7a9d65371caadae24c4890655a13de8b452d2a85cac57916e6000576ac5f9f80

Resubmissions

09/06/2024, 14:57

240609-sbqb1acd769

09/06/2024, 14:54

240609-r9vtpscd639

Analysis

max time kernel
133s
max time network
139s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/06/2024, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransom.exe
Size 9.6MB
Sample240609-r9vtpscd63
SHA256 7a9d65371caadae24c4890655a13de8b452d2a85cac57916e6000576ac5f9f80
MD5 7e7dfca5377a5df1d10a03f42666b30d
SHA1 322a274d242380800a16f742893578a09f92f93a
SHA512 c08c4a8dbac710825ea80d9dc3f3954c2f695eb8d88229615a87d0528b45e4c416cc403bf16bfd3b49ca09bbc39f9e2ffdef9d6820c58226ed87f5d05d669d43
SSDEEP 196608:7MFat7ays9cA2AV2QsyH3zEGL2Vmd6+D+nNgwQ+dtLZ7kFCd5jXkoP4:41TkOnz3L2Vmd6myNjd7lwo
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion execution persistence ransomware spyware

Malware Config

Signatures

Renames multiple (157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
516	netsh.exe

Loads dropped DLL 24 IoCs

pid	Process
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe
4400	ransom.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\update.bat"	reg.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\Pictures\desktop.ini	ransom.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ransom.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ransom.exe
File created	C:\Users\Admin\Music\desktop.ini	ransom.exe
File created	C:\Users\Admin\Videos\desktop.ini	ransom.exe
File created	C:\Users\Admin\Desktop\desktop.ini	ransom.exe
File created	C:\Users\Admin\Documents\desktop.ini	ransom.exe
File created	C:\Users\Admin\Downloads\desktop.ini	ransom.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe
1108	powershell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4932	reg.exe
4804	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe
2208	tskill.exe
2208	tskill.exe
4532	tskill.exe
4532	tskill.exe
2176	tskill.exe
2176	tskill.exe
1740	tskill.exe
1740	tskill.exe
792	tskill.exe
792	tskill.exe
2316	tskill.exe
2316	tskill.exe
3016	tskill.exe
3016	tskill.exe
2228	tskill.exe
2228	tskill.exe
4772	tskill.exe
4772	tskill.exe
4128	tskill.exe
4128	tskill.exe
1612	tskill.exe
1612	tskill.exe
5032	tskill.exe
5032	tskill.exe
1232	tskill.exe
1232	tskill.exe
2872	tskill.exe
2872	tskill.exe
4304	tskill.exe
4304	tskill.exe
3300	tskill.exe
3300	tskill.exe
1228	tskill.exe
1228	tskill.exe
1636	tskill.exe
1636	tskill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4400	2768	ransom.exe	74
PID 2768 wrote to memory of 4400	2768	ransom.exe	74
PID 4400 wrote to memory of 5092	4400	ransom.exe	75
PID 4400 wrote to memory of 5092	4400	ransom.exe	75
PID 5092 wrote to memory of 1108	5092	cmd.exe	76
PID 5092 wrote to memory of 1108	5092	cmd.exe	76
PID 4400 wrote to memory of 1972	4400	ransom.exe	77
PID 4400 wrote to memory of 1972	4400	ransom.exe	77
PID 4400 wrote to memory of 2312	4400	ransom.exe	78
PID 4400 wrote to memory of 2312	4400	ransom.exe	78
PID 2312 wrote to memory of 4800	2312	cmd.exe	79
PID 2312 wrote to memory of 4800	2312	cmd.exe	79
PID 4800 wrote to memory of 2848	4800	net.exe	80
PID 4800 wrote to memory of 2848	4800	net.exe	80
PID 2312 wrote to memory of 516	2312	cmd.exe	81
PID 2312 wrote to memory of 516	2312	cmd.exe	81
PID 2312 wrote to memory of 2208	2312	cmd.exe	82
PID 2312 wrote to memory of 2208	2312	cmd.exe	82
PID 2312 wrote to memory of 4532	2312	cmd.exe	83
PID 2312 wrote to memory of 4532	2312	cmd.exe	83
PID 2312 wrote to memory of 2176	2312	cmd.exe	84
PID 2312 wrote to memory of 2176	2312	cmd.exe	84
PID 2312 wrote to memory of 1740	2312	cmd.exe	85
PID 2312 wrote to memory of 1740	2312	cmd.exe	85
PID 2312 wrote to memory of 792	2312	cmd.exe	86
PID 2312 wrote to memory of 792	2312	cmd.exe	86
PID 2312 wrote to memory of 2316	2312	cmd.exe	87
PID 2312 wrote to memory of 2316	2312	cmd.exe	87
PID 2312 wrote to memory of 3016	2312	cmd.exe	88
PID 2312 wrote to memory of 3016	2312	cmd.exe	88
PID 2312 wrote to memory of 2228	2312	cmd.exe	89
PID 2312 wrote to memory of 2228	2312	cmd.exe	89
PID 2312 wrote to memory of 4772	2312	cmd.exe	90
PID 2312 wrote to memory of 4772	2312	cmd.exe	90
PID 2312 wrote to memory of 4128	2312	cmd.exe	91
PID 2312 wrote to memory of 4128	2312	cmd.exe	91
PID 2312 wrote to memory of 1612	2312	cmd.exe	92
PID 2312 wrote to memory of 1612	2312	cmd.exe	92
PID 2312 wrote to memory of 5032	2312	cmd.exe	93
PID 2312 wrote to memory of 5032	2312	cmd.exe	93
PID 2312 wrote to memory of 1232	2312	cmd.exe	94
PID 2312 wrote to memory of 1232	2312	cmd.exe	94
PID 2312 wrote to memory of 2872	2312	cmd.exe	95
PID 2312 wrote to memory of 2872	2312	cmd.exe	95
PID 2312 wrote to memory of 4304	2312	cmd.exe	96
PID 2312 wrote to memory of 4304	2312	cmd.exe	96
PID 2312 wrote to memory of 3300	2312	cmd.exe	97
PID 2312 wrote to memory of 3300	2312	cmd.exe	97
PID 2312 wrote to memory of 1228	2312	cmd.exe	98
PID 2312 wrote to memory of 1228	2312	cmd.exe	98
PID 2312 wrote to memory of 1636	2312	cmd.exe	99
PID 2312 wrote to memory of 1636	2312	cmd.exe	99
PID 4400 wrote to memory of 4176	4400	ransom.exe	100
PID 4400 wrote to memory of 4176	4400	ransom.exe	100
PID 4176 wrote to memory of 4804	4176	cmd.exe	101
PID 4176 wrote to memory of 4804	4176	cmd.exe	101
PID 4400 wrote to memory of 4744	4400	ransom.exe	102
PID 4400 wrote to memory of 4744	4400	ransom.exe	102
PID 4744 wrote to memory of 4932	4744	cmd.exe	103
PID 4744 wrote to memory of 4932	4744	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\ransom.exe
"C:\Users\Admin\AppData\Local\Temp\ransom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\ransom.exe
  "C:\Users\Admin\AppData\Local\Temp\ransom.exe"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -command Set-Culture en-US
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command Set-Culture en-US
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp57ag2p7d\disable_av.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp57ag2p7d\kill_av.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\system32\net.exe
      net stop "Security Center"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Security Center"
        5⤵
        
        PID:2848
  - - C:\Windows\system32\netsh.exe
      netsh firewall set opmode mode=disable
      4⤵
      Modifies Windows Firewall
      PID:516
  - - C:\Windows\system32\tskill.exe
      tskill /A av*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2208
  - - C:\Windows\system32\tskill.exe
      tskill /A fire*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4532
  - - C:\Windows\system32\tskill.exe
      tskill /A anti*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2176
  - - C:\Windows\system32\tskill.exe
      tskill /A spy*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1740
  - - C:\Windows\system32\tskill.exe
      tskill /A bullguard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:792
  - - C:\Windows\system32\tskill.exe
      tskill /A PersFw
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2316
  - - C:\Windows\system32\tskill.exe
      tskill /A KAV*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3016
  - - C:\Windows\system32\tskill.exe
      tskill /A ZONEALARM
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2228
  - - C:\Windows\system32\tskill.exe
      tskill /A SAFEWEB
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4772
  - - C:\Windows\system32\tskill.exe
      tskill /A OUTPOST
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4128
  - - C:\Windows\system32\tskill.exe
      tskill /A nv*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1612
  - - C:\Windows\system32\tskill.exe
      tskill /A nav*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5032
  - - C:\Windows\system32\tskill.exe
      tskill /A F-*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1232
  - - C:\Windows\system32\tskill.exe
      tskill /A ESAFE
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2872
  - - C:\Windows\system32\tskill.exe
      tskill /A cle
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4304
  - - C:\Windows\system32\tskill.exe
      tskill /A BLACKICE
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3300
  - - C:\Windows\system32\tskill.exe
      tskill /A def*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1228
  - - C:\Windows\system32\tskill.exe
      tskill /A ka*
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /f
      4⤵
      Modifies registry key
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\update.bat /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\update.bat /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 dcd32b4386d3af7c5bb776f5110a414bd12c8e58160a385db33c018e7f5e1acb
MD5 1b3065a1d600254ed284e3be2d44c775
SHA1 dc1ec7edfb2afc31663efb55ce2645caf89e892c
SHA512 ccf6c29ccac0e1a53eb3c0412a587d005b9a183e16c1984f16731162306e2331044a8b44523b6baf7a17720ed549cad4c0e45bb9680430c244129fb72bec14c8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 53c531cc510a3afca78636b4f8f2ec88d7545f57b28ebb69cf3310e27735fd5f
MD5 7946fab362fe6b6cdb97439ae0a58d00
SHA1 d21e02dec249126ea8cd2f45cd78172de2f42642
SHA512 2f8a3c54dc3b6dc460216e2b26a903b8a68e542ae8d551bc364724793604f0aa6f7eb3044852dbe6ab0fae0893ff1609645870e9258dbfbabe4608510d88d55f
MD5 SHA1 SHA512

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\_ctypes.pyd
Size 116KB
SHA256 9ab1f8cbb50db3d9a00f74447a2275a89ec52d1139fc0a93010e59c412c2c850
MD5 92276f41ff9c856f4dbfa6508614e96c
SHA1 5bc8c3555e3407a3c78385ff2657de3dec55988e
SHA512 9df63ef04ea890dd0d38a26ac64a92392cf0a8d0ad77929727238e9e456450518404c1b6bb40844522fca27761c4e864550aacb96e825c4e4b367a59892a09e7
SSDEEP 3072:zW66GKh4hqyIVQoavMSut/SfrS34ep9x3FIMQPwnJC:C6QKtkSuZSfrSlFLJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\base_library.zip
Size 812KB
SHA256 762591f4a42f9dc8b9e9a6c0ed6bd5c3b39875eeacc34a6bf078c18a3e735982
MD5 514cf74da8ee921006c003a1257df418
SHA1 59321f253aacda0287335048193747bd0c274c98
SHA512 df1e5dd55f09bfe3a9354911b4568a706e563b03c56be0a18934dfe5225e8101b84a561b8826b7fd6d146485f79c0bf156a3ff5cb11cc8c79942d084b2de3339
SSDEEP 12288:lEHYKPYOWSgVqFEIrRA4a2YCd8Vw9FfJEaQqFSRMNoW:lEHYQ1gALa2SVw9FfJEaQqMMNoW
MD5 SHA1 SHA512 SSDEEP

Submit Download

_openssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\cryptography\hazmat\bindings\_openssl.pyd
Size 3.8MB
SHA256 da0dea85eb34de0e50ab1d343d33ed0a99b3af5e2f479d306fce5c0ed604b1d8
MD5 772cace2ab493c306930c01050a5b667
SHA1 5130913527cb73ca1358875f63464907088f0a5b
SHA512 b0019a4ff07a5d76e1c01dd7079ea9eae5bd1cede64af917ba94206ad434acf946efad90ebfd240cfefcdb22c8ca732af659e4408105a9ff130545950ed1bd2d
SSDEEP 49152:tIU6iL9GtlqiVwASOHU9/RsUkuH+6y/237DqbZ3iAsUJyYWQ6WP1dX7P6nD75pCX:a+SOxLDqgYhWQ6WjTKm+A5q2
MD5 SHA1 SHA512 SSDEEP

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\cryptography\hazmat\bindings\_rust.pyd
Size 1.6MB
SHA256 bca2dd906302a6a84e9aa5f41b06c4deef4fee139e861d5c538ba30bd4c40574
MD5 7d6f3ad57f25c087286a55fe1ecd55db
SHA1 df87721286061ef3e5687fd29924c025d230c9e9
SHA512 8a042d70956c6d8d617b9fb73f942209c4396cee11a8ef64b8cce77f5989ac5fc728f04353b342beb1823953c6e73fdc50ccdc0d72721b81f515581ca5c32f6a
SSDEEP 24576:/paFZST2pNXfXj9q/Vys/27ZkmLKS3/Zys:BaFpHfXj9q/Vys/2dfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\python3.DLL
Size 60KB
SHA256 84a29c369560c5175d22ee764fe8ada882ab6b37b6b10c005404153518a344ec
MD5 0812ee5d8abc0072957e9415ba6e62f2
SHA1 ea05c427e46c5d9470ba81d6b7cbca6838ee0dd5
SHA512 18ca5631f2ae957b9ec8eaa7aa87094d3a296548790ced970752625a0f271511e0ce0042a0ea5469a9c362a0d811c530ef6fe41b84c61b25c838466acc37f22b
SSDEEP 768:Ba8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq5:Bawewnvtjnsfw1FIMQ0Q7Syn
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\python310.dll
Size 4.2MB
SHA256 8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e
MD5 a1185bef38fdba5e3fe6a71f93a9d142
SHA1 e2b40f5e518ad000002b239a84c153fdc35df4eb
SHA512 cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4
SSDEEP 49152:kAz5zjppNAQdRnpoFPN7RhvPSUrRBthux243ahuxZplZTJycg7gpP7Bz5AIu35H8:9NPNE1NJpGgk7J3uJHsMraSSFP+4j
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27682\unicodedata.pyd
Size 1.1MB
SHA256 09e1d1e9190160959696aeddb0324667fef39f338edc28f49b5f518b92f27f5f
MD5 d67ac58da9e60e5b7ef3745fdda74f7d
SHA1 092faa0a13f99fd05c63395ee8ee9aa2bb1ca478
SHA512 9d510135e4106fef0640565e73d438b4398f7aa65a36e3ea21d8241f07fec7a23e721e8696b3605147e5ce5365684e84e8145001201a19d7537e8f61b20cf32c
SSDEEP 12288:ZrlBMmuZ63N5QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uOK4:JlBueZV0m81MMREtV6Vo4uYOK4
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_x0fzscvj.t4p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x0fzscvj.t4p.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

file_paths.txt

Path C:\Users\Admin\AppData\Local\Temp\tmp57ag2p7d\ROBLOX\file_paths.txt
Size 4KB
SHA256 6b8a1ba87572a6f51f6e796675dea61c180104d4031e93ac153b22402a504345
MD5 05a671fbd7c56a996fbca8ab9676df86
SHA1 8e753a5d6447137a267c3c2385223040a407e29f
SHA512 05b7ad7cfabe5606d78993106a56b4174b6f607ab5a98a5611db2bd7c570f703a9227abb061cf1f38f81877f668ab294c0675fa618549ac0cd9a2b6686ea30c6
SSDEEP 24:omvhkwNQoGXmhKwPTovGDk5R9HWj9/JvxoTUpv5r6lgRO+D597o4+upj5DzWsSBE:omvPq6jMGA5OjhJBpMqg1uizoHl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

disable_av.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp57ag2p7d\disable_av.ps1
Size 86B
SHA256 d1dcccfd275790c7fa06a9a333c49e58326fc92ebfd20bbfd02d933b591e3dd8
MD5 dd103dbae79bf4add0186931a9d4664a
SHA1 4d2b8d5349972ea0d25aa60a05334712205d0f02
SHA512 6618832266ee652a363471ef238246ec6869b8c5760e3d1e43bfe4c08f042afc4e671b7e8d5832ee413cdfcc2f03172cdd2c10242a179a55773660759e25e762
MD5 SHA1 SHA512

Submit Download

kill_av.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp57ag2p7d\kill_av.bat
Size 434B
SHA256 957257c8a0c8523912f0ec37b52ae7418129713c2af42b739d19903c599b667a
MD5 597891c0702fa504dc42d653e9900b89
SHA1 80390c43da4a555b4835788c446f03168a01726a
SHA512 b58227f2e419a0ffad493fba962e252561f320c6c9817e35d262e5257acad047339e78090d45d29ba6998d6aededdf022f4b5e6d85167c7c3079330c3d3095f2
MD5 SHA1 SHA512

Submit Download

MSVCP140.dll

Path \Users\Admin\AppData\Local\Temp\_MEI27682\MSVCP140.dll
Size 559KB
SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
MD5 c3d497b0afef4bd7e09c7559e1c75b05
SHA1 295998a6455cc230da9517408f59569ea4ed7b02
SHA512 d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
SSDEEP 12288:mPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDaM:sqwpzSFJQEKZm+jWodEEq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path \Users\Admin\AppData\Local\Temp\_MEI27682\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path \Users\Admin\AppData\Local\Temp\_MEI27682\VCRUNTIME140_1.dll
Size 36KB
SHA256 1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
MD5 37c372da4b1adb96dc995ecb7e68e465
SHA1 6c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA512 926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6
SSDEEP 384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_brotli.cp310-win_amd64.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_brotli.cp310-win_amd64.pyd
Size 861KB
SHA256 58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a
MD5 6d44fd95c62c6415999ebc01af40574b
SHA1 a5aee5e107d883d1490257c9702913c12b49b22a
SHA512 59b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3
SSDEEP 12288:XCJ+rcI2+Lf+G8vi2onrhZFQMd65Tx8Y4AHhly08bXTw05nmZfRR:XCJ0cI2+Oi209Q+674AkgAmZfRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_bz2.pyd
Size 77KB
SHA256 0897e209676f5835f62e5985d7793c884fd91b0cfdfaff893fc05176f2f82095
MD5 a1fbcfbd82de566a6c99d1a7ab2d8a69
SHA1 3e8ba4c925c07f17c7dffab8fbb7b8b8863cad76
SHA512 55679427c041b2311cff4e97672102962f9d831e84f06f05600ecdc3826f6be5046aa541955f57f06e82ee72a4ee36f086da1f664f493fbe4cc0806e925afa04
SSDEEP 1536:szXz7Bgrj7FUHfuwttm8ebvwyBIMtVk7SyNU:oXzVMFOfuIRebvwyBIMtVk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.cp310-win_amd64.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_cffi_backend.cp310-win_amd64.pyd
Size 179KB
SHA256 5763c1d29903567cde4d46355d3a7380d10143543986ca4eebfca4d22d991e3e
MD5 282b92ef9ed04c419564fbaee2c5cdbe
SHA1 e19b54d6ab67050c80b36a016b539cbe935568d5
SHA512 3ddebdc28d0add9063ee6d41f14331898f92452a13762b6c4c9aa5a83dde89510176425c11a48591fa05c949cb35218bf421f1974e33eb8133a1b95ea74e4941
SSDEEP 3072:UE3+oUv8dnqoy8e7VxECiOxwqaL6cTAoSTL9KXZnrqGWcRZVcmU:r3+KnqT7VaC/wqq6yAoSTL8X1qHI71U
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_hashlib.pyd
Size 59KB
SHA256 2e30544d07f1c55d741b03992ea57d1aa519edaaa121e889f301a5b8b6557fe4
MD5 ad6e31dba413be7e082fab3dbafb3ecc
SHA1 f26886c841d1c61fb0da14e20e57e7202eefbacc
SHA512 6401664e5c942d98c6fa955cc2424dfa0c973bd0ac1e515f7640c975bba366af1b3e403ea50e753f837dcd82a04af2ce043e22b15fa9976af7cbb30b3ac80452
SSDEEP 768:8nvx+iVPY7S+NbM2S2uoU1lyZjWv4so5IM5IkzrYiSyvchym:FWPYW+Nbs2uP1UZjWv1o5IM5I4r7Syrm
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_lzma.pyd
Size 150KB
SHA256 ce72d59a0e96077c9ea3f1fd7b011287248dc8d80fd3c16916a1d9040a9a941f
MD5 a6bee109071bbcf24e4d82498d376f82
SHA1 1babacdfaa60e39e21602908047219d111ed8657
SHA512 8cb2dafd19f212e71fa32cb74dad303af68eaa77a63ccf6d3a6ae82e09ac988f71fe82f8f2858a9c616b06dc42023203fa9f7511fac32023be0bc8392272c336
SSDEEP 3072:rD6xBrqs+vs0H0q8bnpbVZbXsAI0znfo9mNoJ5vSpxpBIMe19cc:rD63rcRLCV+qwYOJ50Pk
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_queue.pyd
Size 26KB
SHA256 8e7e758150ea066299a956f268c3eb04bc800e9f3395402cd407c486844a9595
MD5 8dd33fe76645636520c5d976b8a2b6fc
SHA1 12988ddd52cbb0ce0f3b96ce19a1827b237ed5f7
SHA512 e7b4b5662ebd8efb2e4b6f47eb2021afacd52b100db2df66331ca79a4fb2149cac621d5f18ab8ab9cfadbd677274db798ebad9b1d3e46e29f4c92828fd88c187
SSDEEP 384:vfqkQfdUCUFYS9F6Xg6rEGSSVYptTDbFIM7UoIYiSy1pCQW3hL8:sdUC+F6rEGSSVYTFIM7UxYiSyvQho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_socket.pyd
Size 73KB
SHA256 130de3506471878031aecc4c9d38355a4719edd3786f27262a724efc287a47b9
MD5 c5378bac8c03d7ef46305ee8394560f5
SHA1 2aa7bc90c0ec4d21113b8aa6709569d59fadd329
SHA512 1ecb88c62a9daad93ec85f137440e782dcc40d7f1598b5809ab41bf86a5c97224e2361c0e738c1387c6376f2f24d284583fd001c4e1324d72d6989d0b84bf856
SSDEEP 1536:0mtvsZWgzruIAl9/s+S+pByXc/+lvFIMQwY7Sy3:z5IJzrAl9/sT+pB8c/SvFIMQwYJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\_ssl.pyd
Size 152KB
SHA256 5a4c78adedf0bcb5fc422faac619b4c7b57e3d7ba4f2d47a98c1fb81a503b6b7
MD5 9d810454bc451ff440ec95de36088909
SHA1 8c890b934a2d84c548a09461ca1e783810f075be
SHA512 0800666f848faec976366dbfd2c65e7b7e1d8375d5d9e7d019bf364a1f480216c271c3bcf994dbab19290d336cf691cd8235e636f3dbc4d2a77f4760871c19ed
SSDEEP 3072:l9Y1GpXg28PqCBWZxVkc85nu9ekFc8j8V+AOXLkdWXxZIIkjIIBIMt7LU:l9Y0BgdqCETavu9L6V+RrIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bcrypt.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\bcrypt\_bcrypt.pyd
Size 294KB
SHA256 3d1c66bdcb4fa0b8e917895e1b4d62ee14260eaa1bd6fe908877c47585ec6127
MD5 03ef5e8da65667751e1fd3fa0c182d3e
SHA1 4608d1efca23143006c1338deda144a2f3bb8a16
SHA512 c094a3dfbd863726524c56dab2592b3513a3a8c445bcaac6cfb41a5ddec3079d9b1f849c6826c1cc4241ca8b0aa44e33d2502bb20856313966af31f480ba8811
SSDEEP 6144:GSL1oP995ooVABNirLq0l/IzkQ37P6BdeAb6:Gh19NO7irLq0l/IzB37Pe6
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path \Users\Admin\AppData\Local\Temp\_MEI27682\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-7.dll

Path \Users\Admin\AppData\Local\Temp\_MEI27682\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path \Users\Admin\AppData\Local\Temp\_MEI27682\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI27682\select.pyd
Size 25KB
SHA256 cb643556c2dcdb957137b25c8a33855067e0d07547e547587c9886238253bfe5
MD5 63ede3c60ee921074647ec0278e6aa45
SHA1 a02c42d3849ad8c03ce60f2fd1797b1901441f26
SHA512 d0babc48b0e470abdafad6205cc0824eec66dbb5bff771cee6d99a0577373a2de2ffab93e86c42c7642e49999a03546f94e7630d3c58db2cff8f26debc67fcad
SSDEEP 384:dPjk/7e12hwheCnHqJYBsVRXFIM7Gh+IYiSy1pCQyvUhD:NUC2hwhjHqWYVFIM7GdYiSyvdhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-97-0x00007FFD0B760000-0x00007FFD0C14C000-memory.dmp

Download

memory/1108-96-0x0000018A6C800000-0x0000018A6C876000-memory.dmp

Download

memory/1108-141-0x00007FFD0B760000-0x00007FFD0C14C000-memory.dmp

Download

memory/1108-95-0x00007FFD0B760000-0x00007FFD0C14C000-memory.dmp

Download

memory/1108-89-0x00007FFD0B763000-0x00007FFD0B764000-memory.dmp

Download

memory/1108-92-0x0000018A6C480000-0x0000018A6C4A2000-memory.dmp

Download