Malware Analysis Report

2025-06-16 00:54

Sample ID 241031-qxscdaxpat
Target Image-LoggerV3.zip
SHA256 b0cd9ab51c869d22fda1470ac6ec64283ff99c21077c08f999c8cf0f0cf7ab0a
Tags
upx collection credential_access discovery execution persistence privilege_escalation spyware stealer blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b0cd9ab51c869d22fda1470ac6ec64283ff99c21077c08f999c8cf0f0cf7ab0a

Threat Level: Known bad

The file Image-LoggerV3.zip was found to be: Known bad.

Malicious Activity Summary

upx collection credential_access discovery execution persistence privilege_escalation spyware stealer blankgrabber

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Clipboard Data

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Enumerates processes with tasklist

UPX packed file

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Enumerates physical storage devices

System Network Configuration Discovery: Wi-Fi Discovery

Detects videocard installed

Gathers system information

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 13:38

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 13:38

Reported

2024-10-31 13:41

Platform

win7-20241023-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe

"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"

C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe

"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI26042\python311.dll

MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

memory/2096-23-0x000007FEF59E0000-0x000007FEF5FC9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 13:38

Reported

2024-10-31 13:41

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe
PID 216 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe
PID 732 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 2844 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 732 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 2132 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2132 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4908 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4908 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 732 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 1580 wrote to memory of 3896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1580 wrote to memory of 3896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 732 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 2472 wrote to memory of 1084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2472 wrote to memory of 1084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3064 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3064 wrote to memory of 3772 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3996 wrote to memory of 1460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3996 wrote to memory of 1460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1500 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 1500 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4196 wrote to memory of 3740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4196 wrote to memory of 3740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1032 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1032 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4156 wrote to memory of 4524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4156 wrote to memory of 4524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 732 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 3512 wrote to memory of 3948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 3512 wrote to memory of 3948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 3376 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3376 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 732 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe
PID 732 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe
PID 4460 wrote to memory of 632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4460 wrote to memory of 632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 388 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 388 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 732 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe
PID 732 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe

"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"

C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe

"C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Image-LoggerV3\Image Logger.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"Nesa2011\" "C:\Users\Admin\AppData\Local\Temp\X0R3T.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"Nesa2011\" "C:\Users\Admin\AppData\Local\Temp\X0R3T.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.204.67:443 gstatic.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI2162\python311.dll

MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

C:\Users\Admin\AppData\Local\Temp\_MEI2162\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

memory/732-25-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI2162\base_library.zip

MD5 bf6cd99ec3d2a7bc939a8f3d14121641
SHA1 ca8eafb77077e23fb23a45784ea17b19e93c99bc
SHA256 01be805110393abf9f1c57084dc026cdbc7135a4081f604579e3bf8f1dd23bd5
SHA512 e74f6dfbb0d7b56d4201339cca3896bef9af652e1cd031207a683b490433f1de82d0557d5d551db4c656d5f503639d16fb27cda30dff21b1399bd8bd339d3ec8

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ctypes.pyd

MD5 00f75daaa7f8a897f2a330e00fad78ac
SHA1 44aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA256 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
SHA512 f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

memory/732-30-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI2162\libssl-3.dll

MD5 bf4a722ae2eae985bacc9d2117d90a6f
SHA1 3e29de32176d695d49c6b227ffd19b54abb521ef
SHA256 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
SHA512 dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ssl.pyd

MD5 f9cc7385b4617df1ddf030f594f37323
SHA1 ebceec12e43bee669f586919a928a1fd93e23a97
SHA256 b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
SHA512 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_sqlite3.pyd

MD5 1a8fdc36f7138edcc84ee506c5ec9b92
SHA1 e5e2da357fe50a0927300e05c26a75267429db28
SHA256 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
SHA512 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_socket.pyd

MD5 1a34253aa7c77f9534561dc66ac5cf49
SHA1 fcd5e952f8038a16da6c3092183188d997e32fb9
SHA256 dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
SHA512 ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_queue.pyd

MD5 347d6a8c2d48003301032546c140c145
SHA1 1a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA256 e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
SHA512 b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_lzma.pyd

MD5 542eab18252d569c8abef7c58d303547
SHA1 05eff580466553f4687ae43acba8db3757c08151
SHA256 d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
SHA512 b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_hashlib.pyd

MD5 b227bf5d9fec25e2b36d416ccd943ca3
SHA1 4fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA256 d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
SHA512 c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_decimal.pyd

MD5 e3fb8bf23d857b1eb860923ccc47baa5
SHA1 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0
SHA256 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3
SHA512 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

C:\Users\Admin\AppData\Local\Temp\_MEI2162\_bz2.pyd

MD5 c413931b63def8c71374d7826fbf3ab4
SHA1 8b93087be080734db3399dc415cc5c875de857e2
SHA256 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
SHA512 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

C:\Users\Admin\AppData\Local\Temp\_MEI2162\unicodedata.pyd

MD5 8c42fcc013a1820f82667188e77be22d
SHA1 fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA256 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
SHA512 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

C:\Users\Admin\AppData\Local\Temp\_MEI2162\sqlite3.dll

MD5 dbc64142944210671cca9d449dab62e6
SHA1 a2a2098b04b1205ba221244be43b88d90688334c
SHA256 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
SHA512 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

C:\Users\Admin\AppData\Local\Temp\_MEI2162\select.pyd

MD5 45d5a749e3cd3c2de26a855b582373f6
SHA1 90bb8ac4495f239c07ec2090b935628a320b31fc
SHA256 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
SHA512 c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

memory/732-32-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI2162\libcrypto-3.dll

MD5 78ebd9cb6709d939e4e0f2a6bbb80da9
SHA1 ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA256 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
SHA512 b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

C:\Users\Admin\AppData\Local\Temp\_MEI2162\blank.aes

MD5 68cbfbcb6872d7f0777dd8917992976b
SHA1 3819e68ced45763dfb916fb31e66343c9729dc57
SHA256 7c1cd0acea0b678e8072d4a33f1fe02568f43b9ebf77f19bce219baaa3c9c74b
SHA512 497e44b46a7b3f142c50ef462553b2fe029a3564a9614985cce868c447582f96019f233473f9fecc1e99a9a6244688fb7ce89114ff7b0f51517381fe29b9f5f6

C:\Users\Admin\AppData\Local\Temp\_MEI2162\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/732-54-0x00007FFBBB770000-0x00007FFBBB79D000-memory.dmp

memory/732-56-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp

memory/732-58-0x00007FFBBB740000-0x00007FFBBB763000-memory.dmp

memory/732-60-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp

memory/732-62-0x00007FFBBB630000-0x00007FFBBB649000-memory.dmp

memory/732-64-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp

memory/732-66-0x00007FFBBB310000-0x00007FFBBB343000-memory.dmp

memory/732-70-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp

memory/732-71-0x00007FFBBB240000-0x00007FFBBB30D000-memory.dmp

memory/732-72-0x00007FFBAB960000-0x00007FFBABE80000-memory.dmp

memory/732-74-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp

memory/732-73-0x000002BCF4F10000-0x000002BCF5430000-memory.dmp

memory/732-78-0x00007FFBBC040000-0x00007FFBBC04D000-memory.dmp

memory/732-81-0x00007FFBAC280000-0x00007FFBAC39C000-memory.dmp

memory/732-80-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp

memory/732-77-0x00007FFBBB610000-0x00007FFBBB624000-memory.dmp

memory/732-82-0x00007FFBBB740000-0x00007FFBBB763000-memory.dmp

memory/732-84-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp

memory/2056-83-0x00007FFBAAE93000-0x00007FFBAAE95000-memory.dmp

memory/2056-85-0x00007FFBAAE90000-0x00007FFBAB951000-memory.dmp

memory/2056-86-0x00007FFBAAE90000-0x00007FFBAB951000-memory.dmp

memory/732-87-0x00007FFBBB630000-0x00007FFBBB649000-memory.dmp

memory/2056-97-0x00000297D2750000-0x00000297D2772000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mcgkwyen.cw5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/732-168-0x00007FFBBB310000-0x00007FFBBB343000-memory.dmp

memory/732-169-0x00007FFBAB960000-0x00007FFBABE80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/732-176-0x00007FFBBB240000-0x00007FFBBB30D000-memory.dmp

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

memory/2056-186-0x00007FFBAAE90000-0x00007FFBAB951000-memory.dmp

memory/732-203-0x000002BCF4F10000-0x000002BCF5430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\ExpandWrite.doc

MD5 ab11a05e0499d42e70c165ab7c1f4b42
SHA1 8867dcd0e599ec6d69ac1e317b8d0be501079bb7
SHA256 ce3fd353ff9d58a84629f187c0514585d5b42531da79c49adf0ae59bb50a3cb4
SHA512 d2d406fa09e2ce675d4bacc916365ca4ae26d6dae2517fdb67bcd4363fca793bf5750dca8644f43dd2d5767dea6e36b15d8550842991ed3eae79b7ca2d3e4e9a

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\JoinInstall.docx

MD5 862001d2e5e454427aace57f9bcf2e52
SHA1 ca38963340510a646525d4b41c65d2af058725ec
SHA256 7662ef15e41e04d56c0d247f48554426667c4110172ea2d132fdd58612b5b21e
SHA512 479680e1f862f77f621a09749c0c74bcc0c6de6e3ceb15f05a3bda3ae41138d9c61b12f8a430cba76f0a6ad6586156f2798b501aabd11c747c8a0ca781c91d28

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\OutPublish.xlsx

MD5 f66e8359868783dbd51a118c217aa333
SHA1 053f82e611e9f75755ac77c56f6371f7c6cd63e8
SHA256 144cd5f9701faa1c77af13332546d1ae58d731c686ea0ff706f1f8cff3af7b1b
SHA512 d6320cb892c633ba2dd33a2e4c75af433897b098e52d049069f218a06d4b018afc6f6db748d8100686a2e89038e30bce10454ae48c058a2a317fedc1f0e12684

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\OpenRedo.docx

MD5 1cf9b5fe028704d85616ab4b1d9ce0b7
SHA1 f02a9e396b1db75962ad5c70777ed3e32d82dd98
SHA256 80650cf9d49188c80180fbafc1311dde06a7307368845199b854dba4c40736d2
SHA512 aff6fdd1ad1dcf486e3d9d4d8d3a97ec861caacce3061b3cb6148da52d6a3e64722afb11bf64f71df7aa6a67ae073a233d169e784dbaa33a5b9220e2289f65c8

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\RestoreUnpublish.xlsx

MD5 76d4ed319d100c1e44141fcead9541b4
SHA1 78482692b275526778e590b599be984dfca97b18
SHA256 71c48cc0de74a2f1eb586ebddb4e03af7d77981944f45aaf0ea89fc109308d3e
SHA512 641c5ae4a9a30c8a9175ae5e351e52f2ecf0dac242b9984cf5dcb831980ec4cc487dd2da218450f88b03c8c967cfec65f9c4eb5bdb795c8fb4ee628ceda2c55d

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\SkipGroup.jpeg

MD5 653b0afdaefbb9ce3615169655573088
SHA1 d8a2e50d8076a2cb6c22067ae9abd0b6c49bfba7
SHA256 591b4c88d7898a9e24cd9114046070a5250ac8bde8b70d62251ad0c90ffd8534
SHA512 0bfb7f7749d9aec9afd2f9001fb711fde2817edf90c4321d5fb82f58f6305ad85052523da7cc591ba784612b539de269a7aa580a5cfeff58bfa347699718a424

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\UseCompare.jpg

MD5 183579439868f97b6e5464ec8298acec
SHA1 2cc52c64817b401b256dba5b587ff794244182b3
SHA256 37c2bbf0686ae41cd4fc00d575823e740d06ad7604a3451eb768ac3847ac0f13
SHA512 1afdcc3b94deca2008e08e15b8861e436bce198e09bb77d95967406b7068ae47c329f02494593174aa98a34fcd98d4df72ba181adf1fdd9988e112a25092327e

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\AddResolve.xlsx

MD5 a47cdf894d5f28d6adc3e78407f6a53f
SHA1 3b477c676dac77c39ecb8f5125d41f42f8d356bf
SHA256 9ccf6b36bfd4e13e53b8fda3456b8dd8c7f3384fa98b5c3ba9757413264f6ab2
SHA512 b9812b169e918faae3a6470164bec3f200f852c7862c1810287f3fb7f555af87ceb345027c03a8fff6c2b3fe6b9c9bc5340f9210d8bb613164a3adb28883b50a

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\CopyTrace.xlsx

MD5 f2f118ee490d0e9af557ccb6baa040a3
SHA1 502396d77ed6f0025961353614e413e7b610d7db
SHA256 d58aede43f6d187373a2a36c2c90d87c0cc55f44f8b40e7ffb9a3d6a260593ae
SHA512 70e22b94afea97d66b8f941ce3f37d3eb056fa17e67396742d768c7ad00835f13a6a681715d04b43ac5f72d323e231ee80f51398cefcce29c786f1a5523999a8

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\InitializeResolve.docx

MD5 7d3d9ba30e55a3ddb9586d5f8d807838
SHA1 53130eec723ff695fa074c3ffb49cddcfec18546
SHA256 c459b92c91cb5086ce5287b36796c08290c3f6466c64cffc55af5f08244b226d
SHA512 04d088440a363aeffd5d4cfb6f36f80c440fc96a428f4b72a1aa91a53c177a88625544386dd419e9c37b83d99349da2651d1799567bb35250e2246186b43a256

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\OpenTest.docx

MD5 782c581e1ca731288f7c95a375cb0a22
SHA1 f0510cd26e4a7f5fa8fe35d3a09a2bc051d863bb
SHA256 0339b5a1a717125e1507ace2bf6b7558faf3ce3add3119b79bcb782ef2401466
SHA512 3abdd1fd8b4e7945c64204a317ea45a0699ecfc682ddb83e15cb38012b45192c413184878836aaf18b1eb0de5078a97ef0108c5a75cd49919c634e9bd364bc03

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\RestoreGrant.txt

MD5 b9359c020a4619caf671ae56e4128440
SHA1 fcbe6a200c44987321d3b85ee2ad0230d77e7407
SHA256 de5f17d180953e919bf2859e5ef68a185f94e0773a399ae3bc9af044bef84e73
SHA512 67b4f61a1f085d0d32926d8f54494845494bc7cb0c099eef1f9dfff8393ecb27f467744fcc6ab771942d3b6583bfdf6547ee141a2e35348d632468235414e163

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\RepairPop.xlsx

MD5 c7574dfefa707a607da32f26952098c7
SHA1 f1ab061aec0b5dcd7c75f90742ea902382268e13
SHA256 de9c5710062b5ba3fb89030a53bc48a52f9de197644cccfb14c316ecae99be52
SHA512 25e22d6e8e7e64ee179332002a1ac8321d634f2d5ab4c7e8743e7444ebf42ad77e9816856d52139067e95e36efb5b374eeec51f229c93f7e56c96b719071d67c

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\SaveProtect.xlsx

MD5 01a232a1f01bf8050e0cfa82d45dbd19
SHA1 798ed36910268b0497dc5a8555968e6139e4f2a8
SHA256 9cd6ebc2212ccc78c0be4fd60692d4b138753f36e5849eea2fb3d8709ac84363
SHA512 c6df02b01813b080202eca9445395e6e5b30c9d1d75493d33941c7127ef526f8b2e7e1fe9fe4165b9fb17c1fe820e2125bd603b484877c226d080dd3d678b515

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\SwitchGroup.xlsx

MD5 f7e7ac09f81319ff34f19ad80e79c4fd
SHA1 0a9a1190617862783bd6b13a16e45de65ba1ef1a
SHA256 5c66a216392d68e6f1d0b8e109750212cd7ef081097b5169b228cc6b8d58172d
SHA512 2dd54f0b918ba0f549ac6e06e1469fc2de4ac62fd991250984731533553e927d3ead804fc168d2149f8fbc8bf3f588ce4cde4bb766dd87c63326d5835771eef9

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\SwitchRequest.docx

MD5 9560f9b0a87b71e593f3da92bc3a7788
SHA1 3e3a03d52a4f798e9fb3e4114059365857af2262
SHA256 bf3e92e3a8762c1fbc7b354e38c3e4f92644fbb1aa5c3911625318465df631c7
SHA512 f956e07e73999cd7763572aed3fa9d5a63e9f52c8f39056713c8e4ff6f69453664ff8451b6bfe6eb7f992071d7665d26b0b0b138d3b2f2713059b6f2a96e64ac

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Downloads\BackupSubmit.lnk

MD5 66d2b2627737c50f04b3196b1ceb302a
SHA1 494c720d5a6d9c6978a7dffc6e4e2baed4369525
SHA256 15fdaa880605f21c2e7a7ca6a7158cb0dab86690a114ccc3fe189879ce403c4a
SHA512 90a58c51ea11e92a68e57df68b66b51e253e126ac4fe5743689d59bf51c5ae93700e07dfd377c479072694c1478b8342a59aaf21a4ef3acac26142b819176816

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Downloads\ConfirmResolve.mp4

MD5 df6dde1cfb36dce1efa0f5fe5c2990f3
SHA1 554feb79c847ad5a88f4c4a20bd79f0d4acbe81b
SHA256 3576fec9968b5cc3561b00d97e4f3e71bd0bc0f6fbb4b46433f09cb0df2d1014
SHA512 2cb1b0449e4f004d7bba96a4f68804d844dcc41bcfe0fa4ce0e763907bd4fd0bc0018ad4a726db78b97ec4945d2a0bc7920dde268fa74caf5f59a2d2a1102681

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Downloads\LimitCopy.mp3

MD5 8fdb897adfce8204f5773c2a141ecf44
SHA1 f9837e9a9afff1f67c9696d88987cd242fab0611
SHA256 736c86e65c70bff97cea260409445076c667d60f25bb06841a23d7bb8453553f
SHA512 6b72bf37c812867cdb4ad55de86487e09d30eee0cd7db1e252265ddccdcd7c067d24291e605d76c364fb0eecd55eea4e0acb6161bfde854564bfc7bba7718f15

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Music\JoinBackup.m4a

MD5 586fbdeb470ed0fbc7943e8ae9efe4e4
SHA1 381b8de2e5c138a68cbb73df473051204aab3ec2
SHA256 e02897affc5aef994580665e88eaaa21384d68feddbb2967f150592e0480309a
SHA512 df2143a408b508a9c5695770efb57626d49c38d0e04abc794f309a2a13d15ec1604ebda3ba6487532de7f6240699d3b1b88f7b4c0817fe9ed3d27acda99d6313

C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Music\WriteUnpublish.txt

MD5 9832c2ea8a34b6459d912b5edce48a12
SHA1 2c2270913de7d1042f6fba9e51a7c0fdb708144e
SHA256 efe52f280b59d799a327f17992242946a50291de98fb20434804c9c40c1d8e7e
SHA512 0f4f853d709eb5ee69f7891837db0578db78a26b0becbface7148d32f8e7a4bcff68f595e268b06e369acd4634bf18761e3f80e4bbe1d9c78c750ab59a87b5c7

memory/732-253-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp

memory/732-247-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp

memory/732-246-0x00007FFBAC280000-0x00007FFBAC39C000-memory.dmp

memory/732-248-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp

memory/732-283-0x00007FFBACA40000-0x00007FFBAD029000-memory.dmp

memory/732-297-0x00007FFBAC280000-0x00007FFBAC39C000-memory.dmp

memory/732-294-0x00007FFBAB960000-0x00007FFBABE80000-memory.dmp

memory/732-289-0x00007FFBAC470000-0x00007FFBAC5E7000-memory.dmp

memory/732-308-0x00007FFBBB610000-0x00007FFBBB624000-memory.dmp

memory/732-307-0x00007FFBBB240000-0x00007FFBBB30D000-memory.dmp

memory/732-306-0x00007FFBBB310000-0x00007FFBBB343000-memory.dmp

memory/732-305-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp

memory/732-304-0x00007FFBBB630000-0x00007FFBBB649000-memory.dmp

memory/732-303-0x00007FFBBC040000-0x00007FFBBC04D000-memory.dmp

memory/732-302-0x00007FFBBB740000-0x00007FFBBB763000-memory.dmp

memory/732-301-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp

memory/732-300-0x00007FFBBB770000-0x00007FFBBB79D000-memory.dmp

memory/732-299-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp

memory/732-298-0x00007FFBBF510000-0x00007FFBBF533000-memory.dmp