0x00007FFA31FC0000-0x00007FFA31FCC000-memory.dmp
            Download

            memory/2900-1377-0x00007FFA31FB0000-0x00007FFA31FBB000-memory.dmp
            Download

            memory/2900-1379-0x00007FFA31F90000-0x00007FFA31F9C000-memory.dmp
            Download

            memory/2900-1378-0x00007FFA31FA0000-0x00007FFA31FAC000-memory.dmp
            Download

            memory/2900-1380-0x00007FFA31F80000-0x00007FFA31F8E000-memory.dmp
            Download

            memory/2900-1381-0x00007FFA31F70000-0x00007FFA31F7C000-memory.dmp
            Download

            memory/2900-1382-0x00007FFA31DE0000-0x00007FFA31DEB000-memory.dmp
            Download

            memory/2900-1383-0x00007FFA31DD0000-0x00007FFA31DDB000-memory.dmp
            Download

            memory/2900-1385-0x00007FFA31DB0000-0x00007FFA31DBC000-memory.dmp
            Download

            memory/2900-1386-0x00007FFA31DA0000-0x00007FFA31DAD000-memory.dmp
            Download

            memory/2900-1384-0x00007FFA31DC0000-0x00007FFA31DCC000-memory.dmp
            Download

            memory/2900-1387-0x00007FFA31D80000-0x00007FFA31D92000-memory.dmp
            Download

            memory/2900-1388-0x00007FFA31D70000-0x00007FFA31D7C000-memory.dmp
            Download

            memory/2900-1390-0x00007FFA31D30000-0x00007FFA31D42000-memory.dmp
            Download

            memory/2900-1362-0x00007FFA22900000-0x00007FFA22E22000-memory.dmp
            Download

            memory/2900-1391-0x00007FFA31CF0000-0x00007FFA31D04000-memory.dmp
            Download

            memory/2900-1393-0x00007FFA31CC0000-0x00007FFA31CE2000-memory.dmp
            Download

            memory/2900-1389-0x00007FFA31D50000-0x00007FFA31D66000-memory.dmp
            Download

            memory/2900-1394-0x00007FFA324A0000-0x00007FFA324B4000-memory.dmp
            Download

            memory/2900-1395-0x00007FFA31C30000-0x00007FFA31C47000-memory.dmp
            Download

            memory/2900-1396-0x00007FFA31BC0000-0x00007FFA31C0A000-memory.dmp
            Download

            memory/2900-1397-0x00007FFA31BA0000-0x00007FFA31BB1000-memory.dmp
            Download

            memory/2900-1398-0x00007FFA31C10000-0x00007FFA31C29000-memory.dmp
            Download

            memory/2900-1399-0x00007FFA31B70000-0x00007FFA31B8E000-memory.dmp
            Download

            memory/2900-1400-0x00007FFA28F00000-0x00007FFA28F5D000-memory.dmp
            Download

            memory/2900-1401-0x00007FFA22900000-0x00007FFA22E22000-memory.dmp
            Download

            memory/2900-1402-0x00007FFA2BE70000-0x00007FFA2BEA9000-memory.dmp
            Download

            memory/2900-1403-0x00007FFA23AE0000-0x00007FFA23B09000-memory.dmp
            Download

            memory/2900-1405-0x00007FFA22FE0000-0x00007FFA2300E000-memory.dmp
            Download

            memory/2900-1404-0x00007FFA22FB0000-0x00007FFA22FD4000-memory.dmp
            Download

            memory/2900-1406-0x00007FFA21EA0000-0x00007FFA22016000-memory.dmp
            Download

            memory/2900-1407-0x00007FFA21D90000-0x00007FFA21DA8000-memory.dmp
            Download

            memory/2900-1408-0x00007FFA31FD0000-0x00007FFA31FF7000-memory.dmp
            Download

            memory/2900-1410-0x00007FFA2B5F0000-0x00007FFA2B5FB000-memory.dmp
            Download

            memory/2900-1409-0x00007FFA306F0000-0x00007FFA306FB000-memory.dmp
            Download

            memory/2900-1411-0x00007FFA28EF0000-0x00007FFA28EFC000-memory.dmp
            Download

            memory/2900-1412-0x00007FFA22F00000-0x00007FFA22F0B000-memory.dmp
            Download

            memory/2900-1413-0x00007FFA21D20000-0x00007FFA21D2C000-memory.dmp
            Download

            memory/2900-1414-0x00007FFA21D10000-0x00007FFA21D1B000-memory.dmp
            Download

            memory/2900-1416-0x00007FFA21CE0000-0x00007FFA21CEE000-memory.dmp
            Download

            memory/2900-1415-0x00007FFA21CF0000-0x00007FFA21CFC000-memory.dmp
            Download

            memory/2900-1417-0x00007FFA21CD0000-0x00007FFA21CDC000-memory.dmp
            Download

            memory/2900-1419-0x00007FFA21CB0000-0x00007FFA21CBB000-memory.dmp
            Download

            memory/2900-1418-0x00007FFA21CC0000-0x00007FFA21CCB000-memory.dmp
            Download

            memory/2900-1520-0x00007FFA23010000-0x00007FFA236E8000-memory.dmp
            Download

            memory/2900-1521-0x00007FFA32980000-0x00007FFA329A5000-memory.dmp
            Download

            memory/2900-1563-0x00007FFA2BE70000-0x00007FFA2BEA9000-memory.dmp
            Download

            memory/2900-1298-0x00007FFA23010000-0x00007FFA236E8000-memory.dmp
            Download