3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AV-2.scr
Size

5.9MB
MD5

ca1fb1ad30189110cc225620dc537368
SHA1

bfc2de8f0b376a6f1ff1930a4f261709a27e92ec
SHA256

3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69
SHA512

11737f00ac297040b40cfe6879b695c9900b6b2a691e0b4e12c190ed9918179d0b7a76415d67368d3767f7d357e1c0df202af618964986f72dcbac7bfd5ace17
SSDEEP

98304:RLNSThOfTCiFBXmfFs+JhTpCVoR8oMEOJ6Ty3RvX+A0eVObApY:bBfTCiUsBVSLOJgyBG3KTp

Score

10^/10

discovery evasion persistence pyinstaller upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123456

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
password

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
root

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123123

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
pass1234

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
wwwwww

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www1

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www123

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www2016

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www2015

Extracted

Credentials

Protocol: ftp
Host:
103.243.131.163
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www!

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
P@ssw0rd!!

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
qwa123

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
12345678

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
test

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123qwe!@#

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123456789

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123321

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
1314520

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
159357

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www2017

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
666666

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
woaini

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
fuckyou

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
000000

Extracted

Credentials

Protocol: ftp
Host:
45.95.12.21
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
1234567890

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
8888888

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
qwerty

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
1qaz2wsx

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
abc123

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
abc123456

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
1q2w3e4r

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
123qwe

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www2019

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
www2018

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
p@ssw0rd

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
p@55w0rd

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
password!

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
p@ssw0rd!

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
password1

Extracted

Credentials

Protocol: ftp
Host:
154.203.101.196
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
r00t

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
tomcat

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
5201314

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
system

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
pass

Extracted

Credentials

Protocol: ftp
Host:
208.113.155.170
Port:
21
Username:
www
Password:
1234

Extracted

Credentials

Protocol: ftp
Host:
83.223.79.60
Port:
21
Username:
www

Extracted

Credentials

Protocol: ftp
Host:
83.223.79.60
Port:
21
Username:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
156.240.25.139
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
141.164.51.247
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
141.164.51.247
Port:
21
Username:
www
Password:
123456

Extracted

Credentials

Protocol: ftp
Host:
141.164.51.247
Port:
21
Username:
www
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
141.164.51.247
Port:
21
Username:
www
Password:
password

Extracted

Credentials

Protocol: ftp
Host:
141.164.51.247
Port:
21
Username:
www
Password:
root

Extracted

Credentials

Protocol: ftp
Host:
221.143.48.201
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
216.92.147.207
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
157.25.140.146
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
103.94.240.140
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
83.223.79.60
Port:
21
Username:
admin

Extracted

Credentials

Protocol: ftp
Host:
43.239.249.206
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
83.223.79.60
Port:
21
Username:
Admin

Extracted

Credentials

Protocol: ftp
Host:
43.239.249.206
Port:
21
Username:
www
Password:
123456

Extracted

Credentials

Protocol: ftp
Host:
38.238.215.170
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
43.239.249.206
Port:
21
Username:
www
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
43.239.249.206
Port:
21
Username:
www
Password:
password

Extracted

Credentials

Protocol: ftp
Host:
209.140.21.136
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
159.223.69.228
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
43.239.249.206
Port:
21
Username:
www
Password:
root

Extracted

Credentials

Protocol: ftp
Host:
43.239.249.206
Port:
21
Username:
www
Password:
123123

Extracted

Credentials

Protocol: ftp
Host:
107.149.104.21
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
102.134.35.141
Port:
21
Username:
www
Password:
anonymous

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
123456

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
107.149.104.21
Port:
21
Username:
www
Password:
123456

Extracted

Credentials

Protocol: ftp
Host:
102.134.35.141
Port:
21
Username:
www
Password:
123456

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
password

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
root

Extracted

Credentials

Protocol: ftp
Host:
107.149.104.21
Port:
21
Username:
www
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
102.134.35.141
Port:
21
Username:
www
Password:
admin

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
123123

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
123

Extracted

Credentials

Protocol: ftp
Host:
107.149.104.21
Port:
21
Username:
www
Password:
password

Extracted

Credentials

Protocol: ftp
Host:
102.134.35.141
Port:
21
Username:
www
Password:
password

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www
Password:
pass1234

Extracted

Credentials

Protocol: ftp
Host:
89.161.191.125
Port:
21
Username:
www

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4664 netsh.exe

pid	process
4664	netsh.exe

Registers new Print Monitor 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

spoolsv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe

ACProtect 1.3x - 1.4x DLL software 16 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI30882\python27.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\Crypto.Cipher._AES.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_ctypes.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_ssl.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\_hashlib.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\_ssl.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_socket.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\psutil._psutil_windows.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\netifaces.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\servicemanager.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\win32event.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI30882\win32api.pyd	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI50482\pywintypes27.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\_MEI50482\win32service.pyd	acprotect

Executes dropped EXE 7 IoCs

Processes:

HelpPane.exeHelpPane.exeHelpPane.exeHelpPane.exeHelpPane.exeHelpPane.exexmrig.exe

pid process

5048 HelpPane.exe
1828 HelpPane.exe
3820 HelpPane.exe
1840 HelpPane.exe
4900 HelpPane.exe
2276 HelpPane.exe
4388 xmrig.exe

pid	process
5048	HelpPane.exe
1828	HelpPane.exe
3820	HelpPane.exe
1840	HelpPane.exe
4900	HelpPane.exe
2276	HelpPane.exe
4388	xmrig.exe

Loads dropped DLL 62 IoCs

Processes:

AV-2.scrHelpPane.exeHelpPane.exeHelpPane.exe

pid	process
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
5064	AV-2.scr
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1828	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
1840	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI30882\python27.dll	upx
behavioral2/memory/5064-34-0x00000000751C0000-0x0000000075470000-memory.dmp	upx
behavioral2/memory/5064-37-0x0000000010000000-0x000000001000E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\Crypto.Cipher._AES.pyd	upx
behavioral2/memory/5064-40-0x00000000750F0000-0x000000007510D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_ctypes.pyd	upx
behavioral2/memory/5064-45-0x00000000750D0000-0x00000000750E1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\_hashlib.pyd	upx
behavioral2/memory/5064-47-0x0000000074F60000-0x00000000750C9000-memory.dmp	upx
behavioral2/memory/5064-49-0x0000000074E50000-0x0000000074F57000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_socket.pyd	upx
behavioral2/memory/5064-53-0x0000000002790000-0x00000000027A4000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\psutil._psutil_windows.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\netifaces.pyd	upx
behavioral2/memory/5064-65-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral2/memory/5064-72-0x000000001E7D0000-0x000000001E7DE000-memory.dmp	upx
behavioral2/memory/5064-71-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\servicemanager.pyd	upx
behavioral2/memory/5064-69-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\win32event.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI30882\win32api.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll	upx
behavioral2/memory/1828-119-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/5064-120-0x00000000750F0000-0x000000007510D000-memory.dmp	upx
behavioral2/memory/1828-122-0x0000000074990000-0x00000000749AD000-memory.dmp	upx
behavioral2/memory/1828-135-0x0000000074970000-0x0000000074981000-memory.dmp	upx
behavioral2/memory/1828-148-0x00000000746F0000-0x00000000747F7000-memory.dmp	upx
behavioral2/memory/1828-155-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral2/memory/1828-156-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral2/memory/1828-161-0x00000000746F0000-0x00000000747F7000-memory.dmp	upx
behavioral2/memory/1828-163-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
behavioral2/memory/5064-160-0x0000000074E50000-0x0000000074F57000-memory.dmp	upx
behavioral2/memory/1840-223-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/5064-225-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral2/memory/1840-228-0x0000000074970000-0x0000000074981000-memory.dmp	upx
behavioral2/memory/1840-229-0x00000000746F0000-0x00000000747F7000-memory.dmp	upx
behavioral2/memory/1840-227-0x0000000074990000-0x00000000749AD000-memory.dmp	upx
behavioral2/memory/1840-230-0x0000000001290000-0x00000000012A4000-memory.dmp	upx
behavioral2/memory/1840-232-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral2/memory/1840-235-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
behavioral2/memory/1840-236-0x000000001E7D0000-0x000000001E7DE000-memory.dmp	upx
behavioral2/memory/2276-268-0x0000000074440000-0x00000000746F0000-memory.dmp	upx
behavioral2/memory/1840-234-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral2/memory/1840-269-0x00000000749B0000-0x0000000074C60000-memory.dmp	upx
behavioral2/memory/2276-271-0x0000000074420000-0x000000007443D000-memory.dmp	upx
behavioral2/memory/2276-275-0x0000000074290000-0x00000000743F9000-memory.dmp	upx
behavioral2/memory/2276-277-0x0000000074180000-0x0000000074287000-memory.dmp	upx
behavioral2/memory/2276-279-0x0000000001C30000-0x0000000001C44000-memory.dmp	upx
behavioral2/memory/1840-278-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral2/memory/1840-276-0x00000000746F0000-0x00000000747F7000-memory.dmp	upx
behavioral2/memory/1840-274-0x0000000074990000-0x00000000749AD000-memory.dmp	upx
behavioral2/memory/2276-280-0x0000000001C50000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/2276-281-0x000000001ECB0000-0x000000001ECC1000-memory.dmp	upx
behavioral2/memory/1840-284-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/1840-288-0x0000000074970000-0x0000000074981000-memory.dmp	upx
behavioral2/memory/1840-297-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
behavioral2/memory/1840-296-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral2/memory/1840-295-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral2/memory/1840-298-0x000000001E7D0000-0x000000001E7DE000-memory.dmp	upx
behavioral2/memory/5064-316-0x00000000751C0000-0x0000000075470000-memory.dmp	upx
behavioral2/memory/5064-319-0x00000000750D0000-0x00000000750E1000-memory.dmp	upx

Detects Pyinstaller 5 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\HelpPane.exe	pyinstaller
C:\Users\Admin\HelpPane.exe	pyinstaller
C:\Users\Admin\HelpPane.exe	pyinstaller
C:\Users\Admin\HelpPane.exe	pyinstaller
C:\Users\Admin\HelpPane.exe	pyinstaller

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

spoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spoolsv.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2148 taskkill.exe

pid	process
2148	taskkill.exe

Modifies data under HKEY_USERS 22 IoCs

Processes:

spoolsv.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

HelpPane.exe

pid	process
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe
2276	HelpPane.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

AV-2.scrHelpPane.exeHelpPane.exetaskkill.exexmrig.exe

description	pid	process
Token: SeDebugPrivilege	5064	AV-2.scr
Token: SeDebugPrivilege	1828	HelpPane.exe
Token: SeDebugPrivilege	1840	HelpPane.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeLockMemoryPrivilege	4388	xmrig.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

AV-2.scrAV-2.scrcmd.exeHelpPane.execmd.exeHelpPane.exeHelpPane.exeHelpPane.execmd.exe

description	pid	process	target process
PID 3088 wrote to memory of 5064	3088	AV-2.scr	AV-2.scr
PID 3088 wrote to memory of 5064	3088	AV-2.scr	AV-2.scr
PID 3088 wrote to memory of 5064	3088	AV-2.scr	AV-2.scr
PID 5064 wrote to memory of 3480	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 3480	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 3480	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 5104	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 5104	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 5104	5064	AV-2.scr	cmd.exe
PID 5104 wrote to memory of 5048	5104	cmd.exe	HelpPane.exe
PID 5104 wrote to memory of 5048	5104	cmd.exe	HelpPane.exe
PID 5104 wrote to memory of 5048	5104	cmd.exe	HelpPane.exe
PID 5048 wrote to memory of 1828	5048	HelpPane.exe	HelpPane.exe
PID 5048 wrote to memory of 1828	5048	HelpPane.exe	HelpPane.exe
PID 5048 wrote to memory of 1828	5048	HelpPane.exe	HelpPane.exe
PID 5064 wrote to memory of 2496	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 2496	5064	AV-2.scr	cmd.exe
PID 5064 wrote to memory of 2496	5064	AV-2.scr	cmd.exe
PID 2496 wrote to memory of 3820	2496	cmd.exe	HelpPane.exe
PID 2496 wrote to memory of 3820	2496	cmd.exe	HelpPane.exe
PID 2496 wrote to memory of 3820	2496	cmd.exe	HelpPane.exe
PID 3820 wrote to memory of 1840	3820	HelpPane.exe	HelpPane.exe
PID 3820 wrote to memory of 1840	3820	HelpPane.exe	HelpPane.exe
PID 3820 wrote to memory of 1840	3820	HelpPane.exe	HelpPane.exe
PID 4900 wrote to memory of 2276	4900	HelpPane.exe	HelpPane.exe
PID 4900 wrote to memory of 2276	4900	HelpPane.exe	HelpPane.exe
PID 4900 wrote to memory of 2276	4900	HelpPane.exe	HelpPane.exe
PID 2276 wrote to memory of 4908	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 4908	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 4908	2276	HelpPane.exe	cmd.exe
PID 4908 wrote to memory of 2148	4908	cmd.exe	taskkill.exe
PID 4908 wrote to memory of 2148	4908	cmd.exe	taskkill.exe
PID 4908 wrote to memory of 2148	4908	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 1476	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 1476	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 1476	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 4788	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 4788	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 4788	2276	HelpPane.exe	cmd.exe
PID 2276 wrote to memory of 4388	2276	HelpPane.exe	xmrig.exe
PID 2276 wrote to memory of 4388	2276	HelpPane.exe	xmrig.exe
PID 2276 wrote to memory of 4388	2276	HelpPane.exe	xmrig.exe
PID 2276 wrote to memory of 4664	2276	HelpPane.exe	netsh.exe
PID 2276 wrote to memory of 4664	2276	HelpPane.exe	netsh.exe
PID 2276 wrote to memory of 4664	2276	HelpPane.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\AV-2.scr
"C:\Users\Admin\AppData\Local\Temp\AV-2.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:3088

C:\Users\Admin\AppData\Local\Temp\AV-2.scr
"C:\Users\Admin\AppData\Local\Temp\AV-2.scr" /S
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /y C:\Users\Admin\AppData\Local\Temp\AV-2.scr C:\Users\Admin\HelpPane.exe
3⤵
PID:3480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe --startup auto install
3⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Users\Admin\HelpPane.exe
C:\Users\Admin\HelpPane.exe --startup auto install
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048

C:\Users\Admin\HelpPane.exe
C:\Users\Admin\HelpPane.exe --startup auto install
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe start
3⤵
- Suspicious use of WriteProcessMemory
PID:2496

C:\Users\Admin\HelpPane.exe
C:\Users\Admin\HelpPane.exe start
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820

C:\Users\Admin\HelpPane.exe
C:\Users\Admin\HelpPane.exe start
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Users\Admin\HelpPane.exe
"C:\Users\Admin\HelpPane.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI49~1\\config.json C:\Windows\TEMP\config.json
2⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI49~1\\xmrig.exe C:\Windows\TEMP\xmrig.exe
2⤵
PID:1476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /pid 2012 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram C:\Users\Admin\HelpPane.exe "MyApp" ENABLE
2⤵
- Modifies Windows Firewall
PID:4664

C:\Windows\TEMP\xmrig.exe
C:\Windows\TEMP\xmrig.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Admin\HelpPane.exe
"C:\Users\Admin\HelpPane.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 2012 /f
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30882\Crypto.Cipher._AES.pyd
Filesize
16KB

MD5
371397e80a55d432da47311b8ef25317

SHA1
71617777d6a2500d6464d7b394c8be5f1e4e119e

SHA256
c1a900615c9500c46b9602c30c53f299290b03632208ef1152af8830ab73ad17

SHA512
3139e2848acf02cc8475449f213873d2c2b7196f6a55c70d2d8f8b487020387740364e5ca0aa584624d1b9b01b965146a2f0e15eef34830c7c0ecbb8637dae03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_ctypes.pyd
Filesize
37KB

MD5
6cb8b560efbc381651d2045f1571d7c8

SHA1
15283a7a467adb7b6d7a7182f660dd783f90e483

SHA256
6456fea123e04bcec8a8eed26160e1df5482e69d187d3e1a0c428995472ac134

SHA512
ca2958095e8e08b5ef05ec9de15b7d1eb180923a40b90356db56a124101c96d8e745001948b89dbe9d6b9ce3c2029f7e9eaf20c73fa1d410a821d6605830bfc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_socket.pyd
Filesize
21KB

MD5
be47363992c7dd90019276d35fa8da76

SHA1
ccf7ebbe829da08efd95a53d4ba0c0d4938f6169

SHA256
be10254b111713bef20a13d561de61ca3c74a34c64ddc5b10825c64ab2c46734

SHA512
573f9111535a9a136fcaaa5c1a16c347f7327626768d849513d69c9848406b1002dcc5b8c17a291ef2e6519587533ca806018ee471a39d330f032a9e7e635ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\_ssl.pyd
Filesize
487KB

MD5
68c3ad86e0a8833c29ad1be10d3c025d

SHA1
04488362814b2f3ae07c4e8df8e45868d48b447f

SHA256
c236271b92a0f1d3304337f2e2444107f34d8e26272981f48c47db347133566c

SHA512
bb2819d913033cc26dcd1e5cbf015dacdbf747d29c72bfd41bfe0d74bb77e51a61cf9be4b67b6348938837125f1d0f80af0ac33531e00cea1585535952a22785

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\ftpcrack.exe.manifest
Filesize
1KB

MD5
b5dea49b86c5bb5d9cd8d64a09f70065

SHA1
487ef676ebd244ebc3cf197f70da7a5e393fb96e

SHA256
78b1160f6adab34d144ad19a0f4b83f83453f1e18460bbdfbe17ad354b62af7d

SHA512
1b5914f4c52f47a33c57f5f6428482e6766099bf43d4e8616ce4aabc4a917c24b2e0c98c841f0d7e7b8a202f40ff960885535539bf70cc7c7ed8687c7ece010c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\psutil._psutil_windows.pyd
Filesize
25KB

MD5
2fc800fcc46a597921c2ed447aeb09ac

SHA1
72004227e5c60c8460f835a170798aa22861b79e

SHA256
2e4ad3d08118da77c928c4614bfecb34397cfaf53f5d46d7c7e5f1da3172c1f1

SHA512
a17022b364615b45a1873aea0de922a2988e4d75a8f4e63ecb9ca7dd46263e684b1f28b82bd77b046bbe2ad03ce65c5dacf98eaccae861a30f137e0118a87225

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\python27.dll
Filesize
877KB

MD5
8c44826a640b3cf0b32b0258c65fee07

SHA1
e3f9fe6366d0876bfa8b903b20d2acf06416f1bc

SHA256
fbad053d962bac96865ac3372958d697711800fdc46f36c87011bb5e89026614

SHA512
884e2c01c088b9ae86d4605fed1cf8e9b17f99cf887efc5644f4a91959ecd89148cca3e9fdaa6ab9e8c4dfd2d61dbdfd442a95b13dab7e5cd027b4782d473355

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\servicemanager.pyd
Filesize
16KB

MD5
6a95bcf45e4be23cc2634ef5bad17660

SHA1
7d13b791588cb800c2add75ff8e74c3c493a8143

SHA256
60da4b4e628b7dc1115615128ac554aeb29b50a61629ad5aeeb5cc9d2bd86202

SHA512
d3c80b025647444f42d42e82cad50c4383728f7f8c9e16aa9d87450ca864b0b97b5f8f47e80328a4a2b67ce7d06c9a8f1dae8c5b3c798de1b2a50164161e69c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\win32api.pyd
Filesize
34KB

MD5
42c475231f4835bb1a5f94b0d3da4520

SHA1
fcfae296dd10c92d973a57d61bbf5c0f4a15ed6b

SHA256
87ceeb1b7586db730f48988a07018f9c8af57934ff7f173a869542207f46b0f1

SHA512
d1a699b8497e8843f990f6f719a904a7751fe2a9404cb195be2d94341728a7372cd93d379b576e6031980e1da53f2336805c6bf59e799b63565cd63d4931c02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30882\win32event.pyd
Filesize
11KB

MD5
796306be7a1abcffb8853ee9ceb5beae

SHA1
93762cf53958a3a99b674986fcf3c53c489133ed

SHA256
26e6d883e9e61bf872425526a9b8c7bb229c3b9d2f82bb3c0bf500660dbe1995

SHA512
5919a837fa1fcaea91b14d02da306928d5e523e4591dca290422c9eb9be15f2ee626a8379f5c953f2b08e7a6b2cd67618652b9efa9ace8abd47a8bd7cd8c2f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\_hashlib.pyd
Filesize
343KB

MD5
ee134421fbabeb565e4f3ca721331c2e

SHA1
4b03bdd142c6a7bb6f74abe968c5b76b63e06059

SHA256
7863e1bedfe1ffc720b67b2eb7b3491db9d2b8e56b5574e6a40ff90336b8dafa

SHA512
d27ff65b6a8bf2e5e70d2865e72eee6930e76c2a3990428c54fc998743d3c540c5c984b5d1429e8ffbe3d160ae1f6782cd6d3ca40822f81d2052ba168595d1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\_ssl.pyd
Filesize
474KB

MD5
4b9d5c55e5a35dbfce6d632d334a46d5

SHA1
e236c4f7517bf2bd393f238a0935d41b45f8241d

SHA256
a450e728925da08eb237ab388ec17fc4e180b0b48fff7e7d5da1b6a68c14d319

SHA512
21586f7cfecfb764557eb09a72585f42100b1c6b2702855e03588272664664851d1aad128bb50770f71088835b82d2ad909dca33f792a432af472e2142f2d7b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30~1\netifaces.pyd
Filesize
11KB

MD5
c7807680a69196c3ee66c4cfb3e271ac

SHA1
d3ea74c9e3b810c6a1ee4296b97e20f2f45c9461

SHA256
1a6c57ac8031582477b1d3463a65b6eb006eea704e27c8c4b812b99ea910428d

SHA512
a5d893132ad889e98b434da7fd5ca377afb1800fd8d3230cced5e9fde576fcec943dd22fa48810ba6d93c510ebaa8ac5a94ec1b9d639fd6c533c5bbd4737cf15

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll
Filesize
279KB

MD5
cf43c67da98968c5b08037d33743d678

SHA1
428a130ff9b42d545f6166971e3bf031e0929276

SHA256
c87b010839a9a1997a7112c877fa4e25034f6c12c94fcaf700e8a64ccc87e0ab

SHA512
d810f80614e4e721378120d8e981ab66be9a2ffec0e757b80d3779e03a4cdf8386c1809804fedf0ef829dcfd1a43f2d16f7919970dca905867ac90da37afd037

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50482\python27.dll
Filesize
183KB

MD5
dd7d8109436a95aa43b4f2b941c2fd0e

SHA1
b733c26418582e6f407076e7fcbdd3f10064537c

SHA256
8e1244c1957a58034ccfbe391a9dc101faceeaf486afaef523a9c10fe358f6ca

SHA512
69a686810ae56de489836e090d54143d41dda22787d53116609d2134018ef7f763cc4c20be923577a86c2c9ea6f97f510c7e24526a8dcbaed886aef21ecd7a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50482\pywintypes27.dll
Filesize
52KB

MD5
07b436bfa1c7b4ffc21fb39358158060

SHA1
7f5a47cdab9a7d93bbbd204cedffca61d3f80c84

SHA256
82c2926cb03a04392fa479801d505e2a387446bca978ff930177121db2fdb461

SHA512
13ebcb83f478c859ca808003933769b84290e108648b69f33043653263c5b4bd37ed5ca8d521b46a1d9122eb232f7e5d05a25e16f250d5573cf85cd5cdefb2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50482\win32service.pyd
Filesize
18KB

MD5
f23a62491bd945c050e3e1d13909e9e7

SHA1
b8dac4e00163533157a17e3b56d05e049a2375a2

SHA256
e52b5532a6764aaae67db557412b3f77ebdc8a14a72771a1c6414a83bb3fc15c

SHA512
52200cf9687752db43bbae703192c841694d5bd976fa56c0f25e0478cfb97681bc77677c1a8907167612ddf9fe6a561945fbeb0180022670af97bf41b5b11766

Download Submit
C:\Users\Admin\HelpPane.exe
Filesize
162KB

MD5
7ad48838ac9f1c2529d4bcada1585517

SHA1
58ba1d6cdedcb0e46450fbab16a9b2d863536f15

SHA256
472696601ee1da060e46d5d4d4ccf32b96d84b9bd3fda5c79c61988973fc5855

SHA512
7e75bbd11a1b71e278a88705d3975226d6ea2f705247587dfb2eb79b153fff91089121efa03c4d0d3352f37d1fca326085759b014342299bee61593dba12b109

Download Submit
C:\Users\Admin\HelpPane.exe
Filesize
135KB

MD5
5c91c67a5b9c3ac521c05af4656a409d

SHA1
d936285abd674925dc9c28b9c4544af452c25ea0

SHA256
344848b3dc3c7b0121cd62004514ae46094137b0e989b58cb7cf3c099ffd7bdf

SHA512
81ab7cf796f2226f7a0fef3e2a33fef052ce4641fd9bad0663c36cba4a6ab557ae9e13852ca7a29211eca1813b02385bb64f1edd7d3194c2317046be1c5b3d9f

Download Submit
C:\Users\Admin\HelpPane.exe
Filesize
51KB

MD5
750390036e95ce4d3d7133e5a4d5593a

SHA1
c2e74e18fa2bee4d7eddc19b37a5cd5d0f144f6c

SHA256
15bf578f794560c720a25e3e41e1ef5d151cf7c4c077fa5986023184d96ccab0

SHA512
4a5a7b8fb80c6c795f741c43c5805159db050384cea26ec8379898c385671a5a47e629f31ae0508b087e3f3c35393803d6cf0024f55e8290482d2bde99451aa0

Download Submit
C:\Users\Admin\HelpPane.exe
Filesize
407KB

MD5
0e442b4ea5ab552a9a96b6728ae7bc09

SHA1
abb7ef9988cb37df082be0b03f2003545555e2f3

SHA256
07b52e26e8ab8aa517476eedb243cd19a34c6725dc445f0be3d3a452f6587758

SHA512
1e2d881c4007bd60179fe1def27a10e63b71f3d0a93f491a898761d66fb984a2279749f7e9bd153bcb94cfd03234ce8cf2083c025715c6b0a29b176ec120b9e3

Download Submit
C:\Users\Admin\HelpPane.exe
Filesize
405KB

MD5
82b16e488c4b0cd777aaa3bda30650b8

SHA1
e565fe0c5fe8cad68f7c2c9786a62ac70cf898a0

SHA256
a133f528bf1f6a2068eaed5b8207d606bb10210204b13c9a819cb37bbb7eeb35

SHA512
47bd3d7bf96eb8131766c1cc2293d623157a8655caab3756f3a7a8cd228ea3ef39b2d4f41b47605eddf3cc828f54dadda4e296e16555950181f78e9ca08b9233

Download Submit
C:\Windows\Temp\config.json
Filesize
1KB

MD5
42a60033b0cc3d34577ac729e10ab957

SHA1
9f9e6ab8f51937754639fae6b4b172025d5d825e

SHA256
5106382075ddad29ecaa71fb572a03bcefb586f0b1426bd9de56b8bf1a82af57

SHA512
42e0771378f46dddaa02e58384a1077ddb43b738cd7f7a971a6889cb98bd169b6fb33ec5e68234981714a8a9a93c6a83259378573c034c32e87e626727b3cab1

Download Submit
C:\Windows\Temp\xmrig.exe
Filesize
364KB

MD5
7bfec395b2e98a380c63eac91e01ca19

SHA1
465ba6751b09883595b873fe4ad538ba661389ef

SHA256
69ae0c1ebcfa1816719f2970b626a3cba468c89627f47640c6df61efddf79305

SHA512
cf107ea8e8573aa3ce71e94d066cab10a851516ee23be8e8b1c1fe4a6c3a85aeb1d2211146f4824be387cb0106b7dbdf581a2cb90077386e0c16ce449ebd4f83

Download Submit
memory/1828-149-0x0000000001270000-0x0000000001284000-memory.dmp

Filesize
80KB

Download
memory/1828-157-0x0000000074970000-0x0000000074981000-memory.dmp

Filesize
68KB

Download
memory/1828-154-0x0000000074990000-0x00000000749AD000-memory.dmp

Filesize
116KB

Download
memory/1828-153-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/1828-152-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1828-119-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1828-158-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Filesize
56KB

Download
memory/1828-122-0x0000000074990000-0x00000000749AD000-memory.dmp

Filesize
116KB

Download
memory/1828-135-0x0000000074970000-0x0000000074981000-memory.dmp

Filesize
68KB

Download
memory/1828-148-0x00000000746F0000-0x00000000747F7000-memory.dmp

Filesize
1.0MB

Download
memory/1828-155-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/1828-156-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Filesize
132KB

Download
memory/1828-161-0x00000000746F0000-0x00000000747F7000-memory.dmp

Filesize
1.0MB

Download
memory/1828-163-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Filesize
52KB

Download
memory/1828-159-0x0000000074800000-0x0000000074969000-memory.dmp

Filesize
1.4MB

Download
memory/1828-151-0x0000000001180000-0x000000000118A000-memory.dmp

Filesize
40KB

Download
memory/1828-150-0x00000000749B0000-0x0000000074C60000-memory.dmp

Filesize
2.7MB

Download
memory/1828-126-0x0000000074800000-0x0000000074969000-memory.dmp

Filesize
1.4MB

Download
memory/1828-115-0x00000000749B0000-0x0000000074C60000-memory.dmp

Filesize
2.7MB

Download
memory/1840-297-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Filesize
52KB

Download
memory/1840-291-0x00000000746F0000-0x00000000747F7000-memory.dmp

Filesize
1.0MB

Download
memory/1840-227-0x0000000074990000-0x00000000749AD000-memory.dmp

Filesize
116KB

Download
memory/1840-230-0x0000000001290000-0x00000000012A4000-memory.dmp

Filesize
80KB

Download
memory/1840-232-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/1840-235-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Filesize
52KB

Download
memory/1840-236-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Filesize
56KB

Download
memory/1840-221-0x00000000749B0000-0x0000000074C60000-memory.dmp

Filesize
2.7MB

Download
memory/1840-234-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Filesize
132KB

Download
memory/1840-269-0x00000000749B0000-0x0000000074C60000-memory.dmp

Filesize
2.7MB

Download
memory/1840-226-0x0000000074800000-0x0000000074969000-memory.dmp

Filesize
1.4MB

Download
memory/1840-231-0x00000000012B0000-0x00000000012BA000-memory.dmp

Filesize
40KB

Download
memory/1840-233-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/1840-272-0x0000000074800000-0x0000000074969000-memory.dmp

Filesize
1.4MB

Download
memory/1840-278-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/1840-276-0x00000000746F0000-0x00000000747F7000-memory.dmp

Filesize
1.0MB

Download
memory/1840-274-0x0000000074990000-0x00000000749AD000-memory.dmp

Filesize
116KB

Download
memory/1840-282-0x00000000749B0000-0x0000000074C60000-memory.dmp

Filesize
2.7MB

Download
memory/1840-286-0x0000000074990000-0x00000000749AD000-memory.dmp

Filesize
116KB

Download
memory/1840-284-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1840-288-0x0000000074970000-0x0000000074981000-memory.dmp

Filesize
68KB

Download
memory/1840-228-0x0000000074970000-0x0000000074981000-memory.dmp

Filesize
68KB

Download
memory/1840-296-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Filesize
132KB

Download
memory/1840-295-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/1840-298-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Filesize
56KB

Download
memory/1840-290-0x0000000074800000-0x0000000074969000-memory.dmp

Filesize
1.4MB

Download
memory/1840-229-0x00000000746F0000-0x00000000747F7000-memory.dmp

Filesize
1.0MB

Download
memory/1840-292-0x0000000001290000-0x00000000012A4000-memory.dmp

Filesize
80KB

Download
memory/1840-293-0x00000000012B0000-0x00000000012BA000-memory.dmp

Filesize
40KB

Download
memory/1840-223-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1840-294-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/2276-268-0x0000000074440000-0x00000000746F0000-memory.dmp

Filesize
2.7MB

Download
memory/2276-358-0x0000000074440000-0x00000000746F0000-memory.dmp

Filesize
2.7MB

Download
memory/2276-270-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2276-275-0x0000000074290000-0x00000000743F9000-memory.dmp

Filesize
1.4MB

Download
memory/2276-271-0x0000000074420000-0x000000007443D000-memory.dmp

Filesize
116KB

Download
memory/2276-361-0x0000000074400000-0x0000000074411000-memory.dmp

Filesize
68KB

Download
memory/2276-364-0x0000000001C30000-0x0000000001C44000-memory.dmp

Filesize
80KB

Download
memory/2276-371-0x0000000002CE0000-0x0000000002D09000-memory.dmp

Filesize
164KB

Download
memory/2276-365-0x0000000001C50000-0x0000000001C5A000-memory.dmp

Filesize
40KB

Download
memory/2276-362-0x0000000074290000-0x00000000743F9000-memory.dmp

Filesize
1.4MB

Download
memory/2276-376-0x0000000074400000-0x0000000074411000-memory.dmp

Filesize
68KB

Download
memory/2276-373-0x0000000074440000-0x00000000746F0000-memory.dmp

Filesize
2.7MB

Download
memory/2276-279-0x0000000001C30000-0x0000000001C44000-memory.dmp

Filesize
80KB

Download
memory/2276-277-0x0000000074180000-0x0000000074287000-memory.dmp

Filesize
1.0MB

Download
memory/2276-281-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/2276-287-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Filesize
56KB

Download
memory/2276-285-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Filesize
132KB

Download
memory/2276-283-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/2276-280-0x0000000001C50000-0x0000000001C5A000-memory.dmp

Filesize
40KB

Download
memory/2276-273-0x0000000074400000-0x0000000074411000-memory.dmp

Filesize
68KB

Download
memory/4388-372-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/5064-224-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/5064-40-0x00000000750F0000-0x000000007510D000-memory.dmp

Filesize
116KB

Download
memory/5064-319-0x00000000750D0000-0x00000000750E1000-memory.dmp

Filesize
68KB

Download
memory/5064-328-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Filesize
56KB

Download
memory/5064-326-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Filesize
132KB

Download
memory/5064-222-0x0000000002790000-0x00000000027A4000-memory.dmp

Filesize
80KB

Download
memory/5064-225-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/5064-160-0x0000000074E50000-0x0000000074F57000-memory.dmp

Filesize
1.0MB

Download
memory/5064-120-0x00000000750F0000-0x000000007510D000-memory.dmp

Filesize
116KB

Download
memory/5064-69-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Filesize
132KB

Download
memory/5064-71-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Filesize
52KB

Download
memory/5064-72-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Filesize
56KB

Download
memory/5064-65-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download
memory/5064-53-0x0000000002790000-0x00000000027A4000-memory.dmp

Filesize
80KB

Download
memory/5064-49-0x0000000074E50000-0x0000000074F57000-memory.dmp

Filesize
1.0MB

Download
memory/5064-47-0x0000000074F60000-0x00000000750C9000-memory.dmp

Filesize
1.4MB

Download
memory/5064-45-0x00000000750D0000-0x00000000750E1000-memory.dmp

Filesize
68KB

Download
memory/5064-316-0x00000000751C0000-0x0000000075470000-memory.dmp

Filesize
2.7MB

Download
memory/5064-133-0x0000000074F60000-0x00000000750C9000-memory.dmp

Filesize
1.4MB

Download
memory/5064-130-0x00000000750D0000-0x00000000750E1000-memory.dmp

Filesize
68KB

Download
memory/5064-37-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/5064-34-0x00000000751C0000-0x0000000075470000-memory.dmp

Filesize
2.7MB

Download
memory/5064-113-0x00000000751C0000-0x0000000075470000-memory.dmp

Filesize
2.7MB

Download
memory/5064-62-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/5064-58-0x00000000027B0000-0x00000000027BA000-memory.dmp

Filesize
40KB

Download
memory/5064-327-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Filesize
52KB

Download
memory/5064-317-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/5064-318-0x00000000750F0000-0x000000007510D000-memory.dmp

Filesize
116KB

Download
memory/5064-321-0x0000000074E50000-0x0000000074F57000-memory.dmp

Filesize
1.0MB

Download
memory/5064-320-0x0000000074F60000-0x00000000750C9000-memory.dmp

Filesize
1.4MB

Download
memory/5064-322-0x0000000002790000-0x00000000027A4000-memory.dmp

Filesize
80KB

Download
memory/5064-323-0x00000000027B0000-0x00000000027BA000-memory.dmp

Filesize
40KB

Download
memory/5064-324-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Filesize
68KB

Download
memory/5064-325-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Filesize
156KB

Download