Analysis
-
max time kernel
300s -
max time network
297s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-05-2024 15:26
Behavioral task
behavioral1
Sample
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe
Resource
win7-20240508-en
Behavioral task
behavioral3
Sample
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe
Resource
win11-20240508-en
General
-
Target
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe
-
Size
9.0MB
-
MD5
8e575057308494a02213dd094240048f
-
SHA1
e14cb5b49926f48417fd3b3ce55282c20f0e2f41
-
SHA256
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4
-
SHA512
e50a74e824d4e1050893b4d19f63ce4298a0679d982d42b3a49e74fb6fa1664f29e26e24738263aca364a3bffa9659caa98149147a3bb1d2ca37f42a531db3ea
-
SSDEEP
196608:Y0jlDwGcsAgejtcGfcY3gtAXSdyowjcOSP9FtCNb:1k3meBcGfdrSNm47CNb
Malware Config
Extracted
njrat
0.7d
HacKed
icpanel.hackcrack.io:40544
Windows Explorer
-
reg_key
Windows Explorer
-
splitter
|'|'|
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3732 powershell.exe 4948 powershell.exe 4156 powershell.exe 2256 powershell.exe 1480 powershell.exe 2812 powershell.exe 4948 powershell.exe 4156 powershell.exe 2256 powershell.exe 1480 powershell.exe 2812 powershell.exe 3732 powershell.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2352 netsh.exe -
Executes dropped EXE 10 IoCs
Processes:
Setup.exeSetup.execheck .exesvchost.execheck .exesvchost.exeexplorer.exeexplorer.exeversion.exeexplorer.exepid process 2776 Setup.exe 2788 Setup.exe 1700 check .exe 3724 svchost.exe 1160 check .exe 3812 svchost.exe 4100 explorer.exe 3960 explorer.exe 5092 version.exe 1676 explorer.exe -
Loads dropped DLL 16 IoCs
Processes:
check .exepid process 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe 1160 check .exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Setup.exeSetup.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ." explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ." explorer.exe -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\check .exe pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3656 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exepid process 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe 4100 explorer.exe -
Suspicious use of AdjustPrivilegeToken 59 IoCs
Processes:
svchost.exesvchost.exeexplorer.exepowershell.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 3724 svchost.exe Token: SeDebugPrivilege 3812 svchost.exe Token: SeDebugPrivilege 4100 explorer.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeDebugPrivilege 3732 powershell.exe Token: SeDebugPrivilege 3656 taskkill.exe Token: SeDebugPrivilege 4156 powershell.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 2812 powershell.exe Token: SeDebugPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe Token: 33 1676 explorer.exe Token: SeIncBasePriorityPrivilege 1676 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
explorer.exepid process 4100 explorer.exe 4100 explorer.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exeSetup.execheck .exeSetup.exesvchost.exeexplorer.exesvchost.exeversion.execmd.execmd.execmd.execmd.execmd.execmd.exeexplorer.exeexplorer.exedescription pid process target process PID 3360 wrote to memory of 2776 3360 253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe Setup.exe PID 3360 wrote to memory of 2776 3360 253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe Setup.exe PID 3360 wrote to memory of 2788 3360 253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe Setup.exe PID 3360 wrote to memory of 2788 3360 253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe Setup.exe PID 3360 wrote to memory of 1700 3360 253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe check .exe PID 3360 wrote to memory of 1700 3360 253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe check .exe PID 2788 wrote to memory of 3724 2788 Setup.exe svchost.exe PID 2788 wrote to memory of 3724 2788 Setup.exe svchost.exe PID 1700 wrote to memory of 1160 1700 check .exe check .exe PID 1700 wrote to memory of 1160 1700 check .exe check .exe PID 2776 wrote to memory of 3812 2776 Setup.exe svchost.exe PID 2776 wrote to memory of 3812 2776 Setup.exe svchost.exe PID 3812 wrote to memory of 4100 3812 svchost.exe explorer.exe PID 3812 wrote to memory of 4100 3812 svchost.exe explorer.exe PID 4100 wrote to memory of 1484 4100 explorer.exe cmstp.exe PID 4100 wrote to memory of 1484 4100 explorer.exe cmstp.exe PID 3724 wrote to memory of 3960 3724 svchost.exe explorer.exe PID 3724 wrote to memory of 3960 3724 svchost.exe explorer.exe PID 5092 wrote to memory of 3728 5092 version.exe cmd.exe PID 5092 wrote to memory of 3728 5092 version.exe cmd.exe PID 5092 wrote to memory of 4964 5092 version.exe cmd.exe PID 5092 wrote to memory of 4964 5092 version.exe cmd.exe PID 5092 wrote to memory of 4728 5092 version.exe cmd.exe PID 5092 wrote to memory of 4728 5092 version.exe cmd.exe PID 5092 wrote to memory of 1288 5092 version.exe cmd.exe PID 5092 wrote to memory of 1288 5092 version.exe cmd.exe PID 5092 wrote to memory of 4700 5092 version.exe cmd.exe PID 5092 wrote to memory of 4700 5092 version.exe cmd.exe PID 5092 wrote to memory of 388 5092 version.exe cmd.exe PID 5092 wrote to memory of 388 5092 version.exe cmd.exe PID 3728 wrote to memory of 3732 3728 cmd.exe powershell.exe PID 3728 wrote to memory of 3732 3728 cmd.exe powershell.exe PID 4964 wrote to memory of 4948 4964 cmd.exe powershell.exe PID 4964 wrote to memory of 4948 4964 cmd.exe powershell.exe PID 4700 wrote to memory of 4156 4700 cmd.exe powershell.exe PID 4700 wrote to memory of 4156 4700 cmd.exe powershell.exe PID 1288 wrote to memory of 2256 1288 cmd.exe powershell.exe PID 1288 wrote to memory of 2256 1288 cmd.exe powershell.exe PID 388 wrote to memory of 1480 388 cmd.exe powershell.exe PID 388 wrote to memory of 1480 388 cmd.exe powershell.exe PID 4728 wrote to memory of 2812 4728 cmd.exe powershell.exe PID 4728 wrote to memory of 2812 4728 cmd.exe powershell.exe PID 3960 wrote to memory of 1676 3960 explorer.exe explorer.exe PID 3960 wrote to memory of 1676 3960 explorer.exe explorer.exe PID 1676 wrote to memory of 2352 1676 explorer.exe netsh.exe PID 1676 wrote to memory of 2352 1676 explorer.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe"C:\Users\Admin\AppData\Local\Temp\253dc3c343cc4d87556dfd992f69f345d0ad0fe932dce42a4231f0533c75a0a4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\tt0ku0ju.inf5⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE6⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\check .exe"C:\Users\Admin\AppData\Local\Temp\check .exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\check .exe"C:\Users\Admin\AppData\Local\Temp\check .exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.logFilesize
408B
MD5b086782ac488892b614985f9355a4979
SHA185f1537da0120829dcabae7c4d6334e614c738eb
SHA256196110ae45d16c909675bf3106c8794312b7b5520c2555842481dc0c9bd5a88d
SHA51215401e81b4aaca10b999b68858d05f1e410ea7417b5bbabb22e4f3a487e714bdedf430eec92a154444ea4f0844b70052a8e4dd0be80b9cc35d1fc189a41b55a2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\explorer.exe.logFilesize
676B
MD538cb0fee80ab2ca7847812a3b7c0a38e
SHA1f8377b86a0dd4f4a36ef2d8328cd0407bafdca4c
SHA25671fd0b006b21e9b88498e3f7f2a8b6c297dd37810b323b4d2d82f0f16866df80
SHA51248be591b05e4103491a477b23e586bbb3428b3d10cc9301f20704819bac0f3101ceb8b782ace49400bc0b8ed84d8a24f4cf22b49c4f49096ff2a021e09672950
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchost.exe.logFilesize
588B
MD574cb6d78314d7fdaaf7119fe006bcfd9
SHA1be787e0eb70c3a8732dffecae56f4002e5b16f75
SHA256a42326016fe054353c71343d7c48e072d30f7426503637175add202f5b20947b
SHA51231f4c81ccb1788f242f2fbd3889c532f929a64f94cdd54687814e2e9637951122afe7c451abf176adfa7328044ceac0758ddadf541a79f5b033400129851dd90
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56903d57eed54e89b68ebb957928d1b99
SHA1fade011fbf2e4bc044d41e380cf70bd6a9f73212
SHA25636cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52
SHA512c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52e8eb51096d6f6781456fef7df731d97
SHA1ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA25696bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA5120a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeFilesize
375KB
MD58e4f8329f0837d6a3801dd96973a05fe
SHA17309226e370a33000c08653504f2ac5786944b2b
SHA2560d8f6fc81065fc6f20ea5b9de9a85fbfffe2deb1f2055f1b304b5b0f3e99407d
SHA5129df93293a5fec2a2fca0838f43b24af8347f229884fab4338f7804ef0050b0aba02235ae2368ffef7dd42640420b42f69eaf974f5107bdab0bf0a8c9b39671cc
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\VCRUNTIME140.dllFilesize
106KB
MD549c96cecda5c6c660a107d378fdfc3d4
SHA100149b7a66723e3f0310f139489fe172f818ca8e
SHA25669320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_bz2.pydFilesize
82KB
MD54438affaaa0ca1df5b9b1cdaa0115ec1
SHA14eda79eaf3de614d5f744aa9eea5bfcf66e2d386
SHA256ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
SHA5126992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_ctypes.pydFilesize
120KB
MD56114277c6fc040f68d25ca90e25924cd
SHA1028179c77cb3ba29cd8494049421eaa4900ccd0e
SHA256f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
SHA51276e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_hashlib.pydFilesize
63KB
MD51524882af71247adecf5815a4e55366a
SHA1e25014c793c53503bdff9af046140edda329d01b
SHA2566f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
SHA5125b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_lzma.pydFilesize
155KB
MD5737119a80303ef4eccaa998d500e7640
SHA1328c67c6c4d297ac13da725bf24467d8b5e982e3
SHA2567158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
SHA5121c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_queue.pydFilesize
31KB
MD58bbed19359892f8c95c802c6ad7598e9
SHA1773fca164965241f63170e7a1f3a8fa17f73ea18
SHA2564e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
SHA51222ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_socket.pydFilesize
77KB
MD564a6c475f59e5c57b3f4dd935f429f09
SHA1ca2e0719dc32f22163ae0e7b53b2caadb0b9d023
SHA256d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
SHA512cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\_ssl.pydFilesize
172KB
MD5a0b40f1f8fc6656c5637eacacf7021f6
SHA138813e25ffde1eee0b8154fa34af635186a243c1
SHA25679d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
SHA512c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\base_library.zipFilesize
1.8MB
MD5d271ba9b8bffd25395083cccf6fc17b9
SHA1a2970f5991f41af61176e1f184287717ac7eb8b5
SHA2569226f0ca49d97923deb30845e664fe17e14b3e3b084ea9a4b5c63bb07fdfc8ee
SHA51286e8b13ed396a27c985d1c521af341db7e7dfb8e4c7ea70481680ddea1ddea9d1548c03d302b4f17cecab70bbc585837ceff4cd33105af1310bfaa249c878136
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\charset_normalizer\md.cp311-win_amd64.pydFilesize
10KB
MD5723ec2e1404ae1047c3ef860b9840c29
SHA18fc869b92863fb6d2758019dd01edbef2a9a100a
SHA256790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
SHA5122e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\charset_normalizer\md__mypyc.cp311-win_amd64.pydFilesize
116KB
MD59ea8098d31adb0f9d928759bdca39819
SHA1e309c85c1c8e6ce049eea1f39bee654b9f98d7c5
SHA2563d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
SHA51286af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\libcrypto-3.dllFilesize
4.9MB
MD57a6a8c2a8c379b111cdceb66b18d687d
SHA1f3b8a4c731fa0145f224112f91f046fddf642794
SHA2568e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
SHA512f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\libffi-8.dllFilesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\libssl-3.dllFilesize
771KB
MD564acb046fe68d64ee475e19f67253a3c
SHA1d9e66c9437ce6f775189d6fdbd171635193ec4cc
SHA256b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
SHA512f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\python311.dllFilesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\select.pydFilesize
29KB
MD5653bdccb7af2aa9ccf50cb050fd3be64
SHA1afe0a85425ae911694c250ab4cb1f6c3d3f2cc69
SHA256e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
SHA51207e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277
-
C:\Users\Admin\AppData\Local\Temp\_MEI17002\unicodedata.pydFilesize
1.1MB
MD51905b5d0f945499441e8cd58eb123d86
SHA1117e584e6fcc0e8cfc8e24e3af527999f14bac30
SHA256b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
SHA512ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_saqxmelt.54g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\check .exeFilesize
8.6MB
MD5d74eb99109dc495ab735264ba68edb06
SHA1a7b5b1471c2e8f46d3e3d5340435d8a148fd285d
SHA25626789e493fb9cc881d40e0eed7609fd390eb76196c91c4fc7be9ac7cbb11b41a
SHA512b715d226c70edfa5b413e7989a0f56ee4c5765b16f273f04bdfd6afb11fd1ba02638aa08d5f47e340eabab0397a3f300618cbcb2d49a921734b3bcfd09e0f643
-
C:\Users\Admin\AppData\Local\Temp\tt0ku0ju.infFilesize
619B
MD56f1420f2133f3e08fd8cdea0e1f5fe27
SHA13aa41ec75adc0cf50e001ca91bbfa7f763adf70b
SHA256aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242
SHA512d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
163KB
MD5c833287873afe73c333638e4d187c666
SHA14aa5686878ed71c4d27996449854e63107165b98
SHA256a9a387bafca70c8bce39473ee63df9fb439d15ba83b6b26e84f91fc920c1f39f
SHA512a949d0d6143405f3bb98589e67856a5971a8b23d35536b13ad3aae4b51c53de256315d8deaf609f49e8fe9ccf39e59e95b0cecef2619d5d08f3059a9254ae006
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.zipFilesize
177KB
MD58fb86ff3840ca7ef4656f0e3bc082824
SHA11a490e6b4fda8b2987f9ac4b29ee0c6bcbbd0ce2
SHA2561aaf14aa698f2057086ea4e7ff74a313bd6e2fbfe93d11179384682f2c384054
SHA512363b09b52578509195c48d503a37f03400fa9c4f1f378e7ec557a622d8ec470d27c494fd82efe448075b3ec5ad1e21d0b3ca56226dc44324910571ae8cf13800
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exeFilesize
252KB
MD5e5d01a5a8cc5c5ca9a5329459814c91a
SHA100ec50ab1cdab87816ec0f3e77fa8ad00ea9c067
SHA256612bbbf476228032ebab743100c98dae7f01a1dc854298cd8ece588351acb3c6
SHA5122d0d0d964e9100b0586043b16f91532e0f81347ef3697dee7ab0cd90469e6c118ac58e630d9a7fe0a84f5c275440813aeede0e0c44cacf316f59cb760081ab07
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zipFilesize
124KB
MD5287c4ef4138442be3996d52619f9e7d3
SHA12a64f031df9e950aec105ac2eaf6cf0932bda940
SHA256686f17451faf52211e0b477c8b4dee8666eebc7332e5b429fa7f478aeece5b00
SHA512a980b88c60bc4f5d8a6a233a24faf20aa4de697475492945208ddbe628f55a6f4a88ca945f6d1fdf147bd62e02cb103537b56083413e82763f74fcb9696cb6d3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exeFilesize
11KB
MD510d90137afcca51c429a2c0aa78c92d6
SHA1c7cb2762e0a31b06aaca0c440db5556fd23df24f
SHA25644a4f73cc6a5a89208372ded41ed5e3cecc8bf2064ee1224275f21061dae11a1
SHA512c914381e197450f3e576d3c77f103796be594444499ff2397e0bb74f9249baff973ea5c66ab42540835e060ad6032694fc2b8d01c95795d71adf6f1c91d000b0
-
memory/2776-34-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/2776-25-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/2776-29-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/2776-87-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/2788-36-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/2788-67-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/3360-0-0x00007FFFFDA55000-0x00007FFFFDA56000-memory.dmpFilesize
4KB
-
memory/3360-35-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/3360-2-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/3360-1-0x000000001BF20000-0x000000001BFC6000-memory.dmpFilesize
664KB
-
memory/3360-3-0x000000001C850000-0x000000001CD1E000-memory.dmpFilesize
4.8MB
-
memory/3360-4-0x000000001C0C0000-0x000000001C15C000-memory.dmpFilesize
624KB
-
memory/3360-5-0x00007FFFFD7A0000-0x00007FFFFE141000-memory.dmpFilesize
9.6MB
-
memory/3960-127-0x000000001B7F0000-0x000000001B7FC000-memory.dmpFilesize
48KB
-
memory/4100-126-0x0000000000D70000-0x0000000000D78000-memory.dmpFilesize
32KB
-
memory/4948-136-0x00000181F8D90000-0x00000181F8DB2000-memory.dmpFilesize
136KB