Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    1s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 01:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    source_prepared.exe
  • Size 24.5MB
  • Sample240606-bjdvhaec42
  • SHA256 3a58d1a27234d0414d85ed5b1eadff6f26d071cba9501d4e660f9f4408b6dbb9
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
evasionexecutionupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
      PID:1792
      • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
        "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
        2⤵
          PID:3428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\jeste\""
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2616
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\jeste\activate.bat
            3⤵
              PID:412
              • C:\Windows\system32\attrib.exe
                attrib +s +h .
                4⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:3084
              • C:\Users\Admin\jeste\jesteosam.exe
                "jesteosam.exe"
                4⤵
                  PID:5084
                  • C:\Users\Admin\jeste\jesteosam.exe
                    "jesteosam.exe"
                    5⤵
                      PID:3024
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\jeste\""
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:2724
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im "source_prepared.exe"
                    4⤵
                    • Kills process with taskkill
                    PID:5944

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\VCRUNTIME140.dll
                  • Size 116KB
                  • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\_bz2.pyd
                  • Size 48KB
                  • SHA256 8c0571c2d937f8161626bb05acf6db121db399474be107467122b27b350310d8
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\_ctypes.pyd
                  • Size 59KB
                  • SHA256 5dc7f9409c83d146586d27c150534db326c52abfb499d6ba09d03f98259fa0a5
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\_lzma.pyd
                  • Size 86KB
                  • SHA256 dacc3b750b2c9d961064e3c7c35e46399405d8a2a544a6d243eb79a2b73338f4
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-console-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-console-l1-1-0.dll
                  • Size 22KB
                  • SHA256 0f03daf30daac7e3547ae9017fc8a1bbb1a9c3dd97e8e6b1315d69b4e7fc7409
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-datetime-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-datetime-l1-1-0.dll
                  • Size 22KB
                  • SHA256 e19241e058d2986759ddd4163e56dd75bb440fbdeca3b65e0318d010e34a9067
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-debug-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-debug-l1-1-0.dll
                  • Size 22KB
                  • SHA256 c86071a3f70b36aae955d70c16a38c557ef6b694bf9c54205b8cc503057de84a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-errorhandling-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-errorhandling-l1-1-0.dll
                  • Size 22KB
                  • SHA256 e5276f9127938300d412cbb4f96101bad34326f9e5498c19399c042840159b71
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-fibers-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-fibers-l1-1-0.dll
                  • Size 22KB
                  • SHA256 88d67179923a161a8cd3d6552fdf036343841bf8b51e63a7a116a460244531e7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-file-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-file-l1-1-0.dll
                  • Size 26KB
                  • SHA256 fd15984e6068d3127a337907ff88357dd4d807d49b682b2060d22ae3aa874140
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-file-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-file-l1-2-0.dll
                  • Size 22KB
                  • SHA256 01b61d57ba1290bf2640ecee28de3d240eeb09e9c664c0f4d0f9402cd1da5eaf
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-file-l2-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-file-l2-1-0.dll
                  • Size 22KB
                  • SHA256 4413208101061038455b7e0752fb37d4108b3ec4642d10cbaddf835b3843888e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-handle-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-handle-l1-1-0.dll
                  • Size 22KB
                  • SHA256 2a20ed31a3e9d57c21c0f9d48d230443c8b9297e934cf3257b5f9bfc75cc0a0c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-heap-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-heap-l1-1-0.dll
                  • Size 22KB
                  • SHA256 b6798c4723bdbf2455c19e8c15f76e7222a329ebc2c7a2fa014f2a581e9f5c35
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-interlocked-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-interlocked-l1-1-0.dll
                  • Size 22KB
                  • SHA256 b24434f58bec151dbbfddac528dbe6e65ec3cc38cd5631b3392031acd1f82df8
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-libraryloader-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-libraryloader-l1-1-0.dll
                  • Size 22KB
                  • SHA256 6873c614ae5c9ae92f526c3558f4204aa8abf603a7caa59ab45677035c26b2cc
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-localization-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-localization-l1-2-0.dll
                  • Size 22KB
                  • SHA256 197b29ba3989e8d974e29f81fbddd0731051399dc40763bda998a1e36d1c3ab4
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-memory-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-memory-l1-1-0.dll
                  • Size 22KB
                  • SHA256 9c8680caf042b7dfc1d5ed46617cb7fb005b86d97d968d7663e04902867098ea
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-namedpipe-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-namedpipe-l1-1-0.dll
                  • Size 22KB
                  • SHA256 572781609f3e787dc36b634b6d9c938652881e4a99b5138ebb3540cb2e41cbb9
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-processenvironment-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-processenvironment-l1-1-0.dll
                  • Size 22KB
                  • SHA256 9b92da261ec648267aabdb5c70fb2ff04ea579e732757c8d2c81ae7e7ed303eb
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-processthreads-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-processthreads-l1-1-0.dll
                  • Size 22KB
                  • SHA256 ffd0bebb1ff0f83eb81406be8ae753d199461cc4804df756904dbc30582cac6a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-processthreads-l1-1-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-processthreads-l1-1-1.dll
                  • Size 22KB
                  • SHA256 408081a4655ee846c1067aaafe462a62fa3a562341e681d0dbbf3400362f5cf7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-profile-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-profile-l1-1-0.dll
                  • Size 22KB
                  • SHA256 409b4abb42be87243ffa92e857c82b8726f658ac7f66655a9feec998307790b0
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-rtlsupport-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-rtlsupport-l1-1-0.dll
                  • Size 22KB
                  • SHA256 29b37632c942d5794803cf20f92412843045ab49fc480b61f441b4f3df7f2b10
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-string-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-string-l1-1-0.dll
                  • Size 22KB
                  • SHA256 9b7433c6ae09a0ec60361064cf970d7df92e598bf2a342ffedd42b931f26f457
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-synch-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-synch-l1-1-0.dll
                  • Size 22KB
                  • SHA256 c8e39897c5520e777d8db974dd2f40b4ae390aed351f34b90023bec768a44d10
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-synch-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-synch-l1-2-0.dll
                  • Size 22KB
                  • SHA256 b4eb43a8486aab2e9393c9b026d5624c8348a8178985574fe50dadc16d130776
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-sysinfo-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-sysinfo-l1-1-0.dll
                  • Size 22KB
                  • SHA256 968cc240fccfc3ea067e7c9b89c002ecee9844573c06923b490bbdb644dac098
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-timezone-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-timezone-l1-1-0.dll
                  • Size 22KB
                  • SHA256 04f932559f3e5eec0d929d60ab501fc0f6037e97b241e2b3ddd3ad16fedaa23c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-core-util-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-util-l1-1-0.dll
                  • Size 22KB
                  • SHA256 20f67e47fbcb86fed54052bcff354b6049fc4af4f33f6e0dee254a8dc75f7106
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-conio-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-conio-l1-1-0.dll
                  • Size 22KB
                  • SHA256 019c530ae81be718735a3462dd7546e2601e395da27bbd680e51cc65ea273ca0
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-convert-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-convert-l1-1-0.dll
                  • Size 26KB
                  • SHA256 b9e79b0a43738078c13034a62e4472da8a5b2e44894f29fe3464702ecda3c8d4
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-environment-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-environment-l1-1-0.dll
                  • Size 22KB
                  • SHA256 29db38f7a980f74934d17f7ba9dd8df503678c5787dc1a94c0ef057dedfc2cef
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-filesystem-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-filesystem-l1-1-0.dll
                  • Size 22KB
                  • SHA256 fc59e7a7cbc98aa47655df33728919a4c14faf593368ad21e5e1fb0f09cb6cce
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-heap-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-heap-l1-1-0.dll
                  • Size 22KB
                  • SHA256 d3c96f9dfe7a3b1f22b6a6ab11779e8a42e77d986b331caefa1435fdbaa2c358
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-locale-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-locale-l1-1-0.dll
                  • Size 22KB
                  • SHA256 4cb91250129f9e90e89f0eb429387ba4896789b18be4a47bfbe94eae64976d74
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-math-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-math-l1-1-0.dll
                  • Size 30KB
                  • SHA256 0160bbf3762f1116dfc039162cd94b82fcf61bcdaac9e8161fbe763e68ebf489
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-process-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-process-l1-1-0.dll
                  • Size 22KB
                  • SHA256 859a0f16a6b01af35f4eccaa4ce383c98dfdfc9d9903ec2f35ba5cde44983924
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-runtime-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-runtime-l1-1-0.dll
                  • Size 26KB
                  • SHA256 43dab57bbe95b15272261849e3285b2359394de2a4c2a5b0b44834d35125764a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-stdio-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-stdio-l1-1-0.dll
                  • Size 26KB
                  • SHA256 0fab6f7dd517d084a05cf39d63c21b047148a82a5c884a62a04faff8af3e8dcc
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-string-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-string-l1-1-0.dll
                  • Size 26KB
                  • SHA256 047ef4e4a2a8991cfe3c443f068f8184d2a0a18dfd0545300cf46b93e8886113
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-time-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-time-l1-1-0.dll
                  • Size 22KB
                  • SHA256 27961196048277ad6836dfd80307ce1334bc921d661c35576bc86858dc24cdf4
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  api-ms-win-crt-utility-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\api-ms-win-crt-utility-l1-1-0.dll
                  • Size 22KB
                  • SHA256 38b77cd742da9542b3527d71c35a8e44991a17f6222c85a2e9efca9e5e477787
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\base_library.zip
                  • Size 1.3MB
                  • SHA256 eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\libcrypto-3.dll
                  • Size 1.6MB
                  • SHA256 3423134795ab8fce58190ae156d4b5d70053bebe6c9a228bea3281855e5357fa
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\libffi-8.dll
                  • Size 29KB
                  • SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libopus-0.x64.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\libopus-0.x64.dll
                  • Size 217KB
                  • SHA256 fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\libssl-3.dll
                  • Size 223KB
                  • SHA256 6844483a33468eb919e9a3ef3561c80dd9c4cd3a11ad0961c9c4f2025b0a8dff
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  pyexpat.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\pyexpat.pyd
                  • Size 87KB
                  • SHA256 a7a095d822ddc5d26c18b3afba8df7a158ed57a7389c0c67ccaceb5b2047fa8e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  python3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\python3.dll
                  • Size 66KB
                  • SHA256 a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  python312.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\python312.dll
                  • Size 1.8MB
                  • SHA256 b93e682bddb5c3e2af1f0264e83fbc40481fe6abd90c3ab26e94f246c8ce8d7d
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\select.pyd
                  • Size 25KB
                  • SHA256 4f36ba1427114fc9f13f632baedea4984e8267c912525722a7ade73ef450e582
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  sqlite3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\sqlite3.dll
                  • Size 630KB
                  • SHA256 2bcdef677d17f776e622e802b2a020cf5d2597f1e7a4a2dd2ab1fcd266e5c263
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  tcl86t.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\tcl86t.dll
                  • Size 651KB
                  • SHA256 d6f817f67275cd587b1ad39055f4ead3812dc96c14010d834740388c98691d4e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  ucrtbase.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17922\ucrtbase.dll
                  • Size 1.1MB
                  • SHA256 5d652e1ba943587035b573e0dbcdc8a2f114030ac5cae4894805cc228dda3d22
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  __PSScriptPolicyTest_4pgkmd5y.jf2.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4pgkmd5y.jf2.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512
                  Submit Download

                  executed_at_2024-06-06_01-16-56.log
                  • Path C:\Users\Admin\AppData\Local\Temp\logs\executed_at_2024-06-06_01-16-56.log
                  • Size 1KB
                  • SHA256 42aaabb0e6ed2489973602ea44ed8b47af26b82cbbf2e7a11dc3a49a80eaea6e
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/2616-1278-0x00007FFE583C3000-0x00007FFE583C5000-memory.dmp
                  Download

                  memory/2616-1279-0x00000143DA040000-0x00000143DA062000-memory.dmp
                  Download

                  memory/3024-3639-0x00007FFE6AE00000-0x00007FFE6AE0B000-memory.dmp
                  Download

                  memory/3024-3649-0x00007FFE64630000-0x00007FFE6463C000-memory.dmp
                  Download

                  memory/3024-3644-0x00007FFE6AD90000-0x00007FFE6AD9B000-memory.dmp
                  Download

                  memory/3024-3645-0x00007FFE6AB80000-0x00007FFE6AB8C000-memory.dmp
                  Download

                  memory/3024-3646-0x00007FFE6AB30000-0x00007FFE6AB3B000-memory.dmp
                  Download

                  memory/3024-3647-0x00007FFE6A920000-0x00007FFE6A92C000-memory.dmp
                  Download

                  memory/3024-3648-0x00007FFE6A910000-0x00007FFE6A91B000-memory.dmp
                  Download

                  memory/3024-3643-0x00007FFE6ADE0000-0x00007FFE6ADEB000-memory.dmp
                  Download

                  memory/3024-3650-0x00007FFE62650000-0x00007FFE6265C000-memory.dmp
                  Download

                  memory/3024-3642-0x00007FFE6ADF0000-0x00007FFE6ADFD000-memory.dmp
                  Download

                  memory/3024-3640-0x00007FFE6A590000-0x00007FFE6A5B7000-memory.dmp
                  Download

                  memory/3024-3638-0x00007FFE6B5D0000-0x00007FFE6B5DD000-memory.dmp
                  Download

                  memory/3024-3637-0x00007FFE5C330000-0x00007FFE5C3FD000-memory.dmp
                  Download

                  memory/3024-3636-0x00007FFE680E0000-0x00007FFE68113000-memory.dmp
                  Download

                  memory/3024-3632-0x00007FFE59E90000-0x00007FFE5A3B2000-memory.dmp
                  Download

                  memory/3024-3626-0x00007FFE5B6C0000-0x00007FFE5BD98000-memory.dmp
                  Download

                  memory/3428-1189-0x00007FFE6BA10000-0x00007FFE6BA29000-memory.dmp
                  Download

                  memory/3428-1137-0x00007FFE6B5E0000-0x00007FFE6B605000-memory.dmp
                  Download

                  memory/3428-1251-0x00007FFE5A610000-0x00007FFE5A61B000-memory.dmp
                  Download

                  memory/3428-1250-0x00007FFE5A620000-0x00007FFE5A62C000-memory.dmp
                  Download

                  memory/3428-1249-0x00007FFE5A630000-0x00007FFE5A63E000-memory.dmp
                  Download

                  memory/3428-1248-0x00007FFE5A640000-0x00007FFE5A64C000-memory.dmp
                  Download

                  memory/3428-1247-0x00007FFE5A650000-0x00007FFE5A65C000-memory.dmp
                  Download

                  memory/3428-1246-0x00007FFE5A660000-0x00007FFE5A66B000-memory.dmp
                  Download

                  memory/3428-1245-0x00007FFE5A670000-0x00007FFE5A67C000-memory.dmp
                  Download

                  memory/3428-1244-0x00007FFE5A680000-0x00007FFE5A68B000-memory.dmp
                  Download

                  memory/3428-1243-0x00007FFE5A690000-0x00007FFE5A69C000-memory.dmp
                  Download

                  memory/3428-1242-0x00007FFE5A6A0000-0x00007FFE5A6AB000-memory.dmp
                  Download

                  memory/3428-1241-0x00007FFE5A6B0000-0x00007FFE5A6BB000-memory.dmp
                  Download

                  memory/3428-1240-0x00007FFE61F50000-0x00007FFE61F72000-memory.dmp
                  Download

                  memory/3428-1208-0x00007FFE5AFD0000-0x00007FFE5B4F2000-memory.dmp
                  Download

                  memory/3428-1259-0x00007FFE5A510000-0x00007FFE5A545000-memory.dmp
                  Download

                  memory/3428-1258-0x00007FFE61F30000-0x00007FFE61F47000-memory.dmp
                  Download

                  memory/3428-1209-0x00007FFE6A5A0000-0x00007FFE6A5AE000-memory.dmp
                  Download

                  memory/3428-1214-0x00007FFE68100000-0x00007FFE6810B000-memory.dmp
                  Download

                  memory/3428-1215-0x00007FFE680F0000-0x00007FFE680FC000-memory.dmp
                  Download

                  memory/3428-1260-0x00007FFE59F40000-0x00007FFE5A185000-memory.dmp
                  Download

                  memory/3428-1216-0x00007FFE680E0000-0x00007FFE680EC000-memory.dmp
                  Download

                  memory/3428-1225-0x00007FFE6ADE0000-0x00007FFE6AE07000-memory.dmp
                  Download

                  memory/3428-1226-0x00007FFE61F50000-0x00007FFE61F72000-memory.dmp
                  Download

                  memory/3428-1224-0x00007FFE62600000-0x00007FFE62614000-memory.dmp
                  Download

                  memory/3428-1217-0x00007FFE64630000-0x00007FFE6463D000-memory.dmp
                  Download

                  memory/3428-1222-0x00007FFE5C330000-0x00007FFE5C3FD000-memory.dmp
                  Download

                  memory/3428-1223-0x00007FFE62620000-0x00007FFE62632000-memory.dmp
                  Download

                  memory/3428-1220-0x00007FFE6B710000-0x00007FFE6B743000-memory.dmp
                  Download

                  memory/3428-1221-0x00007FFE62640000-0x00007FFE62656000-memory.dmp
                  Download

                  memory/3428-1218-0x00007FFE61F80000-0x00007FFE61F92000-memory.dmp
                  Download

                  memory/3428-1219-0x00007FFE625E0000-0x00007FFE625EC000-memory.dmp
                  Download

                  memory/3428-1210-0x00007FFE6A590000-0x00007FFE6A59C000-memory.dmp
                  Download

                  memory/3428-1261-0x00007FFE5A7A0000-0x00007FFE5A7EC000-memory.dmp
                  Download

                  memory/3428-1211-0x00007FFE68110000-0x00007FFE6811B000-memory.dmp
                  Download

                  memory/3428-1262-0x00007FFE59840000-0x00007FFE59F35000-memory.dmp
                  Download

                  memory/3428-1212-0x00007FFE74990000-0x00007FFE749A4000-memory.dmp
                  Download

                  memory/3428-1213-0x00007FFE6A5B0000-0x00007FFE6A5BC000-memory.dmp
                  Download

                  memory/3428-1207-0x00007FFE6B5E0000-0x00007FFE6B605000-memory.dmp
                  Download

                  memory/3428-1206-0x00007FFE6AE50000-0x00007FFE6AE5B000-memory.dmp
                  Download

                  memory/3428-1198-0x00007FFE6B700000-0x00007FFE6B70D000-memory.dmp
                  Download

                  memory/3428-1253-0x00007FFE5A5F0000-0x00007FFE5A5FC000-memory.dmp
                  Download

                  memory/3428-1195-0x00007FFE6B9C0000-0x00007FFE6B9CB000-memory.dmp
                  Download

                  memory/3428-1197-0x00007FFE5AD00000-0x00007FFE5AE1B000-memory.dmp
                  Download

                  memory/3428-1196-0x00007FFE6ADE0000-0x00007FFE6AE07000-memory.dmp
                  Download

                  memory/3428-1194-0x00007FFE6B9D0000-0x00007FFE6B9DD000-memory.dmp
                  Download

                  memory/3428-1192-0x00007FFE6B710000-0x00007FFE6B743000-memory.dmp
                  Download

                  memory/3428-1193-0x00007FFE5C330000-0x00007FFE5C3FD000-memory.dmp
                  Download

                  memory/3428-1228-0x00007FFE61F30000-0x00007FFE61F47000-memory.dmp
                  Download

                  memory/3428-1190-0x00007FFE6BA00000-0x00007FFE6BA0D000-memory.dmp
                  Download

                  memory/3428-1191-0x00007FFE6B9E0000-0x00007FFE6B9F8000-memory.dmp
                  Download

                  memory/3428-1188-0x00007FFE5AFD0000-0x00007FFE5B4F2000-memory.dmp
                  Download

                  memory/3428-1187-0x00007FFE74990000-0x00007FFE749A4000-memory.dmp
                  Download

                  memory/3428-1263-0x00007FFE597E0000-0x00007FFE59835000-memory.dmp
                  Download

                  memory/3428-1139-0x00007FFE6AE90000-0x00007FFE6AEA9000-memory.dmp
                  Download

                  memory/3428-1138-0x00007FFE6BBA0000-0x00007FFE6BBAF000-memory.dmp
                  Download

                  memory/3428-1266-0x00007FFE59770000-0x00007FFE597AE000-memory.dmp
                  Download

                  memory/3428-1265-0x00007FFE5A3A0000-0x00007FFE5A3B6000-memory.dmp
                  Download

                  memory/3428-1264-0x00007FFE5A700000-0x00007FFE5A75D000-memory.dmp
                  Download

                  memory/3428-1252-0x00007FFE5A600000-0x00007FFE5A60B000-memory.dmp
                  Download

                  memory/3428-1254-0x00007FFE5A5E0000-0x00007FFE5A5EC000-memory.dmp
                  Download

                  memory/3428-1255-0x00007FFE5A5D0000-0x00007FFE5A5DD000-memory.dmp
                  Download

                  memory/3428-1271-0x00007FFE5A370000-0x00007FFE5A399000-memory.dmp
                  Download

                  memory/3428-1270-0x00007FFE593A0000-0x00007FFE59539000-memory.dmp
                  Download

                  memory/3428-1269-0x00007FFE59540000-0x00007FFE5956E000-memory.dmp
                  Download

                  memory/3428-1268-0x00007FFE59570000-0x00007FFE5973A000-memory.dmp
                  Download

                  memory/3428-1267-0x00007FFE59740000-0x00007FFE59756000-memory.dmp
                  Download

                  memory/3428-1140-0x00007FFE6AE60000-0x00007FFE6AE8D000-memory.dmp
                  Download

                  memory/3428-1124-0x00007FFE5B6C0000-0x00007FFE5BD98000-memory.dmp
                  Download

                  memory/3428-1256-0x00007FFE5A5B0000-0x00007FFE5A5C2000-memory.dmp
                  Download

                  memory/3428-1272-0x00007FFE5A310000-0x00007FFE5A334000-memory.dmp
                  Download

                  memory/3428-1277-0x00007FFE5A190000-0x00007FFE5A306000-memory.dmp
                  Download

                  memory/3428-1274-0x00007FFE59000000-0x00007FFE5902B000-memory.dmp
                  Download

                  memory/3428-1273-0x00007FFE59030000-0x00007FFE5904A000-memory.dmp
                  Download

                  memory/3428-1257-0x00007FFE5A5A0000-0x00007FFE5A5AC000-memory.dmp
                  Download

                  memory/3428-1230-0x00007FFE6B700000-0x00007FFE6B70D000-memory.dmp
                  Download

                  memory/3428-1229-0x00007FFE5A7F0000-0x00007FFE5A809000-memory.dmp
                  Download

                  memory/3428-1199-0x00007FFE5B6C0000-0x00007FFE5BD98000-memory.dmp
                  Download

                  memory/3428-1320-0x00007FFE5AFD0000-0x00007FFE5B4F2000-memory.dmp
                  Download

                  memory/3428-1329-0x00007FFE5AD00000-0x00007FFE5AE1B000-memory.dmp
                  Download

                  memory/3428-1328-0x00007FFE6ADE0000-0x00007FFE6AE07000-memory.dmp
                  Download

                  memory/3428-1327-0x00007FFE6B9C0000-0x00007FFE6B9CB000-memory.dmp
                  Download

                  memory/3428-1326-0x00007FFE6B9D0000-0x00007FFE6B9DD000-memory.dmp
                  Download

                  memory/3428-1325-0x00007FFE5C330000-0x00007FFE5C3FD000-memory.dmp
                  Download

                  memory/3428-1324-0x00007FFE6B710000-0x00007FFE6B743000-memory.dmp
                  Download

                  memory/3428-1323-0x00007FFE6B9E0000-0x00007FFE6B9F8000-memory.dmp
                  Download

                  memory/3428-1322-0x00007FFE6BA00000-0x00007FFE6BA0D000-memory.dmp
                  Download

                  memory/3428-1321-0x00007FFE6BA10000-0x00007FFE6BA29000-memory.dmp
                  Download

                  memory/3428-1314-0x00007FFE5B6C0000-0x00007FFE5BD98000-memory.dmp
                  Download

                  memory/3428-1319-0x00007FFE74990000-0x00007FFE749A4000-memory.dmp
                  Download

                  memory/3428-1318-0x00007FFE6AE60000-0x00007FFE6AE8D000-memory.dmp
                  Download

                  memory/3428-1317-0x00007FFE6AE90000-0x00007FFE6AEA9000-memory.dmp
                  Download

                  memory/3428-1316-0x00007FFE6BBA0000-0x00007FFE6BBAF000-memory.dmp
                  Download

                  memory/3428-1315-0x00007FFE6B5E0000-0x00007FFE6B605000-memory.dmp
                  Download

                  memory/3428-1352-0x00007FFE5A310000-0x00007FFE5A334000-memory.dmp
                  Download

                  memory/3428-1351-0x00007FFE5A780000-0x00007FFE5A791000-memory.dmp
                  Download

                  memory/3428-1350-0x00007FFE5A7A0000-0x00007FFE5A7EC000-memory.dmp
                  Download

                  memory/3428-1348-0x00007FFE61F30000-0x00007FFE61F47000-memory.dmp
                  Download

                  memory/3428-1347-0x00007FFE625E0000-0x00007FFE625EC000-memory.dmp
                  Download

                  memory/3428-1346-0x00007FFE61F80000-0x00007FFE61F92000-memory.dmp
                  Download

                  memory/3428-1345-0x00007FFE64630000-0x00007FFE6463D000-memory.dmp
                  Download

                  memory/3428-1344-0x00007FFE680E0000-0x00007FFE680EC000-memory.dmp
                  Download

                  memory/3428-1343-0x00007FFE680F0000-0x00007FFE680FC000-memory.dmp
                  Download

                  memory/3428-1342-0x00007FFE68100000-0x00007FFE6810B000-memory.dmp
                  Download

                  memory/3428-1200-0x00007FFE6B5D0000-0x00007FFE6B5DB000-memory.dmp
                  Download

                  memory/3428-1201-0x00007FFE6AD90000-0x00007FFE6AD9C000-memory.dmp
                  Download

                  memory/3428-1202-0x00007FFE6AB80000-0x00007FFE6AB8B000-memory.dmp
                  Download

                  memory/3428-1203-0x00007FFE6AB30000-0x00007FFE6AB3C000-memory.dmp
                  Download

                  memory/3428-1239-0x00007FFE5A190000-0x00007FFE5A306000-memory.dmp
                  Download

                  memory/3428-1237-0x00007FFE5A340000-0x00007FFE5A36E000-memory.dmp
                  Download

                  memory/3428-1238-0x00007FFE5A310000-0x00007FFE5A334000-memory.dmp
                  Download

                  memory/3428-1204-0x00007FFE6A920000-0x00007FFE6A92B000-memory.dmp
                  Download

                  memory/3428-1236-0x00007FFE5A370000-0x00007FFE5A399000-memory.dmp
                  Download

                  memory/3428-1205-0x00007FFE6A910000-0x00007FFE6A91C000-memory.dmp
                  Download

                  memory/3428-1235-0x00007FFE5A6C0000-0x00007FFE5A6F9000-memory.dmp
                  Download

                  memory/3428-1234-0x00007FFE5A700000-0x00007FFE5A75D000-memory.dmp
                  Download

                  memory/3428-1227-0x00007FFE5AD00000-0x00007FFE5AE1B000-memory.dmp
                  Download

                  memory/3428-1231-0x00007FFE5A7A0000-0x00007FFE5A7EC000-memory.dmp
                  Download

                  memory/3428-1233-0x00007FFE5A760000-0x00007FFE5A77E000-memory.dmp
                  Download

                  memory/3428-1232-0x00007FFE5A780000-0x00007FFE5A791000-memory.dmp
                  Download