Malware Analysis Report

2025-06-16 00:54

Sample ID 241031-sjlzjssjfk
Target mintPepper.exe
SHA256 9fb75c6b2633bb2aaf1d25e0ee82ba157bb3d9c2c18ec47e08bcd8d39d3f89ea
Tags
credential_access discovery ransomware spyware stealer pyinstaller
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

9fb75c6b2633bb2aaf1d25e0ee82ba157bb3d9c2c18ec47e08bcd8d39d3f89ea

Threat Level: Likely malicious

The file mintPepper.exe was found to be: Likely malicious.

Malicious Activity Summary

credential_access discovery ransomware spyware stealer pyinstaller

Renames multiple (14779) files with added filename extension

Loads dropped DLL

Credentials from Password Stores: Windows Credential Manager

Drops startup file

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Detects Pyinstaller

Browser Information Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 15:09

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 15:09

Reported

2024-10-31 15:14

Platform

win7-20240708-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mintPepper.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\mintPepper.exe

"C:\Users\Admin\AppData\Local\Temp\mintPepper.exe"

C:\Users\Admin\AppData\Local\Temp\mintPepper.exe

"C:\Users\Admin\AppData\Local\Temp\mintPepper.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI26402\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

C:\Users\Admin\AppData\Local\Temp\_MEI26402\api-ms-win-core-localization-l1-2-0.dll

MD5 de5695f26a0bcb54f59a8bc3f9a4ecef
SHA1 99c32595f3edc2c58bdb138c3384194831e901d6
SHA256 e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a
SHA512 df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

C:\Users\Admin\AppData\Local\Temp\_MEI26402\api-ms-win-core-processthreads-l1-1-1.dll

MD5 74c264cffc09d183fcb1555b16ea7e4b
SHA1 0b5b08cdf6e749b48254ac811ca09ba95473d47c
SHA256 a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09
SHA512 285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

C:\Users\Admin\AppData\Local\Temp\_MEI26402\api-ms-win-core-file-l1-2-0.dll

MD5 d92e6a007fc22a1e218552ebfb65da93
SHA1 3c9909332e94f7b7386664a90f52730f4027a75a
SHA256 03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862
SHA512 b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

C:\Users\Admin\AppData\Local\Temp\_MEI26402\api-ms-win-core-timezone-l1-1-0.dll

MD5 cb39eea2ef9ed3674c597d5f0667b5b4
SHA1 c133dc6416b3346fa5b0f449d7cc6f7dbf580432
SHA256 1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235
SHA512 2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

C:\Users\Admin\AppData\Local\Temp\_MEI26402\python312.dll

MD5 b243d61f4248909bc721674d70a633de
SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb

\Users\Admin\AppData\Local\Temp\_MEI26402\api-ms-win-core-file-l2-1-0.dll

MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 15:09

Reported

2024-10-31 15:14

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mintPepper.exe"

Signatures

Renames multiple (14779) files with added filename extension

ransomware

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Media\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\NewNotePlaceholder-light.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_SmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\WideTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MediumTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\clrcompression.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.schema.mfl C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-private-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\notifications_emptystate_v3.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.Effects.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_contrast-white.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldExist.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Opacity.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\mozavutil.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\adal.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\Example2.Diagnostics.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageProviderFunctions.psm1 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Medium.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\INF\bthprint.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.resx C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Messaging.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Messaging.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\diagnostics\system\Audio\TS_DisabledInCPL.ps1 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Globalization\ELS\SpellDictionaries\MsSp7fr.acl C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\INF\PERFLIB\0407\perfc.dat C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\diagnostics\system\Device\TS_NotWorkingProperly.ps1 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\System.Messaging.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\INF\c_volume.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\JSByteCodeWin.bin C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\1041\cscompui.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\diagnostics\system\Apps\ja-JP\DiagPackage.dll.mui C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\INF\eaphost.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\system.data.sqlxml.resources\v4.0_4.0.0.0_it_b77a5c561934e089\system.data.sqlxml.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Fonts\j8514fix.fon C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\wide.Gaming.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\INF\rspndr.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.Common.Tasks C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ISymWrapper.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Configuration.Install.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Fonts\courfr.fon C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\shfusion.chm C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\INF\hiddigi.PNF C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\INF\usbhub3.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\System.Deployment.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\Microsoft.Build.Tasks.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Boot\EFI\sv-SE\memtest.efi.mui C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Cursors\pin_im.cur C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\diagnostics\system\Power\ja-JP\RS_Adjustwirelessadaptersettings.psd1 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\Microsoft.VisualBasic.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\napinit.resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\napinit.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\System.Web.Services.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\WsatConfig.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.Resources\3.5.0.0_fr_31bf3856ad364e35\System.ComponentModel.DataAnnotations.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Fonts\vgaoem.fon C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W193497eb#\07d0fee6b2ba31e14624c84d372674bd\Microsoft.WSMan.Runtime.ni.dll.aux C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\wide.DefaultPinTile.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.Resources\v4.0_1.0.0.0_it_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Net.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\9761aa02e459394769888f74d97b844c\Microsoft.InternationalSettings.Commands.ni.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\Contact.png C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W79a81d80#\66c9c4b757a6c6e5c7c2a2d7a860f698\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll.aux C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\diagnostics\system\PCW\RS_ProgramCompatibilityWizard.ps1 C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Installer\22d5.msi C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1031\mscoreeis.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.Resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\INF\printqueue.inf C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardProviderInfo.ascx.de.resx C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Help\mui\0411\odbcinst.chm C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\Media\Windows Logoff Sound.wav C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.de.resx C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A

Browser Information Discovery

discovery

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe C:\Users\Admin\AppData\Local\Temp\mintPepper.exe
PID 2188 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\mintPepper.exe C:\Users\Admin\AppData\Local\Temp\mintPepper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mintPepper.exe

"C:\Users\Admin\AppData\Local\Temp\mintPepper.exe"

C:\Users\Admin\AppData\Local\Temp\mintPepper.exe

"C:\Users\Admin\AppData\Local\Temp\mintPepper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 90.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI21882\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

C:\Users\Admin\AppData\Local\Temp\_MEI21882\python312.dll

MD5 b243d61f4248909bc721674d70a633de
SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb

C:\Users\Admin\AppData\Local\Temp\_MEI21882\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

C:\Users\Admin\AppData\Local\Temp\_MEI21882\python3.DLL

MD5 2e2bb725b92a3d30b1e42cc43275bb7b
SHA1 83af34fb6bbb3e24ff309e3ebc637dd3875592a5
SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
SHA512 e4a500287f7888b1935df40fd0d0f303b82cbcf0d5621592805f3bb507e8ee8de6b51ba2612500838d653566fad18a04f76322c3ab405ce2fdbbefb5ab89069e

C:\Users\Admin\AppData\Local\Temp\_MEI21882\_ctypes.pyd

MD5 302ddf5f83b5887ab9c4b8cc4e40b7a6
SHA1 0aa06af65d072eb835c8d714d0f0733dc2f47e20
SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
SHA512 5ddc2488fa192d8b662771c698a63faaf109862c8a4dd0df10fb113aef839d012df58346a87178aff9a1b369f82d8ae7819cef4aad542d8bd3f91327feace596

C:\Users\Admin\AppData\Local\Temp\_MEI21882\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-convert-l1-1-0.dll

MD5 0e35e369165875d3a593d68324e2b162
SHA1 6a1ff3405277250a892b79faed01dcdc9dbf864a
SHA256 14694879f9c3c52fbd7dde96bf5d67b9768b067c80d5567be55b37262e9dbd54
SHA512 d496f0c38300d0eed62b26a59c57463a1444a0c77a75c463014c5791371deca93d1d5dd0090e8e324c6a09bd9cff328f94947272ca49018c191c12732e805ee8

C:\Users\Admin\AppData\Local\Temp\_MEI21882\_decimal.pyd

MD5 82321fb8245333842e1c31f874329170
SHA1 81abb1d3d5c55db53e8aca9bdf74f2dec0aba1a3
SHA256 b7f9603f98ef232a2c5bce7001d842c01d76ed35171afbd898e6d17facf38b56
SHA512 0cf932ee0d1242ea9377d054adcd71fdd7ec335abbac865e82987e3979e24cead6939cca19da63a08e08ac64face16950edce7918e02bfc7710f09645fd2fa19

C:\Users\Admin\AppData\Local\Temp\_MEI21882\_hashlib.pyd

MD5 0abfee1db6c16e8ddaff12cd3e86475b
SHA1 b2dda9635ede4f2841912cc50cb3ae67eea89fe7
SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
SHA512 0a5cae4e3442af1d62b65e8bf91e0f2a61563c2b971bbf008bfb2de0f038ee472e7bfcc88663dc503b2712e92e6a7e6a5f518ddab1fab2eb435d387b740d2d44

C:\Users\Admin\AppData\Local\Temp\_MEI21882\_cffi_backend.cp312-win_amd64.pyd

MD5 fcb71ce882f99ec085d5875e1228bdc1
SHA1 763d9afa909c15fea8e016d321f32856ec722094
SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
SHA512 4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

C:\Users\Admin\AppData\Local\Temp\_MEI21882\_bz2.pyd

MD5 fe499b0a9f7f361fa705e7c81e1011fa
SHA1 cc1c98754c6dab53f5831b05b4df6635ad3f856d
SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
SHA512 60520c5eb5ccc72ae2a4c0f06c8447d9e9922c5f9f1f195757362fc47651adcc1cdbfef193ae4fec7d7c1a47cf1d9756bd820be996ae145f0fbbbfba327c5742

C:\Users\Admin\AppData\Local\Temp\_MEI21882\zlib1.dll

MD5 2849986dadc875a7a92889eced861a36
SHA1 c723d5e55deb07699f2fc83999b07bd9dab1182e
SHA256 84cc14c704067bffd2b4dd411abe752eb492431814cf9ac13417d061a3db0ec3
SHA512 b8376fe9ead1f43eebbaee92e649ba528b3eb2d2b774534f46511ea0a1da743438e03bb793b9bc02a59fbadd5ae32e537c29522dd205d2a4d3e584357fa1bdd6

C:\Users\Admin\AppData\Local\Temp\_MEI21882\VCRUNTIME140_1.dll

MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

C:\Users\Admin\AppData\Local\Temp\_MEI21882\unicodedata.pyd

MD5 098cc6ad04199442c3e2a60e1243c2dc
SHA1 4c92c464a8e1e56e1c4d77cd30a0da474a026aaf
SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
SHA512 73c28488b42a0bc2f0d2861fed3f5dcccf8959ce19d3121c13c998db496f2822deb40f36f86240c8d3954fd2dc2ba5d63c8a125b62324dcd92fb6c8ba49ff170

C:\Users\Admin\AppData\Local\Temp\_MEI21882\tk86t.dll

MD5 6ddb534ef5c74627802ceef0c90b38f3
SHA1 ffa3b78435e7a121ba6a3de32a7c3950a3f1cb28
SHA256 f44fa94865d17e4f0266c8f9a1dd89825d8a0c6c3a63cf4192fc08c8796acabf
SHA512 0cf66eeaa3aef2c7da560c370865bbd84ac2e94536bf751907bf42f36c05b5d0c46f883b1f35daf9e21e8eec1a7fcad439e21a23e114ab0a3a0daf39e8c95eb0

C:\Users\Admin\AppData\Local\Temp\_MEI21882\tcl86t.dll

MD5 bed46aa40c392c9068aed5f94857d398
SHA1 227561d5f6a592dedd7a8b0ffe0c284f9bbf23e8
SHA256 22a1746363151a19e02f92f9b7bc4849038783be34c04f311a11df69fdc1a039
SHA512 04850421617366faeaa711fd28dcf58ff1bc5aa2b0cb962fbfc47b5ae645b3726f3decc19d0b36b23c6b00210badeefc67f83ba6f0a81d6de57dc27001ac19be

C:\Users\Admin\AppData\Local\Temp\_MEI21882\select.pyd

MD5 7e871444ca23860a25b888ee263e2eaf
SHA1 aa43c9d3abdb1aabda8379f301f8116d0674b590
SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
SHA512 2e260d3123f7ca612901513b90fe40739e85248da913297d4cca3b2ebd398d9697880d148830e168e474ebfc3d30ede10668c7316ed7668f8b39da7bca59e57d

C:\Users\Admin\AppData\Local\Temp\_MEI21882\libcrypto-3.dll

MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-utility-l1-1-0.dll

MD5 fcd6b29932d6fb307964b2d3f94e6b48
SHA1 be560f8a63c8e36a7b3fa48ff384f99f69a5d4f7
SHA256 cfb2ee4e426bb00b76163c1a66cf8cfef8d7450cbf9bbce3bc9eb2053f51e0e5
SHA512 3edfcf559f1e21870277358e6d266a1a0cea68b163b11c73108f3b6a56006d20b51410a3b4ea39bf80906bf6c9d573e1072697cfcd6a3d37e3679ea54757c69f

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-time-l1-1-0.dll

MD5 4cf70855444f38e1eb71f9c3cd1c6e86
SHA1 d06aec4008d397756ee841f0e7a435d1c05b5f07
SHA256 a409e25a9d3c252cc0a5af9df85d3733e946087b06cd1fb2cf1bf640eb0d49ba
SHA512 a13a80645e679343ac5638e8aa6a03012f16200cb3a4637be52a01aa3bef854324a8ed1882ca91b304b9c47b6351b1fc1671f4dede5be77bc208a71fe6029064

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-string-l1-1-0.dll

MD5 ec1381c9fda84228441459151e7badea
SHA1 db2d37f3c04a2c2d4b6f9b3fd82c1be091e85d2c
SHA256 44ddab31c182235ac5405d31c1cba048316cc230698e392a732ac941ec683bad
SHA512 ee9ebbdc23e7c945f2b291fde5eb68a42c11988182e6c78c0ab8fa9cb003b24910974a3291bcdaa0c8d1f9dfa8df40293848fb9a16c4be1425253bed0511a712

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-stdio-l1-1-0.dll

MD5 306608a878089cb38602af693ba0485b
SHA1 59753556f471c5bf1dfef46806cb02cf87590c5c
SHA256 3b59a50457f6b6eaa6d35e42722d4562e88bcd716bae113be1271ead0feb7af3
SHA512 21b626e619aaf4eda861a9c5edf02133c63adc9e893f38fede72d90a6e8be0e566c117a8a24ca4bab77928083ae4a859034417b035e8553cc7ccfb88cb4cbd9c

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-runtime-l1-1-0.dll

MD5 27c4a3bcc0f1dba2de4c2242cd489f3b
SHA1 a704fd91e3c67108b1f02fd5e9f1223c7154a9cc
SHA256 315ded39d9e157cec05d83711c09858c23602857c9d8c88beef121c24c43be84
SHA512 793e74dfb1052c06ab4c29e7b622c795cc3122a722382b103940b94e9dac1e6ca8039df48c558efcc5d952a0660393ae2b11ced5ade4dc8d5dd31a9f5bb9f807

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-process-l1-1-0.dll

MD5 55463244172161b76546dc2de37f42bd
SHA1 c10a5360ad5e340d59c814e159ea1efcbf5bf3ee
SHA256 4166a32551989f960dac7c0e296ffb28092f45f6539e7c450fa04bf17612be73
SHA512 eacec78ff95f60def6f7f27bda4a84f1dd2dfa386efc4f6da770c37268df83c5b402693ea5c29f54d48026579f3843db26add4d6448ea10cbf7f14d4d14a72fd

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-math-l1-1-0.dll

MD5 7a235962dbab1e807c6ec7609fc76077
SHA1 148ddd11a0d366313f75871007057b3f0485ab33
SHA256 f7c5d7394643c95fe14c07773a8a206e74a28db125f9b3976f9e1c8c599f2af1
SHA512 25b21ee7bb333e5e34d2b4a32d631a50b8ffaf1f1320d47c97c2a4dff59fa2a2703cdf30638b46c800d3150efaa4a2518c55e7b2a3b2e4273f43dd5ca83ae940

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-locale-l1-1-0.dll

MD5 ebc168d7d3ea7c6192935359b6327627
SHA1 aeceb7c071cf1bb000758b6ceebefeec91ad22bd
SHA256 c048a3d7ab951dce1d6d3f5f497b50353f640a1787c6c65677a13c55c8e99983
SHA512 891d252ecd50bded4614547758d5e301bdf8e71fbb1023ff89f8de2f81927cc7cc84b98985d99e8fa8dcbf361e5117d9c625dc0d36983afc3f2aa48a54ce3d48

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-heap-l1-1-0.dll

MD5 9151e83b4fdfa88353b7a97ae7792678
SHA1 b46152e70d5d3d75d61d4ccdb50403bd08bb9354
SHA256 6c0e0d22b65329f4948fcf36c8048a54ccccbf6c05b330b2c1a686f3e686eed0
SHA512 4d4210474957e656d821e1dc5934a4bfbf7e73dd61d696a1ab39914f887810c8fbe500dbb1e23782b40807f25820f35c9665e04dcdc2fd0f6c83046a4aecb86b

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 d725d87a331e3073bf289d4ec85bd04d
SHA1 c9d36103be794a802957d0a8243b066fa22f2e43
SHA256 30bcf934cbcc9ed72ff364b6e352a70a9e2afa46eceadea5c47183cb46cfd16e
SHA512 6713ff954221c5dd835c15556e5fa6b8684fa7e19ce4f527a5892e77f322b3dae7199a232040b89ad4a9575c8d9788d771892d2294f3c18da45e643eb25fdb08

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-environment-l1-1-0.dll

MD5 dacf383a06480ca5ab70d7156aecab43
SHA1 9e48d096c2e81a7d979f3c6b94315671157206a1
SHA256 00f84c438aab40500a2f2df22c7a4ec147a50509c8d0cdac6a83e4269e387478
SHA512 5d4146a669ddb963cf677257ec7865e2cfcb7960e41a38bbd60f9a7017474ed2f3291505fa407e25881cbf9e5e6b8055ff3bd891043284a0a04e3fe9cfad9817

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-crt-conio-l1-1-0.dll

MD5 a68d15cab300774d2a20a986ee57f9f4
SHA1 bb69665b3c8714d935ee63791181491b819795cb
SHA256 966ddbf59e1d6c2a80b8abbf4a30d37475de097bf13fb72ba78684d65975cd97
SHA512 ac040f92560631ca5162c7559173bdfe858e282225967ab1adc0a038d34943b00db140d44319cd2cdc2864295a098ab0ba634dfaa443e1d1782fa143ae4c217d

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-util-l1-1-0.dll

MD5 5b6c46f42ed6800c54eeb9d12156ce1f
SHA1 66ce7a59b82702875d3e7f5b7cf8054d75ff495f
SHA256 2631cadce7f97b9a9e6df4e88f00f5a43ef73b070ee024ed71f0b447a387ff2f
SHA512 38ff6745bb5597a871b67aa53fcc8426bc2cdd16b6497a0eb7b59c21d8716f1abb1f7c7a40a121ad1bd67b5490fef5cf82ee8fd0bf848f27dca27fc5d25dec61

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-timezone-l1-1-0.dll

MD5 cb39eea2ef9ed3674c597d5f0667b5b4
SHA1 c133dc6416b3346fa5b0f449d7cc6f7dbf580432
SHA256 1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235
SHA512 2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 e1a7b1f8cdb24324d0e44b0078db8bd1
SHA1 b6c2fe32ae5fa1398f7ae6245c405378e32a7897
SHA256 45d4f1e398e4cc73fd1aaad80219d2a9d3205a228167c819eb6787d7b01fc186
SHA512 144afe1cb812de93fbdd08658afeb4c95480a8e504c5dcf909ff226400ca2d0f48395cf71954fbd1b3dd93a49cba39ec0db3fc34a05804c93fd9a48b0a1749ca

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-synch-l1-2-0.dll

MD5 0a2432a420640a79faaff044ab054ef6
SHA1 15688bf3c9330309ec5ea602c0ad5af1fd68bc30
SHA256 9dfd114e4182662a669a3b9054dd2a24d96dd66ed96a8b2ac05601928b2084d5
SHA512 090d6d5046aefe9006b319fc3f9740426bc93e50cf262ce65857449891ca69d2a235421cfea3fb178d3f8b1e3f640b8678aa9d8f6e67b8a17985913bebfb3fdd

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-synch-l1-1-0.dll

MD5 255b18fe8ab465c87fb8ad20d9a63aac
SHA1 645823b0332addaba5e4ef40d421b2da432fda5e
SHA256 e050e1bfbb75a278412380c912266225c3dee15031468dae2f6b77ff0617aa91
SHA512 19244b084ac811b89e0e6a77f9308d20cf4fbb77621d34eedc19fcd5c8775a33b2d9ada3f408cbe5806c39745b30c1c1cc25d724db9377b437d771ae0bf440b1

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-string-l1-1-0.dll

MD5 d2d7458ab838e738b54fb4d6fa490bf6
SHA1 0cfc5659b23a35c987b96cabbc0d10325316385d
SHA256 285a481d7ba9859cc28bededd8f05a90bd648a34d66b8c797118920b40e15e4e
SHA512 62e0abb2e59d360d6a066e73289aa1b880e7c1a0b7e6c695f40b1e0f2cb11deb9e54deba4045d2454b911af109ec198f11073874a8f023eb1b71a16a74354a1e

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 6397d5cc116d884d31552f613f748556
SHA1 b76b19fe4d3d5d26d2dee1983d384e26d961180e
SHA256 40eb38d84dfd13c8a58211b8273c4b4965148742f08eb6fe8b0830392c37abc1
SHA512 4449da9baa3f722eb274ac527125f5918a17bc94b243849a0a44f3463e35f368339a58a6aa1e08b83d54d13538c0d52bfcb452a48b8b9a52961bf136256d220e

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-profile-l1-1-0.dll

MD5 d6f37b232e3f2e944ebcf53a662e852f
SHA1 c10839e941444ed79c2314f90da34e5742f4e514
SHA256 5e6ad9502c8411f29bc072efd08c4fcd09bc3367814269deda74a78536fb8375
SHA512 6e0cf1021ef3ff31895d2b6a9e72084ebe52de4201d317b12fb8b05a7b1946fdef65d2b046f8fb25189d3a94f70726121f2e8eac8239c00ee02ef5eaf57f21c5

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-processthreads-l1-1-1.dll

MD5 74c264cffc09d183fcb1555b16ea7e4b
SHA1 0b5b08cdf6e749b48254ac811ca09ba95473d47c
SHA256 a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09
SHA512 285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-processthreads-l1-1-0.dll

MD5 82159e8d92e38c4f287eb9420dcf1f9f
SHA1 2e4436dbe18d943416a388777d05bfe5cb553de7
SHA256 0d22ce9d987efd6886a8de66a6a678c287d29b15963b4373f73d79dde42c9827
SHA512 dcef1e0c7916c8cd08148962949a996ffc5d46b899cd82dfbcd9bb1bc614622bc8997f1e7d3c4e3d75f2df07540a4c17f39477cfe97ba7f0bd280cdd52e06f91

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 a56e3e2aa6398ccb355c7cde81ccb6e5
SHA1 a26273dd41db7b63d3a79acf6f4f3cf0381a8f02
SHA256 25af1bc31c4a3fb9f1036c9aa51cb0ae8899c499b3eef4cf7281515c1ea27b47
SHA512 3d5cec9e5b42724794282974f637b1fda8c26adf01ed19dd2ec4f940e01cd43bdc42e46dc3e62704e62553de96d3fea1616c9650af73cdb557dfca1b52051a64

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 bf622378d051db49bdc62aca9ddf6451
SHA1 efd8445656a0688e5a8f20243c2419984bb7743e
SHA256 0bfedb0d28e41e70bf9e4da11e83f3a94c2191b5cd5dd45d9e9d439673b830ce
SHA512 df32d34c81fde6eef83a613ce4f153a7945eecfb1ec936ac6ed674654a4e167ec5e5436185b8064177f5f9273d387ca226c3c9529591180250a9c5c581ec6f70

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-memory-l1-1-0.dll

MD5 7ddda921e16582b138a9e7de445782a0
SHA1 9b2d0080eda4ba86a69b2c797d2afc26b500b2d3
SHA256 ef77b3e4fdff944f92908b6feb9256a902588f0cf1c19eb9bf063bb6542abfff
SHA512 c2f4a5505f8d35fbdd7b2eca641b9ecfcb31fe410b64fde990d57b1f8fd932dff3754d9e38f87db51a75e49536b4b6263d8390c7f0a5e95556592f2726b2e418

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-localization-l1-2-0.dll

MD5 de5695f26a0bcb54f59a8bc3f9a4ecef
SHA1 99c32595f3edc2c58bdb138c3384194831e901d6
SHA256 e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a
SHA512 df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 9a8ab7fe8c4cc7604dff1fbfa57458aa
SHA1 68ed7b6b5191f53b50d6a1a13513db780ab19211
SHA256 e9a3d7f8a08ab5bc94acb1ec1bffda90469fec3b7eecdf7cf5408f3e3682d527
SHA512 05daeabbcde867e63fde952213fff42af05e70ae72643c97060a90dcea2a88b75947b6f503cb2c33938afe36ad1bafba5008c1bbe839f6498cda27da549daee9

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-interlocked-l1-1-0.dll

MD5 215e3fa11be60feaae8bd5883c8582f3
SHA1 f5bf8b29fa5c7c177dfec0de68927077e160c9ab
SHA256 fbb9032835d0d564f2f53bbc4192f8a732131b8a89f52f5ef3ff0daa2f71465f
SHA512 c555698f9641af74b4c5bb4ca6385b8d69d5a3d5d48504e42b0c0eb8f65990c96093687bc7ee818aa9c24432247afad7df3bf086010a2efcd3a1010b2fcd6a31

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-heap-l1-1-0.dll

MD5 2edc82c3da339a4a138b4e84dc11e580
SHA1 e88f876c9e36d890398630e1b30878af92df5b59
SHA256 e36b72eafffffb09b3f3a615678a72d561b9469a09f3b4891aba9d809da937a5
SHA512 6c1b195b2fabe4d233724133ae3bdf883f287b5ecd9639a838ad558159a07e307e7ae5e5407ce9229dccde4be2cc39ec59506a5fb73b45d04b80330b55e2b85c

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-handle-l1-1-0.dll

MD5 3039a2f694d26e754f77aecffda9ace4
SHA1 4f240c6133d491a4979d90afa46c11608372917f
SHA256 625667ea50b2bd0bae1d6eb3c7e732e9e3a0dea21b2f9eac3a94c71c5e57f537
SHA512 d2c2a38f3e779ac84593772e11ae70fc8bcfd805903e6010fe37d400b98e37746d4d00555233d36529c53dd80b1df923714530853a69aa695a493ec548d24598

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-file-l2-1-0.dll

MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-file-l1-2-0.dll

MD5 d92e6a007fc22a1e218552ebfb65da93
SHA1 3c9909332e94f7b7386664a90f52730f4027a75a
SHA256 03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862
SHA512 b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-file-l1-1-0.dll

MD5 36277b52c64cc66216751aad135528f9
SHA1 f2a6740ba149a83e4e58e1e331429fa3eb44fba0
SHA256 f353b6c2df7aadb457263a02bce59c44bbab55f98ae6509674cfbc3751f761b9
SHA512 be729194a0a3c4d70a6ffa8de5c7f8bb3dda1f54772f9aeff4b9aa1d6756720d149613c5dcb911286b6c0181a264a4a2a8a4eb848c09ac30ba60b6fd10dd64c9

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-fibers-l1-1-0.dll

MD5 eb065ed1b5cabdbb90e2403b8564778f
SHA1 5b511215ee0e347734fb727fad6a0a959ff81bf1
SHA256 bb2d740333afaea2a73a163f95fa102d018ccd68def28b6815a2be0696ab57db
SHA512 e5ff38f28253fb31bf583131e23ef58af60020ad1fb329986c8789fe351f4b73cb06109fbc4220678d93191b04db353466f728534aa1febedf150c491b8e7c65

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 ecdd006aae56427c3555740f1abfa8d6
SHA1 7dfab7ad873544f627b42c7c4981a8700a250bd4
SHA256 13bc8b3f90da149030897b8f9f08d71e5d1561e3ae604472a82f58dab2b103f9
SHA512 a9b37e36f844796a0fe53a60684be51ab4013750bb0b8460c261d25fa5f3de6ce3380044ddc71116825d130a724df4ba351c2cffcbf497ef1b6c443545e83f1c

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-debug-l1-1-0.dll

MD5 720db2235c4193151ff8987f8a729135
SHA1 038648798892203b506ab4664baeca25f78bc43c
SHA256 092b72832c47f9c4edcde61f1a111c20eb73452984e0a6109482de74eb03c34d
SHA512 caac89dc4fe10e7752b6f248623b34a47a77a750e62f0a558c760a8ad672d980afc966a9e5696ba5c916e722fd221d305c4d2c49d5dda0e4a768855886d4f3ca

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-datetime-l1-1-0.dll

MD5 2a8065dc6e6e60fb90b4b3f9e6ba7288
SHA1 400a1f44cd4354dea0117e79ec04b006d6141b36
SHA256 55e5f10d0dd9c85ff1c6dc7798e46b3a4422fb7ebc583bb00d06a7df2494397b
SHA512 787e033e35aa357263639d97fdfe8a2ebc9f17865579be13c14c0a4c2ed99432ed8ea79c5046d1b4b783bf5fcf7b713efdd70fca8445a7afcb91cfddc7f9d442

C:\Users\Admin\AppData\Local\Temp\_MEI21882\api-ms-win-core-console-l1-1-0.dll

MD5 681c84fb102b5761477d8da2d68cd834
SHA1 fd96cf075a956fbc2b74e1ecc3e7958163b58832
SHA256 f0f7cb2a9ffccb43400db88d6bf99f2fcc3161de1ac96c48501d4d522c48c2ca
SHA512 c41a62f8d10290215b8a7f0ddcc27a1cf12a7453c2daabef75bd2ce87c4ffc87d74edc8caa1771beda0bfa26249cfe3c94d4af50b22a5decb6d282bd8a2c4bdd

C:\Users\Admin\AppData\Local\Temp\_MEI21882\base_library.zip

MD5 bed03063e08a571088685625544ce144
SHA1 56519a1b60314ec43f3af0c5268ecc4647239ba3
SHA256 0d960743dbf746817b61ff7dd1c8c99b4f8c915de26946be56118cd6bedaebdc
SHA512 c136e16db86f94b007db42a9bf485a7c255dcc2843b40337e8f22a67028117f5bd5d48f7c1034d7446bb45ea16e530f1216d22740ddb7fab5b39cc33d4c6d995

memory/4068-3554-0x00007FFE66BA0000-0x00007FFE66BCA000-memory.dmp

C:\Windows\INF\WmiApRpl\WmiApRpl.ini

MD5 234baf0ae0fffc6c4d48f39742a7a46e
SHA1 1e0bb1977c44bf3b39b2a8aecdfd4b281caafb01
SHA256 16c28d102851522ec6c0966507e5df150cb46f79473c14037cd47afec9205a40
SHA512 5b380a8572c8fd43b0cbdd8c91fbc094e3d74623ef161f70cce467e1d4f3a421edb0d6ad7b8e5f89da662f9b37ba145292a0c71c3ea25d41c37c231c3431e7cb