Analysis Overview
SHA256
7928b1e29853be208f9cd41ce51181c80c2654789d509142f784cdb391886e63
Threat Level: Known bad
The file VapeV4-crack-loader-main.zip was found to be: Known bad.
Malicious Activity Summary
Xworm
Agenttesla family
A stealer written in Python and packaged with Pyinstaller
Xworm family
Blankgrabber family
AgentTesla payload
Detect Xworm Payload
Command and Scripting Interpreter: PowerShell
UPX packed file
Loads dropped DLL
Drops startup file
Adds Run key to start application
Looks up external IP address via web service
Hide Artifacts: Hidden Files and Directories
Unsigned PE
Views/modifies file attributes
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Detects videocard installed
Enumerates processes with tasklist
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-21 05:14
Signatures
A stealer written in Python and packaged with Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
AgentTesla payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Agenttesla family
Blankgrabber family
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-21 05:14
Reported
2024-06-21 05:16
Platform
win11-20240508-en
Max time kernel
75s
Max time network
80s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Defender.lnk | C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Defender.lnk | C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe | N/A |
Loads dropped DLL
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Defender.exe" | C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Hide Artifacts: Hidden Files and Directories
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\VapeV4-crack-loader-main.zip
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\vape-loader.bat" "
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
"g-build.exe"
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe
"r-build.exe"
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
"g-build.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Download latest version at : wazkonetwork.com/project', 0, 'Old version detected', 0+16);close()""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe'
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Download latest version at : wazkonetwork.com/project', 0, 'Old version detected', 0+16);close()"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\vape-loader.bat"
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
"g-build.exe"
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe
"r-build.exe"
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
"g-build.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'r-build.exe'
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
"C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe"
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe
"C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Defender.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Defender.exe'
C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe
"C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\r-build.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\Desktop\VapeV4-crack-loader-main\VapeV4-crack-loader-main\bin\exe\exec\g-build.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | blank-vjueg.in | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 8.8.8.8:53 | blank-vjueg.in | udp |
| US | 8.8.8.8:53 | into-hybrid.gl.at.ply.gg | udp |
| US | 8.8.8.8:53 | blank-vjueg.in | udp |
Files
memory/4960-21-0x00007FFD8CCB3000-0x00007FFD8CCB5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI10522\python311.dll
| MD5 | bb46b85029b543b70276ad8e4c238799 |
| SHA1 | 123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c |
| SHA256 | 72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0 |
| SHA512 | 5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31 |
memory/4960-23-0x00000000003A0000-0x00000000003BC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI10522\VCRUNTIME140.dll
| MD5 | f12681a472b9dd04a812e16096514974 |
| SHA1 | 6fd102eb3e0b0e6eef08118d71f28702d1a9067c |
| SHA256 | d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8 |
| SHA512 | 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2 |
memory/2680-27-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI10522\base_library.zip
| MD5 | c362c2fbddaaa631b561d66002fc766d |
| SHA1 | 76bba342034f0a5a8b8625f18f131b9b9f915cdc |
| SHA256 | 679693ed217e10a8fe15a220bafbaa54914670a70ba676d9c7531c2a5aacaaeb |
| SHA512 | 7bd99e029e30ab81a4762ca3f3894e72e8be7ff577ce7a3a07bd9efc303a3f0651bff8ba9bc1c38ce507453e151e9f4801492ab0daf1bbb791b9665d582748b9 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_ctypes.pyd
| MD5 | 38fb83bd4febed211bd25e19e1cae555 |
| SHA1 | 4541df6b69d0d52687edb12a878ae2cd44f82db6 |
| SHA256 | cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65 |
| SHA512 | f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\libffi-8.dll
| MD5 | 90a6b0264a81bb8436419517c9c232fa |
| SHA1 | 17b1047158287eb6471416c5df262b50d6fe1aed |
| SHA256 | 5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79 |
| SHA512 | 1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\select.pyd
| MD5 | abf7864db4445bbbd491c8cff0410ae0 |
| SHA1 | 4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7 |
| SHA256 | ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e |
| SHA512 | 8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_ssl.pyd
| MD5 | 156b1fa2f11c73ed25f63ee20e6e4b26 |
| SHA1 | 36189a5cde36d31664acbd530575a793fc311384 |
| SHA256 | a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51 |
| SHA512 | a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca |
memory/2680-50-0x00007FFDA7D10000-0x00007FFDA7D1F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_sqlite3.pyd
| MD5 | d678600c8af1eeeaa5d8c1d668190608 |
| SHA1 | 080404040afc8b6e5206729dd2b9ee7cf2cb70bc |
| SHA256 | d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed |
| SHA512 | 8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_socket.pyd
| MD5 | 4351d7086e5221398b5b78906f4e84ac |
| SHA1 | ba515a14ec1b076a6a3eab900df57f4f37be104d |
| SHA256 | a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe |
| SHA512 | a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_queue.pyd
| MD5 | fbbbfbcdcf0a7c1611e27f4b3b71079e |
| SHA1 | 56888df9701f9faa86c03168adcd269192887b7b |
| SHA256 | 699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163 |
| SHA512 | 0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_lzma.pyd
| MD5 | 8d9e1bb65a192c8446155a723c23d4c5 |
| SHA1 | ea02b1bf175b7ef89ba092720b3daa0c11bef0f0 |
| SHA256 | 1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7 |
| SHA512 | 4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_hashlib.pyd
| MD5 | 596df8ada4b8bc4ae2c2e5bbb41a6c2e |
| SHA1 | e814c2e2e874961a18d420c49d34b03c2b87d068 |
| SHA256 | 54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec |
| SHA512 | e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_decimal.pyd
| MD5 | 7ba541defe3739a888be466c999c9787 |
| SHA1 | ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac |
| SHA256 | f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29 |
| SHA512 | 9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\_bz2.pyd
| MD5 | 0c13627f114f346604b0e8cbc03baf29 |
| SHA1 | bf77611d924df2c80aabcc3f70520d78408587a2 |
| SHA256 | df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861 |
| SHA512 | c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\unicodedata.pyd
| MD5 | bb3fca6f17c9510b6fb42101fe802e3c |
| SHA1 | cb576f3dbb95dc5420d740fd6d7109ef2da8a99d |
| SHA256 | 5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87 |
| SHA512 | 05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\sqlite3.dll
| MD5 | ddd0dd698865a11b0c5077f6dd44a9d7 |
| SHA1 | 46cd75111d2654910f776052cc30b5e1fceb5aee |
| SHA256 | a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7 |
| SHA512 | b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\libssl-1_1.dll
| MD5 | eac369b3fde5c6e8955bd0b8e31d0830 |
| SHA1 | 4bf77158c18fe3a290e44abd2ac1834675de66b4 |
| SHA256 | 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c |
| SHA512 | c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778 |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\libcrypto-1_1.dll
| MD5 | daa2eed9dceafaef826557ff8a754204 |
| SHA1 | 27d668af7015843104aa5c20ec6bbd30f673e901 |
| SHA256 | 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914 |
| SHA512 | 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea |
C:\Users\Admin\AppData\Local\Temp\_MEI10522\blank.aes
| MD5 | 968d147ea436c9ec847c0e5176be7bb6 |
| SHA1 | afd477b22dbef959af32f374226f666f0ab5ac90 |
| SHA256 | c3524dfb3681fdd3e2fa8abd64eb8e972fe0b40c9076b5a3358f30e11c05cff0 |
| SHA512 | 14935455925a293a2a4684de942807983683eb245674c7bc54669bd005e33ba287af6b3fc09d413c7040f7b247fb2f2fcf1c3e36bdba1852c6c471e32023afd4 |
memory/2680-32-0x00007FFD9F270000-0x00007FFD9F294000-memory.dmp
memory/2680-56-0x00007FFD9E950000-0x00007FFD9E97D000-memory.dmp
memory/2680-58-0x00007FFDA2DD0000-0x00007FFDA2DE9000-memory.dmp
memory/2680-62-0x00007FFD894C0000-0x00007FFD89633000-memory.dmp
memory/2680-61-0x00007FFD9E7A0000-0x00007FFD9E7C3000-memory.dmp
memory/2680-64-0x00007FFD9F690000-0x00007FFD9F6A9000-memory.dmp
memory/2680-66-0x00007FFDA35D0000-0x00007FFDA35DD000-memory.dmp
memory/2680-70-0x00007FFD89400000-0x00007FFD894B8000-memory.dmp
memory/2680-69-0x00007FFD9E5F0000-0x00007FFD9E61E000-memory.dmp
memory/2680-74-0x00007FFD89080000-0x00007FFD893F5000-memory.dmp
memory/2680-75-0x000001A5B8210000-0x000001A5B8585000-memory.dmp
memory/2680-73-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
memory/2680-78-0x00007FFD9E710000-0x00007FFD9E724000-memory.dmp
memory/2680-77-0x00007FFD9F270000-0x00007FFD9F294000-memory.dmp
memory/2680-80-0x00007FFD9F3D0000-0x00007FFD9F3DD000-memory.dmp
memory/2680-82-0x00007FFD88F60000-0x00007FFD8907C000-memory.dmp
memory/4116-88-0x00000263C3EA0000-0x00000263C3EC2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hfr11hw0.chz.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4116-103-0x00000263C4030000-0x00000263C417F000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 627073ee3ca9676911bee35548eff2b8 |
| SHA1 | 4c4b68c65e2cab9864b51167d710aa29ebdcff2e |
| SHA256 | 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c |
| SHA512 | 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb |
memory/3528-107-0x00000189C32C0000-0x00000189C340F000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | e3840d9bcedfe7017e49ee5d05bd1c46 |
| SHA1 | 272620fb2605bd196df471d62db4b2d280a363c6 |
| SHA256 | 3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f |
| SHA512 | 76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376 |
memory/2680-108-0x00007FFDA2DD0000-0x00007FFDA2DE9000-memory.dmp
memory/2680-109-0x00007FFD9E7A0000-0x00007FFD9E7C3000-memory.dmp
memory/2680-135-0x00007FFD894C0000-0x00007FFD89633000-memory.dmp
memory/1884-136-0x00007FFD88970000-0x00007FFD88F58000-memory.dmp
memory/1884-144-0x00007FFD97D80000-0x00007FFD97D8F000-memory.dmp
memory/1884-143-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
memory/2680-142-0x00007FFD9F690000-0x00007FFD9F6A9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI4802\blank.aes
| MD5 | 3b528ab27d7bc3453f1b15d24df68c31 |
| SHA1 | 149de1710b7fff69509819cd24ff418c7af7928e |
| SHA256 | 40e7127143493fe5dfde4bfaacec43ce8344897d452e91a3caae4abd0bc006ad |
| SHA512 | 54f2ba413ad6025c6ab575770b290fc6269f7746ad3987c5f9a09ff85dca4f6e9fedd2535a572c7e06ff9861125dce66f1db1438e718251e6ac0ed3c5d51845d |
memory/2680-166-0x00007FFD89400000-0x00007FFD894B8000-memory.dmp
memory/2680-165-0x00007FFD9E5F0000-0x00007FFD9E61E000-memory.dmp
memory/1884-164-0x00007FFD8D960000-0x00007FFD8D98D000-memory.dmp
memory/1884-167-0x00007FFD8D940000-0x00007FFD8D959000-memory.dmp
memory/1884-168-0x00007FFD887C0000-0x00007FFD88933000-memory.dmp
memory/2680-171-0x000001A5B8210000-0x000001A5B8585000-memory.dmp
memory/1884-170-0x00007FFD88940000-0x00007FFD88963000-memory.dmp
memory/2680-169-0x00007FFD89080000-0x00007FFD893F5000-memory.dmp
memory/1884-173-0x00007FFD942A0000-0x00007FFD942AD000-memory.dmp
memory/1884-172-0x00007FFD887A0000-0x00007FFD887B9000-memory.dmp
memory/1884-178-0x000001F47D470000-0x000001F47D7E5000-memory.dmp
memory/1884-177-0x00007FFD88330000-0x00007FFD886A5000-memory.dmp
memory/1884-176-0x00007FFD886B0000-0x00007FFD88768000-memory.dmp
memory/1884-175-0x00007FFD88770000-0x00007FFD8879E000-memory.dmp
memory/2680-174-0x00007FFD9F3D0000-0x00007FFD9F3DD000-memory.dmp
memory/1884-180-0x00007FFD88310000-0x00007FFD88324000-memory.dmp
memory/2680-179-0x00007FFD88F60000-0x00007FFD8907C000-memory.dmp
memory/1884-196-0x00007FFD88940000-0x00007FFD88963000-memory.dmp
memory/1884-200-0x00007FFD8D960000-0x00007FFD8D98D000-memory.dmp
memory/1884-201-0x00007FFD88970000-0x00007FFD88F58000-memory.dmp
memory/1884-199-0x00007FFD97D80000-0x00007FFD97D8F000-memory.dmp
memory/1884-198-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
memory/1884-197-0x00007FFD8D940000-0x00007FFD8D959000-memory.dmp
memory/1884-193-0x00007FFD88330000-0x00007FFD886A5000-memory.dmp
memory/1884-191-0x00007FFD88770000-0x00007FFD8879E000-memory.dmp
memory/1884-188-0x00007FFD887C0000-0x00007FFD88933000-memory.dmp
memory/1884-194-0x00007FFD88310000-0x00007FFD88324000-memory.dmp
memory/1884-192-0x00007FFD886B0000-0x00007FFD88768000-memory.dmp
memory/1884-190-0x00007FFD942A0000-0x00007FFD942AD000-memory.dmp
memory/1884-189-0x00007FFD887A0000-0x00007FFD887B9000-memory.dmp
memory/1884-182-0x00007FFD93880000-0x00007FFD9388D000-memory.dmp
memory/2680-203-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp
memory/2680-204-0x00007FFD9F270000-0x00007FFD9F294000-memory.dmp
memory/3324-227-0x000001E069350000-0x000001E06949F000-memory.dmp
memory/468-257-0x00007FFD86F10000-0x00007FFD874F8000-memory.dmp
memory/4712-259-0x000001B6C86F0000-0x000001B6C883F000-memory.dmp
memory/468-261-0x00007FFD9E230000-0x00007FFD9E23F000-memory.dmp
memory/468-260-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
memory/468-276-0x00007FFD87D40000-0x00007FFD87D63000-memory.dmp
memory/468-275-0x00007FFD87D70000-0x00007FFD87D89000-memory.dmp
memory/468-274-0x00007FFD87D90000-0x00007FFD87DBD000-memory.dmp
memory/468-277-0x00007FFD87990000-0x00007FFD87B03000-memory.dmp
memory/468-282-0x00007FFD8D940000-0x00007FFD8D96E000-memory.dmp
memory/468-281-0x00007FFD9E220000-0x00007FFD9E22D000-memory.dmp
memory/468-280-0x00007FFD8D970000-0x00007FFD8D989000-memory.dmp
memory/1812-279-0x000001B81CE70000-0x000001B81CFBF000-memory.dmp
memory/468-284-0x00007FFD88B20000-0x00007FFD88BD8000-memory.dmp
memory/468-283-0x00007FFD88BE0000-0x00007FFD88F55000-memory.dmp
memory/468-298-0x00007FFD88B20000-0x00007FFD88BD8000-memory.dmp
memory/468-311-0x00007FFD88BE0000-0x00007FFD88F55000-memory.dmp
memory/468-310-0x00007FFD8D940000-0x00007FFD8D96E000-memory.dmp
memory/468-309-0x00007FFD9E220000-0x00007FFD9E22D000-memory.dmp
memory/468-308-0x00007FFD8D970000-0x00007FFD8D989000-memory.dmp
memory/468-307-0x00007FFD87990000-0x00007FFD87B03000-memory.dmp
memory/468-306-0x00007FFD87D40000-0x00007FFD87D63000-memory.dmp
memory/468-305-0x00007FFD87D70000-0x00007FFD87D89000-memory.dmp
memory/468-304-0x00007FFD87D90000-0x00007FFD87DBD000-memory.dmp
memory/468-303-0x00007FFD9E230000-0x00007FFD9E23F000-memory.dmp
memory/468-302-0x00007FFD8DD60000-0x00007FFD8DD84000-memory.dmp
memory/468-301-0x00007FFD86F10000-0x00007FFD874F8000-memory.dmp
memory/468-286-0x00007FFD97D80000-0x00007FFD97D8D000-memory.dmp
memory/468-285-0x00007FFD88A30000-0x00007FFD88A44000-memory.dmp
memory/1840-321-0x000002401C720000-0x000002401C86F000-memory.dmp
memory/2680-326-0x00007FFD89640000-0x00007FFD89C28000-memory.dmp