77b46bb278d78816aae4c1c4ab1dc60aa6143eb0c450373666d673d51ae32b10

Resubmissions

19/04/2024, 22:47

240419-2qw8jaad6z 7

19/04/2024, 22:22

19/04/2024, 22:20

19/04/2024, 22:19

19/04/2024, 22:17

19/04/2024, 22:16

19/04/2024, 22:14

Analysis

max time kernel
72s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

7.0MB
MD5

f85dc1ba52e4cc046d5e7d41ded3ac22
SHA1

98b8d673dd1c65303a6ea60e9b5b8babe671ea1c
SHA256

77b46bb278d78816aae4c1c4ab1dc60aa6143eb0c450373666d673d51ae32b10
SHA512

314743545610994dbecca18a9847f5c197c8faa7ab2e255d9453b6b860b99d2d310769388a8ed06a83f939eea4e0dd2fffe7a2ce0938b63904960ba27b5d6db9
SSDEEP

98304:WDIgj87TLy71+WYK4tbkZ7+f6b7s4IMsJRXOls3im6yboPMLqCR64ZYfXcQJMitx:WDFjoyHnGybXkJcj2iO3yfXciMit98W

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 18 IoCs

pid	Process
2160	test.exe
4256	test.exe
1816	test.exe
2544	test.exe
2588	test.exe
4648	test.exe
1244	test.exe
4844	test.exe
4348	test.exe
2040	test.exe
2036	test.exe
3848	test.exe
5776	test.exe
5872	test.exe
5880	test.exe
5888	test.exe
5900	test.exe
5908	test.exe

Loads dropped DLL 64 IoCs

pid	Process
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
2160	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
2544	test.exe
2544	test.exe
4256	test.exe
4256	test.exe
2544	test.exe
2544	test.exe
2544	test.exe
4256	test.exe
4256	test.exe
4256	test.exe
2544	test.exe
2544	test.exe
2544	test.exe
2544	test.exe
2544	test.exe
4256	test.exe
4256	test.exe
2544	test.exe
4256	test.exe
4256	test.exe
1816	test.exe
1816	test.exe
4256	test.exe
4256	test.exe
2588	test.exe
2588	test.exe
1816	test.exe
1816	test.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
33	discord.com
64	discord.com
109	discord.com
32	discord.com

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
107	ipinfo.io
108	ipinfo.io
11	ip-api.com
26	ipinfo.io
27	ipinfo.io
62	ipinfo.io

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	test.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	test.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 21 IoCs

evasion

pid	Process
1216	taskkill.exe
388	taskkill.exe
4364	taskkill.exe
2212	taskkill.exe
5372	taskkill.exe
1772	taskkill.exe
5336	taskkill.exe
4524	taskkill.exe
2348	taskkill.exe
2692	taskkill.exe
1432	taskkill.exe
2860	taskkill.exe
4444	taskkill.exe
4332	taskkill.exe
3888	taskkill.exe
3844	taskkill.exe
4552	taskkill.exe
2764	taskkill.exe
6136	taskkill.exe
1076	taskkill.exe
3452	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	taskmgr.exe
4864	taskmgr.exe
2160	test.exe
2160	test.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4256	test.exe
4256	test.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
1244	test.exe
1244	test.exe
4864	taskmgr.exe
2036	test.exe
2036	test.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
2132	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	taskmgr.exe
Token: SeSystemProfilePrivilege	4864	taskmgr.exe
Token: SeCreateGlobalPrivilege	4864	taskmgr.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	4524	taskkill.exe
Token: SeDebugPrivilege	388	taskkill.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	3888	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	3844	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeRestorePrivilege	2648	7zFM.exe
Token: 35	2648	7zFM.exe
Token: SeSecurityPrivilege	2648	7zFM.exe
Token: SeDebugPrivilege	6136	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
2648	7zFM.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
2648	7zFM.exe
2648	7zFM.exe
4864	taskmgr.exe
4864	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe
4864	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2160	2016	Loader.exe	86
PID 2016 wrote to memory of 2160	2016	Loader.exe	86
PID 2160 wrote to memory of 2544	2160	test.exe	91
PID 2160 wrote to memory of 2544	2160	test.exe	91
PID 2160 wrote to memory of 4256	2160	test.exe	92
PID 2160 wrote to memory of 4256	2160	test.exe	92
PID 2160 wrote to memory of 1816	2160	test.exe	93
PID 2160 wrote to memory of 1816	2160	test.exe	93
PID 2160 wrote to memory of 2588	2160	test.exe	94
PID 2160 wrote to memory of 2588	2160	test.exe	94
PID 2160 wrote to memory of 4648	2160	test.exe	95
PID 2160 wrote to memory of 4648	2160	test.exe	95
PID 2544 wrote to memory of 2644	2544	test.exe	96
PID 2544 wrote to memory of 2644	2544	test.exe	96
PID 2588 wrote to memory of 5024	2588	test.exe	99
PID 2588 wrote to memory of 5024	2588	test.exe	99
PID 1816 wrote to memory of 1144	1816	test.exe	98
PID 1816 wrote to memory of 1144	1816	test.exe	98
PID 4256 wrote to memory of 4272	4256	test.exe	97
PID 4256 wrote to memory of 4272	4256	test.exe	97
PID 2644 wrote to memory of 4444	2644	cmd.exe	104
PID 2644 wrote to memory of 4444	2644	cmd.exe	104
PID 4648 wrote to memory of 3176	4648	test.exe	105
PID 4648 wrote to memory of 3176	4648	test.exe	105
PID 5024 wrote to memory of 1216	5024	cmd.exe	107
PID 5024 wrote to memory of 1216	5024	cmd.exe	107
PID 4272 wrote to memory of 388	4272	cmd.exe	108
PID 4272 wrote to memory of 388	4272	cmd.exe	108
PID 1144 wrote to memory of 4524	1144	cmd.exe	109
PID 1144 wrote to memory of 4524	1144	cmd.exe	109
PID 3176 wrote to memory of 4332	3176	cmd.exe	111
PID 3176 wrote to memory of 4332	3176	cmd.exe	111
PID 1816 wrote to memory of 2140	1816	test.exe	112
PID 1816 wrote to memory of 2140	1816	test.exe	112
PID 2588 wrote to memory of 1048	2588	test.exe	114
PID 2588 wrote to memory of 1048	2588	test.exe	114
PID 2140 wrote to memory of 3888	2140	cmd.exe	116
PID 2140 wrote to memory of 3888	2140	cmd.exe	116
PID 1048 wrote to memory of 2348	1048	cmd.exe	117
PID 1048 wrote to memory of 2348	1048	cmd.exe	117
PID 2544 wrote to memory of 5016	2544	test.exe	120
PID 2544 wrote to memory of 5016	2544	test.exe	120
PID 2544 wrote to memory of 2320	2544	test.exe	122
PID 2544 wrote to memory of 2320	2544	test.exe	122
PID 4784 wrote to memory of 1244	4784	Loader.exe	132
PID 4784 wrote to memory of 1244	4784	Loader.exe	132
PID 1244 wrote to memory of 4844	1244	test.exe	133
PID 1244 wrote to memory of 4844	1244	test.exe	133
PID 1244 wrote to memory of 4348	1244	test.exe	134
PID 1244 wrote to memory of 4348	1244	test.exe	134
PID 1244 wrote to memory of 2040	1244	test.exe	135
PID 1244 wrote to memory of 2040	1244	test.exe	135
PID 1244 wrote to memory of 2036	1244	test.exe	136
PID 1244 wrote to memory of 2036	1244	test.exe	136
PID 1244 wrote to memory of 3848	1244	test.exe	137
PID 1244 wrote to memory of 3848	1244	test.exe	137
PID 4844 wrote to memory of 3888	4844	test.exe	138
PID 4844 wrote to memory of 3888	4844	test.exe	138
PID 4348 wrote to memory of 4768	4348	test.exe	141
PID 4348 wrote to memory of 4768	4348	test.exe	141
PID 3848 wrote to memory of 2000	3848	test.exe	139
PID 3848 wrote to memory of 2000	3848	test.exe	139
PID 2040 wrote to memory of 1740	2040	test.exe	140
PID 2040 wrote to memory of 1740	2040	test.exe	140

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe" "--multiprocessing-fork" "parent_pid=2160" "pipe_handle=648"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im chrome.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2320
- - C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe" "--multiprocessing-fork" "parent_pid=2160" "pipe_handle=660"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
- - C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe" "--multiprocessing-fork" "parent_pid=2160" "pipe_handle=664"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im vivaldi.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vivaldi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
- - C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe" "--multiprocessing-fork" "parent_pid=2160" "pipe_handle=716"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im msedge.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im browser.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im browser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
- - C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe" "--multiprocessing-fork" "parent_pid=2160" "pipe_handle=740"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im brave.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1536

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe" "--multiprocessing-fork" "parent_pid=1244" "pipe_handle=712"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im chrome.exe"
      4⤵
      PID:3888
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im vivaldi.exe"
      4⤵
      PID:4740
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vivaldi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
- - C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe" "--multiprocessing-fork" "parent_pid=1244" "pipe_handle=724"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im msedge.exe"
      4⤵
      PID:4768
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
- - C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe" "--multiprocessing-fork" "parent_pid=1244" "pipe_handle=384"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
      4⤵
      PID:1740
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im browser.exe"
      4⤵
      PID:3832
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im browser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
- - C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe" "--multiprocessing-fork" "parent_pid=1244" "pipe_handle=400"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im brave.exe"
      4⤵
      PID:1208
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
- - C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_4784_133580388912966485\test.exe" "--multiprocessing-fork" "parent_pid=1244" "pipe_handle=440"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
      4⤵
      PID:2000
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1632

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240412_113817033.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8175246f8,0x7ff817524708,0x7ff817524718
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14666497235491775549,15009617420358379859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,14666497235491775549,15009617420358379859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,14666497235491775549,15009617420358379859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14666497235491775549,15009617420358379859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14666497235491775549,15009617420358379859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
PID:5672
- C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  PID:5776
- - C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe" "--multiprocessing-fork" "parent_pid=5776" "pipe_handle=672"
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im chrome.exe"
      4⤵
      PID:5960
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im vivaldi.exe"
      4⤵
      PID:5208
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vivaldi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5336
- - C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe" "--multiprocessing-fork" "parent_pid=5776" "pipe_handle=684"
    3⤵
    - Executes dropped EXE
    PID:5880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
      4⤵
      PID:5968
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
- - C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe" "--multiprocessing-fork" "parent_pid=5776" "pipe_handle=688"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
      4⤵
      PID:5976
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe" "--multiprocessing-fork" "parent_pid=5776" "pipe_handle=716"
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im msedge.exe"
      4⤵
      PID:5984
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im browser.exe"
      4⤵
      PID:5264
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im browser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5372
- - C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe
    "C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\test.exe" "--multiprocessing-fork" "parent_pid=5776" "pipe_handle=740"
    3⤵
    - Executes dropped EXE
    PID:5908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /f /im brave.exe"
      4⤵
      PID:6120
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b8a8e51d4a4e08dfe56941902c1a15b

SHA1
9001e460ee0a9df47f6de1f99eda47b7e0d15454

SHA256
5cbaad31baf837fb29ff980caa6ac83a4990c6096d38dcafe688d3d64b965e5e

SHA512
f8f5b19531a3708cd8599ee6e2ba0e687d09afd2fa5353ba7a0a8d1b2a55d9540142b9a405b9ba46930b4c20564ba979b77e84cf1e2cf5173e0117c22afaefa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35250ec8cda1c7fc40ab422d1bb30f2e

SHA1
15a9fddeab7e1bb6d32075c320ba3d5e7f8170f1

SHA256
3e3776b5694d7ff201cc21d376a7cbbe0c015f45d83b807cf8433764662ec77c

SHA512
b10779304ca888553991e7c595d5ab8f5fd8ef6e4de6101f4aea2ba57286da4d5ff526c47281feee231e6d9cfd15f533cfb57f3660c2b68b5f1333fcbe104a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e334331edbc64346ebdc7e66b643dc03

SHA1
f83ff553c31452b8458b83b9d453e5c467f5d9f6

SHA256
ecb0f7d2dd5b1148f51d42de6c9b430a4bd3859e3a4df0fdaab0f0cbfd4fcfe7

SHA512
8ab1ddfa2d60b039d01f1241c7a99ba92ffb4ca164af1d9098f236b33f8c9a0076d6f9a262b3a520df3b071da3f5eee6fb5118c576f3a569f01da209401d1418

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_elementtree.pyd

Filesize
125KB

MD5
974d858b12d10c7ee9e8875f20e0e7af

SHA1
5f56ee3d0a26ce45857016c329984a1ef121fc61

SHA256
a77b2de78310c0b2b4158202ee48734d4835b7ba235aa5f6169f89566357369d

SHA512
cf35b43f28048013be4fa87cfbe7fde60a946784a833d3725aa9404502a75254a89d06da605d89fa59c2a84c20b5cfcb74a0a4f0ce2946618c6e495c6a845e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

Filesize
155KB

MD5
bc07d7ac5fdc92db1e23395fde3420f2

SHA1
e89479381beeba40992d8eb306850977d3b95806

SHA256
ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b

SHA512
b6105333bb15e65afea3cf976b3c2a8a4c0ebb09ce9a7898a94c41669e666ccfa7dc14106992502abf62f1deb057e926e1fd3368f2a2817bbf6845eada80803d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd

Filesize
31KB

MD5
e0cc8c12f0b289ea87c436403bc357c1

SHA1
e342a4a600ef9358b3072041e66f66096fae4da4

SHA256
9517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03

SHA512
4d93f23db10e8640cd33e860241e7ea6a533daf64c36c4184844e6cca7b9f4bd41db007164a549e30f5aa9f983345318ff02d72815d51271f38c2e8750df4d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

Filesize
77KB

MD5
290dbf92268aebde8b9507b157bef602

SHA1
bea7221d7abbbc48840b46a19049217b27d3d13a

SHA256
e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe

SHA512
9ae02b75e722a736b2d76cec9c456d20f341327f55245fa6c5f78200be47cc5885cb73dc3e42e302c6f251922ba7b997c6d032b12a4a988f39bc03719f21d1a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

Filesize
157KB

MD5
0a7eb5d67b14b983a38f82909472f380

SHA1
596f94c4659a055d8c629bc21a719ce441d8b924

SHA256
3bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380

SHA512
3b78fd4c03ee1b670e46822a7646e668fbaf1ef0f2d4cd53ccfcc4abc2399fcc74822f94e60af13b3cdcb522783c008096b0b265dc9588000b7a46c0ed5973e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_uuid.pyd

Filesize
24KB

MD5
a16b1acfdaadc7bb4f6ddf17659a8d12

SHA1
482982d623d88627c447f96703e4d166f9e51db4

SHA256
8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0

SHA512
03d65f37efc6aba325109b5a982be71380210d41dbf8c068d6a994228888d805adac1264851cc6f378e61c3aff1485cc6c059e83218b239397eda0cec87bd533

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll

Filesize
1.4MB

MD5
a98bb13828f662c599f2721ca4116480

SHA1
ea993a7ae76688d6d384a0d21605ef7fb70625ee

SHA256
6217e0d1334439f1ee9e1093777e9aa2e2b0925a3f8596d22a16f3f155262bf7

SHA512
5f1d8c2f52cc976287ab9d952a46f1772c6cf1f2df734e10bbe30ce312f5076ef558df84dce662a108a146a63f7c6b0b5dc7230f96fa7241947645207a6420f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd

Filesize
1.1MB

MD5
2ab7e66dff1893fea6f124971221a2a9

SHA1
3be5864bc4176c552282f9da5fbd70cc1593eb02

SHA256
a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f

SHA512
985480fffcc7e1a25c0070f44492744c3820334a35b9a72b9147898395ab60c7a73ea8bbc761de5cc3b6f8799d07a96c2880a7b56953249230b05dd59a1390ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\_bz2.pyd

Filesize
82KB

MD5
a8a37ba5e81d967433809bf14d34e81d

SHA1
e4d9265449950b5c5a665e8163f7dda2badd5c41

SHA256
50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b

SHA512
b50f4334acb54a6fba776fc77ca07de4940810da4378468b3ca6f35d69c45121ff17e1f9c236752686d2e269bd0b7bce31d16506d3896b9328671049857ed979

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\_ctypes.pyd

Filesize
120KB

MD5
496dcf8821ffc12f476878775999a8f3

SHA1
6b89b8fdd7cd610c08e28c3a14b34f751580cffd

SHA256
b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80

SHA512
07118f44b83d58f333bc4b853e9be66dffb3f7db8e65e0226975297bf5794ebdaa2c7a51ef84971faf4d4233a68a6b5e9ac02e737d16c0ac19a6cf65fad9443f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\_hashlib.pyd

Filesize
63KB

MD5
1c88b53c50b5f2bb687b554a2fc7685d

SHA1
bfe6fdb8377498bbefcaad1e6b8805473a4ccbf3

SHA256
19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778

SHA512
a312b11c85aaa325ab801c728397d5c7049b55fa00f24d30f32bf5cc0ad160678b40f354d9d5ec34384634950b5d6eda601e21934c929b4bc7f6ef50f16e3f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\_multiprocessing.pyd

Filesize
33KB

MD5
15291d70d00d36ba9b079a4af91efb1a

SHA1
85a17ae766811246cf4b2346b50ba008b3b6d8fe

SHA256
25cf4173fb40a3bb197c877742cb5ad13b6ef591b8195d5429a71dc7689f9ab5

SHA512
2e96253d9a8978a162e580c3e122ddd0500857582f442a8b39dd34c39004cd7f25f977e710ad160d750502d17cd915f83ae3350fff8fce5aa8984166b0470e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\_sqlite3.pyd

Filesize
117KB

MD5
562fecc2467778f1179d36af8554849f

SHA1
097c28814722c651f5af59967427f4beb64bf2d1

SHA256
88b541d570afa0542135cc33e891650346997d5c99ae170ef724fa46c87d545a

SHA512
e106ccdd100d0ce42e909d9a21b1ad3b12aee8350033f249ed4c69b195b00adaf441aa199d9885c9d16488db963c751746ce98786246d96568bade4c707d362a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\libcrypto-1_1.dll

Filesize
3.3MB

MD5
80b72c24c74d59ae32ba2b0ea5e7dad2

SHA1
75f892e361619e51578b312605201571bfb67ff8

SHA256
eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d

SHA512
08014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\libffi-8.dll

Filesize
37KB

MD5
d86a9d75380fab7640bb950aeb05e50e

SHA1
1c61aaf9022cd1f09a959f7b2a65fb1372d187d7

SHA256
68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b

SHA512
18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\libssl-1_1.dll

Filesize
686KB

MD5
86f2d9cc8cc54bbb005b15cabf715e5d

SHA1
396833cba6802cb83367f6313c6e3c67521c51ad

SHA256
d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771

SHA512
0013d487173b42e669a13752dc8a85b838c93524f976864d16ec0d9d7070d981d129577eda497d4fcf66fc6087366bd320cff92ead92ab79cfcaa946489ac6cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\pyexpat.pyd

Filesize
194KB

MD5
c5c1ca1b3641772e661f85ef0166fd6c

SHA1
759a34eca7efa25321a76788fb7df74cfac9ee59

SHA256
3d81d06311a8a15967533491783ea9c7fc88d594f40eee64076723cebdd58928

SHA512
4f0d2a6f15ebeeb4f9151827bd0c2120f3ca17e07fca4d7661beece70fdcf1a0e4c4ff5300251f2550451f98ea0fdbf45e8903225b7d0cb8da2851cdf62cb8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\select.pyd

Filesize
29KB

MD5
4ac28414a1d101e94198ae0ac3bd1eb8

SHA1
718fbf58ab92a2be2efdb84d26e4d37eb50ef825

SHA256
b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5

SHA512
2ac15e6a178c69115065be9d52c60f8ad63c2a8749af0b43634fc56c20220afb9d2e71ebed76305d7b0dcf86895ed5cdfb7d744c3be49122286b63b5ebce20c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2016_133580388644298681\test.exe

Filesize
8.4MB

MD5
2a0e99834e3b2b4f74b3d82c78135795

SHA1
e28b95418fa5253d840dfa1bb7d87b2bdfa80aab

SHA256
405612b6275472515d45cca504246f0b2d07eb651d1f197b52b72440c39dbe50

SHA512
e1722be11a5195c87458793b22fa6fbf787a8c4bf37b319a050b1ad6a30341612aaf4e84db81b1f904f5f30ce20fe4fbfd4333a6e8e94324e8444b172627b742

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5672_133580389202894473\_decimal.pyd

Filesize
247KB

MD5
5e8aa9cd4742a51acc5b2155770241d5

SHA1
af030327ea6702a081de422168d812263f581470

SHA256
59fee7a8d0a85ed98bbf5dfb7a0ad64b60cbe88427efd98b3c9faad3e4421a87

SHA512
e751621902897db7274b481386a811d2aabb63aa67759107c2f61bf29afc5437e7f5892158c83810dd5b5b498d160e308e6ed6453102d9bb58fc8f7dabf58697

Download Submit
memory/2036-140-0x00000201C49C0000-0x00000201C49C1000-memory.dmp

Filesize
4KB

Download
memory/4648-101-0x000002440A140000-0x000002440A141000-memory.dmp

Filesize
4KB

Download
memory/4864-68-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-73-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-72-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-71-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-70-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-69-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-67-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-63-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-61-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/4864-62-0x000001DF909C0000-0x000001DF909C1000-memory.dmp

Filesize
4KB

Download
memory/5880-269-0x000002B3B38E0000-0x000002B3B38E1000-memory.dmp

Filesize
4KB

Download