Analysis

  • max time kernel
    134s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-05-2024 16:16

General

  • Target

    Expensive 3.1.exe

  • Size

    73KB

  • MD5

    6fb5db1fb4f6db383d3ec9635bafcc8f

  • SHA1

    a2cc6012448bacc9d0cb0f5c5cfc88c2ced1c29e

  • SHA256

    1c4c132a522839dcd922c7495f381c08c9a142fac9ba23da02b017599c0d2f56

  • SHA512

    c0c87534b5f0e26631ea169c5540d5893d52b0dce1d0482cfc7916014af9e3d3101840d1e9e5e2b9b8ee2717e2f1976b3b7d2f7832e3e17197e8372292b32604

  • SSDEEP

    1536:cZwa23E9lZVp7PmzogbZMuUW+b1pHjFGlqiyJ6SDOKJxENaM:cR2AlZrWog2uUW+b1pjBfOKJCR

Malware Config

Extracted

Family

xworm

C2

loss-winners.gl.at.ply.gg:61007

Attributes
  • Install_directory

    %AppData%

  • install_file

    Expensive 3.1.exe

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • UPX packed file 48 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Expensive 3.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Expensive 3.1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Expensive 3.1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Expensive 3.1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4568
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Expensive 3.1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Expensive 3.1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4040
    • C:\Users\Admin\AppData\Local\Temp\myyahn.exe
      "C:\Users\Admin\AppData\Local\Temp\myyahn.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Users\Admin\AppData\Local\Temp\myyahn.exe
        "C:\Users\Admin\AppData\Local\Temp\myyahn.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\myyahn.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\myyahn.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4636
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1224
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4992
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            5⤵
            • Deletes Windows Defender Definitions
            PID:2088
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            PID:5088
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2236
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            5⤵
              PID:1860
      • C:\Users\Admin\AppData\Local\Temp\xqlfau.exe
        "C:\Users\Admin\AppData\Local\Temp\xqlfau.exe"
        2⤵
        • Executes dropped EXE
        PID:2676
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x3fc
      1⤵
        PID:1436
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2164

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        3KB

        MD5

        ad5cd538ca58cb28ede39c108acb5785

        SHA1

        1ae910026f3dbe90ed025e9e96ead2b5399be877

        SHA256

        c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

        SHA512

        c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        1e0901c0472ec69554a28fdf604e33cc

        SHA1

        a9c81e2a5fdcfb12be45bce6a9b72dcb1de690c0

        SHA256

        8ce77efe5f595784baf15e08aa1e8078f0d6ed2e58c78475beca9492568fb579

        SHA512

        7c0c92e7a44d8fd37ac21df9ca84266dc9ef95de68ed397f1a6fee3889037d4845fea842efed993ad4d63bd2875bbe19bba3e8e10dbc860c3c77715f7287eb2f

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        ec75a995dd901cc5c28bca26d22d0c33

        SHA1

        1038a8207b4933ac584c2a50d4ffa59ba495057d

        SHA256

        75ea542965fd4540cd49a1cb6caff8523eec7a240d809a395176d12d1e5cf424

        SHA512

        a1512d5910d6b126dc65df4152f00d4d47ba77b53d3369ee4c04ec114b3c634e9c02fbd9f4eb43d896ee8c991db1db2ffa5c5c89e203ca03224006bc3a70427a

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        f43df61e8eaa99a5c50f3f5023982f43

        SHA1

        eb5ec6cb29446786355db4a713fc0599788d235f

        SHA256

        70f8d30ddb38c8ca126407e0b1b4bba59f9a90b8360b4e6e929269648316c81b

        SHA512

        76b577d25e56287dcd9464d66a10c952fb24cd3e61f68195ff6243d1340221afca7eb65aef87f4b085b121d6335139a711dd785736738729b8f6d5b3991e60e2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        3990c0164309f8c3e24d9ab1bf09b2e0

        SHA1

        ca8783e4aac4291376e7255d2ff510e490b29fd5

        SHA256

        731a59d67aa1d11f36123b07b41b615ece95a6ebb4e321f62e3f61f38b952c98

        SHA512

        02d0e16aadb3afee166f3d12e3b054b9be6fe4a5223e57e92d9ab4e0e0e6ae1afd6ab44a7ca251e2e99a4625a6beff63dad5fd61614fb49e41f5e434076f0a00

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        10894d371837a5f557e28e94449d95d5

        SHA1

        2abbf407186d3f82f087db5475a094a99fd81c33

        SHA256

        9c6a13e9c7ea3b8902763f283aa1e9047385c29d855ad7f28dcc3cbcb9f1cad5

        SHA512

        1760132574e8ba9f8d500e5b3cdeb3f95d073889f4fdab2e5c49607d53e0ffb4d882ee1087a4cf42034eae43ca30052f6fa4a00892cef02401ec7046e37e6798

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\VCRUNTIME140.dll

        Filesize

        96KB

        MD5

        f12681a472b9dd04a812e16096514974

        SHA1

        6fd102eb3e0b0e6eef08118d71f28702d1a9067c

        SHA256

        d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

        SHA512

        7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_bz2.pyd

        Filesize

        46KB

        MD5

        0c13627f114f346604b0e8cbc03baf29

        SHA1

        bf77611d924df2c80aabcc3f70520d78408587a2

        SHA256

        df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

        SHA512

        c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_ctypes.pyd

        Filesize

        57KB

        MD5

        38fb83bd4febed211bd25e19e1cae555

        SHA1

        4541df6b69d0d52687edb12a878ae2cd44f82db6

        SHA256

        cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

        SHA512

        f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_decimal.pyd

        Filesize

        104KB

        MD5

        7ba541defe3739a888be466c999c9787

        SHA1

        ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

        SHA256

        f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

        SHA512

        9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_hashlib.pyd

        Filesize

        33KB

        MD5

        596df8ada4b8bc4ae2c2e5bbb41a6c2e

        SHA1

        e814c2e2e874961a18d420c49d34b03c2b87d068

        SHA256

        54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

        SHA512

        e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_lzma.pyd

        Filesize

        84KB

        MD5

        8d9e1bb65a192c8446155a723c23d4c5

        SHA1

        ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

        SHA256

        1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

        SHA512

        4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_queue.pyd

        Filesize

        24KB

        MD5

        fbbbfbcdcf0a7c1611e27f4b3b71079e

        SHA1

        56888df9701f9faa86c03168adcd269192887b7b

        SHA256

        699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

        SHA512

        0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_socket.pyd

        Filesize

        41KB

        MD5

        4351d7086e5221398b5b78906f4e84ac

        SHA1

        ba515a14ec1b076a6a3eab900df57f4f37be104d

        SHA256

        a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

        SHA512

        a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_sqlite3.pyd

        Filesize

        54KB

        MD5

        d678600c8af1eeeaa5d8c1d668190608

        SHA1

        080404040afc8b6e5206729dd2b9ee7cf2cb70bc

        SHA256

        d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

        SHA512

        8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\_ssl.pyd

        Filesize

        60KB

        MD5

        156b1fa2f11c73ed25f63ee20e6e4b26

        SHA1

        36189a5cde36d31664acbd530575a793fc311384

        SHA256

        a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

        SHA512

        a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\base_library.zip

        Filesize

        1.4MB

        MD5

        83d235e1f5b0ee5b0282b5ab7244f6c4

        SHA1

        629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

        SHA256

        db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

        SHA512

        77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\blank.aes

        Filesize

        126KB

        MD5

        d6c8fca79229c68ffec0d2ca66666a2f

        SHA1

        e9450f87ebbc97f7456bc21035130b9372855770

        SHA256

        4c922710794b6c2fbed7c4e3b6c4ed5679f2b81c16380ec8d9208ce5fec84e08

        SHA512

        75a5239b3f3b5783ffafb37189625622bcf5478dde146063d97c2d585384e0ad91330958ffefd4b638294d1f61a875224c5d413d2e03c6284db5d5eb80203072

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\blank.aes

        Filesize

        126KB

        MD5

        b268af7fdcf3e613d2689718d6311cb0

        SHA1

        7e76f3509074564351d9d05efaeb07e82b2ffd30

        SHA256

        6776b306646cbacfb0d782c68faa82732e467e385c7bf72f22be5127c133ec95

        SHA512

        9294f7b8d6d2eac89a0d9d746df7a78b78403f51001670d32a4e67742f57ec540596f61ee37ab18adfb94d911328d898ba731c67f9dbcbf67d0d7b6dda2a2558

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\libcrypto-1_1.dll

        Filesize

        1.1MB

        MD5

        daa2eed9dceafaef826557ff8a754204

        SHA1

        27d668af7015843104aa5c20ec6bbd30f673e901

        SHA256

        4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

        SHA512

        7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\libffi-8.dll

        Filesize

        24KB

        MD5

        90a6b0264a81bb8436419517c9c232fa

        SHA1

        17b1047158287eb6471416c5df262b50d6fe1aed

        SHA256

        5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

        SHA512

        1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\libssl-1_1.dll

        Filesize

        203KB

        MD5

        eac369b3fde5c6e8955bd0b8e31d0830

        SHA1

        4bf77158c18fe3a290e44abd2ac1834675de66b4

        SHA256

        60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

        SHA512

        c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\python311.dll

        Filesize

        1.6MB

        MD5

        bb46b85029b543b70276ad8e4c238799

        SHA1

        123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

        SHA256

        72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

        SHA512

        5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\rar.exe

        Filesize

        615KB

        MD5

        9c223575ae5b9544bc3d69ac6364f75e

        SHA1

        8a1cb5ee02c742e937febc57609ac312247ba386

        SHA256

        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

        SHA512

        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\rarreg.key

        Filesize

        456B

        MD5

        4531984cad7dacf24c086830068c4abe

        SHA1

        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

        SHA256

        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

        SHA512

        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\select.pyd

        Filesize

        24KB

        MD5

        abf7864db4445bbbd491c8cff0410ae0

        SHA1

        4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

        SHA256

        ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

        SHA512

        8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\sqlite3.dll

        Filesize

        608KB

        MD5

        ddd0dd698865a11b0c5077f6dd44a9d7

        SHA1

        46cd75111d2654910f776052cc30b5e1fceb5aee

        SHA256

        a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

        SHA512

        b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

      • C:\Users\Admin\AppData\Local\Temp\_MEI10682\unicodedata.pyd

        Filesize

        293KB

        MD5

        bb3fca6f17c9510b6fb42101fe802e3c

        SHA1

        cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

        SHA256

        5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

        SHA512

        05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4phlxvty.w54.ps1

        Filesize

        1B

        MD5

        c4ca4238a0b923820dcc509a6f75849b

        SHA1

        356a192b7913b04c54574d18c28d46e6395428ab

        SHA256

        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

        SHA512

        4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      • C:\Users\Admin\AppData\Local\Temp\myyahn.exe

        Filesize

        6.9MB

        MD5

        bf18bb02b51874987a314cbee503f426

        SHA1

        0ff7983c47cc5e2ab803c9a357ddd1d234a3e278

        SHA256

        1306369409e20dca88c39130d79e38dd889df6c06591102be5d251fd4071ca64

        SHA512

        c53eebaa430338f251a8c4833875257978bf247425c38789b87fd722376a3b1136985245f5ec7102d83b453c6de0586f9666c7c1bbc6a8e67aac1ae94374e2a9

      • C:\Users\Admin\AppData\Local\Temp\xqlfau.exe

        Filesize

        4.1MB

        MD5

        e7c0320cb474f7f0f34ad25c3e343226

        SHA1

        d9780cfbb2bd28f0596cff1dcc9ff10a303e78c1

        SHA256

        3d733b07ec2bbf0c7c5c967d7cb5a6a1ec9a2da1b07d2f9afd95938c661ab0e6

        SHA512

        5552332982d55fe9427b79b749555a8f8463f35a1706c92da16b2f277d07f17df35e4279463e15a5714502770b04086e6e4383f996917ed7ee2fe46eefae11a0

      • memory/1628-185-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/1628-184-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/1628-1-0x00007FFF50293000-0x00007FFF50294000-memory.dmp

        Filesize

        4KB

      • memory/1628-0-0x0000000000960000-0x0000000000978000-memory.dmp

        Filesize

        96KB

      • memory/2676-403-0x0000000000DC0000-0x00000000011D4000-memory.dmp

        Filesize

        4.1MB

      • memory/4224-267-0x00007FFF4B1C0000-0x00007FFF4B535000-memory.dmp

        Filesize

        3.5MB

      • memory/4224-326-0x00007FFF4B6C0000-0x00007FFF4BCA8000-memory.dmp

        Filesize

        5.9MB

      • memory/4224-244-0x00007FFF60460000-0x00007FFF6046F000-memory.dmp

        Filesize

        60KB

      • memory/4224-243-0x00007FFF5FAF0000-0x00007FFF5FB14000-memory.dmp

        Filesize

        144KB

      • memory/4224-328-0x00007FFF60460000-0x00007FFF6046F000-memory.dmp

        Filesize

        60KB

      • memory/4224-329-0x00007FFF5FAC0000-0x00007FFF5FAED000-memory.dmp

        Filesize

        180KB

      • memory/4224-250-0x00007FFF5FAC0000-0x00007FFF5FAED000-memory.dmp

        Filesize

        180KB

      • memory/4224-254-0x00007FFF5FA90000-0x00007FFF5FAB3000-memory.dmp

        Filesize

        140KB

      • memory/4224-253-0x00007FFF63900000-0x00007FFF63919000-memory.dmp

        Filesize

        100KB

      • memory/4224-256-0x00007FFF4B540000-0x00007FFF4B6B3000-memory.dmp

        Filesize

        1.4MB

      • memory/4224-258-0x00007FFF5FA70000-0x00007FFF5FA89000-memory.dmp

        Filesize

        100KB

      • memory/4224-260-0x00007FFF651F0000-0x00007FFF651FD000-memory.dmp

        Filesize

        52KB

      • memory/4224-262-0x00007FFF5FA40000-0x00007FFF5FA6E000-memory.dmp

        Filesize

        184KB

      • memory/4224-268-0x000001E6FD1A0000-0x000001E6FD515000-memory.dmp

        Filesize

        3.5MB

      • memory/4224-221-0x00007FFF4B6C0000-0x00007FFF4BCA8000-memory.dmp

        Filesize

        5.9MB

      • memory/4224-266-0x00007FFF5F620000-0x00007FFF5F6D8000-memory.dmp

        Filesize

        736KB

      • memory/4224-270-0x00007FFF5F600000-0x00007FFF5F614000-memory.dmp

        Filesize

        80KB

      • memory/4224-273-0x00007FFF5F5F0000-0x00007FFF5F5FD000-memory.dmp

        Filesize

        52KB

      • memory/4224-272-0x00007FFF4B6C0000-0x00007FFF4BCA8000-memory.dmp

        Filesize

        5.9MB

      • memory/4224-276-0x00007FFF4B0A0000-0x00007FFF4B1BC000-memory.dmp

        Filesize

        1.1MB

      • memory/4224-275-0x00007FFF5FAF0000-0x00007FFF5FB14000-memory.dmp

        Filesize

        144KB

      • memory/4224-330-0x00007FFF63900000-0x00007FFF63919000-memory.dmp

        Filesize

        100KB

      • memory/4224-334-0x00007FFF651F0000-0x00007FFF651FD000-memory.dmp

        Filesize

        52KB

      • memory/4224-340-0x00007FFF4B0A0000-0x00007FFF4B1BC000-memory.dmp

        Filesize

        1.1MB

      • memory/4224-339-0x00007FFF5F5F0000-0x00007FFF5F5FD000-memory.dmp

        Filesize

        52KB

      • memory/4224-333-0x00007FFF5FA70000-0x00007FFF5FA89000-memory.dmp

        Filesize

        100KB

      • memory/4224-338-0x00007FFF5F600000-0x00007FFF5F614000-memory.dmp

        Filesize

        80KB

      • memory/4224-336-0x00007FFF5F620000-0x00007FFF5F6D8000-memory.dmp

        Filesize

        736KB

      • memory/4224-335-0x00007FFF5FA40000-0x00007FFF5FA6E000-memory.dmp

        Filesize

        184KB

      • memory/4224-332-0x00007FFF4B540000-0x00007FFF4B6B3000-memory.dmp

        Filesize

        1.4MB

      • memory/4224-331-0x00007FFF5FA90000-0x00007FFF5FAB3000-memory.dmp

        Filesize

        140KB

      • memory/4224-337-0x00007FFF4B1C0000-0x00007FFF4B535000-memory.dmp

        Filesize

        3.5MB

      • memory/4224-327-0x00007FFF5FAF0000-0x00007FFF5FB14000-memory.dmp

        Filesize

        144KB

      • memory/4660-41-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/4660-6-0x000001A4B5CF0000-0x000001A4B5D12000-memory.dmp

        Filesize

        136KB

      • memory/4660-9-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/4660-10-0x000001A4B5FD0000-0x000001A4B6046000-memory.dmp

        Filesize

        472KB

      • memory/4660-11-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/4660-52-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/4660-12-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB

      • memory/4660-48-0x00007FFF50290000-0x00007FFF50C7C000-memory.dmp

        Filesize

        9.9MB