Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 11:01

General

  • Target

    H2BOTNET.exe

  • Size

    5.9MB

  • MD5

    6121d9793742fd2ffbc985d0dad01a58

  • SHA1

    27fb444e6f7f838a02ee0d88fe111ca6b53faf03

  • SHA256

    5deb8f3ed733f1d73547bcd154f37f5cf991912f3bf7c6575dca700ea7c37b52

  • SHA512

    40cd64c1bda206579a7c52cb269750d641b388efd719f6f1a03134a2f33e9b28774cf89a38673ace5ca47d0b5904ef83802f2d7d2dede088a9dd0bfcb39c6e6a

  • SSDEEP

    98304:OVDe7pzWqi8MMhJMjarCtaCObO/OH9KkqQz4W1kgeDbFM6+3RM55eE:OwNzW4B6yA+KO0WRqi6955eE

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\H2BOTNET.exe
    "C:\Users\Admin\AppData\Local\Temp\H2BOTNET.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Local\Temp\H2BOTNET.exe
      "C:\Users\Admin\AppData\Local\Temp\H2BOTNET.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4404
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\H2BOTNET.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\H2BOTNET.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5076
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4432
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:224
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4044
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:4108
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:4080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:412
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2652
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:4844
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2908
            • C:\Windows\system32\tree.com
              tree /A /F
              4⤵
                PID:4576
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2240
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:2696
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2060
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:3528
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1564
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:1828
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "getmac"
                    3⤵
                      PID:2168
                      • C:\Windows\system32\getmac.exe
                        getmac
                        4⤵
                          PID:2548
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI44962\rar.exe a -r -hp"ak" "C:\Users\Admin\AppData\Local\Temp\YLm4s.zip" *"
                        3⤵
                          PID:4092
                          • C:\Users\Admin\AppData\Local\Temp\_MEI44962\rar.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI44962\rar.exe a -r -hp"ak" "C:\Users\Admin\AppData\Local\Temp\YLm4s.zip" *
                            4⤵
                            • Executes dropped EXE
                            PID:2812
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                          3⤵
                            PID:4108
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic os get Caption
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2312
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                            3⤵
                              PID:4884
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic computersystem get totalphysicalmemory
                                4⤵
                                  PID:2512
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                3⤵
                                  PID:3568
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic csproduct get uuid
                                    4⤵
                                      PID:208
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                    3⤵
                                      PID:2908
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4904
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                      3⤵
                                        PID:1896
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic path win32_VideoController get name
                                          4⤵
                                          • Detects videocard installed
                                          PID:5028
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                        3⤵
                                          PID:4932
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4500

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      d85ba6ff808d9e5444a4b369f5bc2730

                                      SHA1

                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                      SHA256

                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                      SHA512

                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      6d3e9c29fe44e90aae6ed30ccf799ca8

                                      SHA1

                                      c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                      SHA256

                                      2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                      SHA512

                                      60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      64B

                                      MD5

                                      dc7bf9814cb20bd020db0d2ef94ecd83

                                      SHA1

                                      300c2a2254ca62f19a7b2f94ace04be029f066df

                                      SHA256

                                      9aa35faf20a98c757ff13e045aae9a028fd78a95e164357c413c49daf1d30233

                                      SHA512

                                      ad391353b8bca57904a2e91895f2c60d22b0837d612e276448a59f244624ffd71e079dbf96d66111eefdf5886632fe6dc8612a82c59dd58b7db7de78bfeabb03

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      64B

                                      MD5

                                      446dd1cf97eaba21cf14d03aebc79f27

                                      SHA1

                                      36e4cc7367e0c7b40f4a8ace272941ea46373799

                                      SHA256

                                      a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                      SHA512

                                      a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                    • C:\Users\Admin\AppData\Local\Temp\YLm4s.zip

                                      Filesize

                                      5KB

                                      MD5

                                      bf46a33e743530c5069ee8f242db1b74

                                      SHA1

                                      782a5b896048a8d1831abf1b3b69f025ee2ceba7

                                      SHA256

                                      2e7f140fe7c26307685c34e93c225abe2d0694f2160b9ad99558ba6516207104

                                      SHA512

                                      6903ae2e6e908d7e960e2090cacd881cc736e965654e97de73d0c21b7b15af670ce04516c99e8eda59d4aef21ef8dd9dc6e401ebff9efac27dba628245ac0e76

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\VCRUNTIME140.dll

                                      Filesize

                                      95KB

                                      MD5

                                      f34eb034aa4a9735218686590cba2e8b

                                      SHA1

                                      2bc20acdcb201676b77a66fa7ec6b53fa2644713

                                      SHA256

                                      9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                                      SHA512

                                      d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_bz2.pyd

                                      Filesize

                                      47KB

                                      MD5

                                      f6e387f20808828796e876682a328e98

                                      SHA1

                                      6679ae43b0634ac706218996bac961bef4138a02

                                      SHA256

                                      8886bd30421c6c6bfae17847002b9bf4ee4d9eee1a3be7369ee66b36e26c372b

                                      SHA512

                                      ad7cf281f2d830f9dbf66d8ef50e418b4a17a0144b6616c43d7e98b00e6f0cbafc6fe4aba4fabf2f008bb0df85553614b38ae303e5726621a804051d950e744e

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_ctypes.pyd

                                      Filesize

                                      58KB

                                      MD5

                                      48ce90022e97f72114a95630ba43b8fb

                                      SHA1

                                      f2eba0434ec204d8c6ca4f01af33ef34f09b52fd

                                      SHA256

                                      5998de3112a710248d29df76a05272775bf08a8dbc5a051a7ecb909fef069635

                                      SHA512

                                      7e6c2591805136f74c413b9633d5fdc4428e6f01e0e632b278bee98170b4f418ef2afd237c09e60b0e72076924ed0e3ffb0e2453e543b5e030b263f64568fab8

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_decimal.pyd

                                      Filesize

                                      105KB

                                      MD5

                                      2030438e4f397a7d4241a701a3ca2419

                                      SHA1

                                      28b8d06135cd1f784ccabda39432cc83ba22daf7

                                      SHA256

                                      07d7ac065f25af2c7498d5d93b1551cc43a4d4b5e8fb2f9293b647d0f7bd7c72

                                      SHA512

                                      767f2a9f9eef6ebeca95ab9652b7d0976f2ac87b9e9da1dbd3c4ccf58e8ecb0da8242f4df0b07612282c16ba85197ed0296d1052027cd48b96d61bdf678abaad

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_hashlib.pyd

                                      Filesize

                                      35KB

                                      MD5

                                      13f99120a244ab62af1684fbbc5d5a7e

                                      SHA1

                                      5147a90082eb3cd2c34b7f2deb8a4ef24d7ae724

                                      SHA256

                                      11658b52e7166da976abeeed78a940d69b2f11f518046877bea799759a17f58b

                                      SHA512

                                      46c2f9f43df6de72458ed24c2a0433a6092fd5b49b3234135f06c19a80f18f8bdbfb297e5a411cf29f8c60af342c80db123959f7317cfa045c73bd6f835eb22d

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_lzma.pyd

                                      Filesize

                                      85KB

                                      MD5

                                      7c66f33a67fbb4d99041f085ef3c6428

                                      SHA1

                                      e1384891df177b45b889459c503985b113e754a3

                                      SHA256

                                      32f911e178fa9e4db9bd797598f84f9896f99e5022f2b76a1589b81f686b0866

                                      SHA512

                                      d0caabd031fa0c63f4cfb79d8f3531ad85eda468d77a78dd3dde40ce9ac2d404fc0099c4f67579aa802fe5c6c6a464894fd88c19f1fc601f26189780b36f3f9d

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_queue.pyd

                                      Filesize

                                      25KB

                                      MD5

                                      f9d8b75ccb258b8bc4eef7311c6d611d

                                      SHA1

                                      1b48555c39a36f035699189329cda133b63e36b5

                                      SHA256

                                      b3d9763fc71b001a1a2cc430946933e3832f859eb7857b590f8daeef8017179c

                                      SHA512

                                      cbf8490501b002eec96ae6c1fa4f3684aa1cab1e63025087df92c0e857299b9b498bff91c1f301f926ff86e0dc81e8f0c17db992366bed3cd9f41bcae43542db

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_socket.pyd

                                      Filesize

                                      42KB

                                      MD5

                                      0dd957099cf15d172d0a343886fb7c66

                                      SHA1

                                      950f7f15c6accffac699c5db6ce475365821b92a

                                      SHA256

                                      8142d92dc7557e8c585ea9ee41146b77864b7529ed464fdf51dfb6d797828a4a

                                      SHA512

                                      3dc0380dfc871d8cab7e95d6119f16be2f31cdde784f8f90ffddd6a43323a2988c61e343eede5e5cb347fc2af594fe8d8944644396faf2e478a3487bcf9cf9ee

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_sqlite3.pyd

                                      Filesize

                                      49KB

                                      MD5

                                      dde6bab39abd5fce90860584d4e35f49

                                      SHA1

                                      23e27776241b60f7c936000e72376c4a5180b935

                                      SHA256

                                      c84e5f739ce046b4582663a3017f31fe9ae5e706e087ac4c5ff11c7bba07b5f9

                                      SHA512

                                      8190c6befbe660096363409cb82977e9dce5ab9a78c60f3d3db9dc08a2300504f9b2058d8cfb740d7a17995267d8005392ee0f1a03fb74030286fbc7a9c287de

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\_ssl.pyd

                                      Filesize

                                      62KB

                                      MD5

                                      a4dba3f258344390ee9929b93754f673

                                      SHA1

                                      75bbf00e79bb25f93455a806d0cd951bdd305752

                                      SHA256

                                      e0aa8cfa2e383820561bce2aee35b77a6902ff383076c237c7859cd894d37f49

                                      SHA512

                                      6201e0d840f85d1627db849bfaf4a32f6fc0634a16416074fe6d13329317520b0a06806ad3337a3370dcc1c1e3d1910d18c823c6a7a62efe400de36b28d1767a

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\base_library.zip

                                      Filesize

                                      859KB

                                      MD5

                                      3ae8624c9c1224f10a3135a7039c951f

                                      SHA1

                                      08c18204e598708ba5ea59e928ef80ca4485b592

                                      SHA256

                                      64dfc4067a99c71094b4a9aa8e50344e7d42ea9a0d376cbcd419c04e53384285

                                      SHA512

                                      c47ea6b8e004c27fa29e84f6363f97e775c83a239eb3ae75dedca79e69db02b431a586877ee8f948f83b522b00c20e6b1d5864628c2aef9e33e0be95fe6e3254

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\blank.aes

                                      Filesize

                                      76KB

                                      MD5

                                      083cf589974f70c246d9bf08abf30376

                                      SHA1

                                      ab3537c9446886503f9d64b20e27ea4c942cee3a

                                      SHA256

                                      c35311e6d31939cfd74f364b884489c7911d4636adbd16e5525a573dd823e596

                                      SHA512

                                      f0095a515f0a32bce63e3941d383f5c1f5a6faadfccb0a303ea43acf6b7465cb49b79ab96162d1a180c3c42dd1f7397d9e0b3c35256562367b2e536c4c3d390b

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\blank.aes

                                      Filesize

                                      76KB

                                      MD5

                                      9ddfc10bfae9f3447eac705d728e0783

                                      SHA1

                                      f1d52a54c6de4357006f8eae7a5089cfbf009ff1

                                      SHA256

                                      162b942b61422cde5016b8b990337e42cd9995465e391214978ae4d7c5a54922

                                      SHA512

                                      7b55869f6894feff9269a4d0c9b2047a249f26f2d757655c71207a8c7b718f4f088cfa1441cfc7c69a65bd0156879dfec032b5b122dc8b780923c0e23941c2d5

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\libcrypto-1_1.dll

                                      Filesize

                                      1.1MB

                                      MD5

                                      e5aecaf59c67d6dd7c7979dfb49ed3b0

                                      SHA1

                                      b0a292065e1b3875f015277b90d183b875451450

                                      SHA256

                                      9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

                                      SHA512

                                      145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\libffi-7.dll

                                      Filesize

                                      23KB

                                      MD5

                                      6f818913fafe8e4df7fedc46131f201f

                                      SHA1

                                      bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                      SHA256

                                      3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                      SHA512

                                      5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\libssl-1_1.dll

                                      Filesize

                                      203KB

                                      MD5

                                      7bcb0f97635b91097398fd1b7410b3bc

                                      SHA1

                                      7d4fc6b820c465d46f934a5610bc215263ee6d3e

                                      SHA256

                                      abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

                                      SHA512

                                      835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\python310.dll

                                      Filesize

                                      1.4MB

                                      MD5

                                      3f782cf7874b03c1d20ed90d370f4329

                                      SHA1

                                      08a2b4a21092321de1dcad1bb2afb660b0fa7749

                                      SHA256

                                      2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6

                                      SHA512

                                      950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\rar.exe

                                      Filesize

                                      615KB

                                      MD5

                                      9c223575ae5b9544bc3d69ac6364f75e

                                      SHA1

                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                      SHA256

                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                      SHA512

                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\rarreg.key

                                      Filesize

                                      456B

                                      MD5

                                      4531984cad7dacf24c086830068c4abe

                                      SHA1

                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                      SHA256

                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                      SHA512

                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\select.pyd

                                      Filesize

                                      25KB

                                      MD5

                                      5c66bcf3cc3c364ecac7cf40ad28d8f0

                                      SHA1

                                      faf0848c231bf120dc9f749f726c807874d9d612

                                      SHA256

                                      26dada1a4730a51a0e3aa62e7abc7e6517a4dc48f02616e0b6e5291014a809cc

                                      SHA512

                                      034cd4c70c4e0d95d6bb3f72751c07b8b91918aabe59abf9009c60aa22600247694d6b9e232fefff78868aad20f5f5548e8740659036096fab44b65f6c4f8db6

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\sqlite3.dll

                                      Filesize

                                      622KB

                                      MD5

                                      ad4bcb50bb8309e4bbda374c01fab914

                                      SHA1

                                      a299963016a3d5386bf83584a073754c6b84b236

                                      SHA256

                                      32c0978437c9163bb12606607e88701dd79400cdde926d890cdbf6334c2b8435

                                      SHA512

                                      ba6bfa3c27fa4285eeb2978ff17cba94375d84d7c0f79150d1f2f7163c80c347b84d712da83435e8d13e27ed59ea0375edb5af2ea1ba67b2c77b6dfcb62ad65a

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44962\unicodedata.pyd

                                      Filesize

                                      289KB

                                      MD5

                                      dfa1f0cd0ad295b31cb9dda2803bbd8c

                                      SHA1

                                      cc68460feae2ff4e9d85a72be58c8011cb318bc2

                                      SHA256

                                      46a90852f6651f20b7c89e71cc63f0154f00a0e7cd543f046020d5ec9ef6cb10

                                      SHA512

                                      7fbdfd56e12c8f030483f4d033f1b920968ea87687e9896f418e9cf1b9e345e2be2dc8f1ea1a8afb0040a376ffb7a5dc0db27d84fb8291b50e2ed3b10c10168e

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dt11vmjo.4n4.ps1

                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \Directories\Desktop.txt

                                      Filesize

                                      638B

                                      MD5

                                      7d533a0f2282e68078c0337089297144

                                      SHA1

                                      bddc25778223c100765bd45d9a0ef471f74dc358

                                      SHA256

                                      58ceab11f6a1463950962a69edb389f00b990c04ffa020ab4e209ae9ff401fa8

                                      SHA512

                                      90a44d2550ce7b603ac2dab065d1d16b3f68dcf191f03997930831bc99b72a989a201a8f106ec6576738261987b04f4053215b1e0f60a82ba3c8bd258472b047

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \Directories\Documents.txt

                                      Filesize

                                      1KB

                                      MD5

                                      65e5389166279506d0e605a2f8048d60

                                      SHA1

                                      7a7da60ee9d35169d2a3e0d384795274d8d69f93

                                      SHA256

                                      4e9654d96501cb2e0d96118472809cfba8dd886c2a66ea51de7410be83c49fe6

                                      SHA512

                                      7927a6ae76e1fbba7654538d05fe9d8d208f68c3530f90c085a5f01556fae42ddc8725c91f1b5191a0ccbbccf1d85f81694b1122d819bd1493b2a8c303b88bde

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \Directories\Downloads.txt

                                      Filesize

                                      788B

                                      MD5

                                      7b2c8bd662cd43bacb189bbe726e4c20

                                      SHA1

                                      e93bc5aa3452d2c80a7d8ce698fc2898b7c0e025

                                      SHA256

                                      e0f91c49d77940e36570b1a34335a752e15e24901cf84b5383fc902f4fef923d

                                      SHA512

                                      82324efb35f62d4b94270bff88ee9f866b0ae07a17fe3662a6cd7d254478e14f6d97c89d3a309c2d6f100a9e08f7f0e752ed8026ac2405b6d8c1fa24bef15148

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \Directories\Music.txt

                                      Filesize

                                      563B

                                      MD5

                                      070eaf0aad90c1edf0bac5c871172c29

                                      SHA1

                                      bac24c5cb41e243d4d47215c6bf270378316102e

                                      SHA256

                                      6b442c53f026ed9468c0f3efa86275535a9b86b2d9a9756a1e6c5ae57df1286c

                                      SHA512

                                      ae1461736065773662d3c267be0e0d508dfd39b7a847fe51733b0a2bb9a046d00e8f3e78b0585228b3f77b2d353c537421ab7d27c9fa7b534a2f577f51d59cc8

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \Directories\Pictures.txt

                                      Filesize

                                      675B

                                      MD5

                                      30c93bc233a5965d27caf48b4847ae8b

                                      SHA1

                                      080fb618546204e28e84510edefcad56eb80a2c2

                                      SHA256

                                      9a05bb71fa053bee23b318609604a077a10a8fa2d981e484f29d63be84efa179

                                      SHA512

                                      8dd6d105951a4eb88b19dab765bc89d234ce0a9281880f2b215a918e13f57391a6a295f564d6c4bbfbb69057bc7b5184125ca09082758d4781cd550586128452

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \Directories\Videos.txt

                                      Filesize

                                      30B

                                      MD5

                                      e140e10b2b43ba6f978bee0aa90afaf7

                                      SHA1

                                      bbbeb7097ffa9c2daa3206b3f212d3614749c620

                                      SHA256

                                      c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

                                      SHA512

                                      df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \System\MAC Addresses.txt

                                      Filesize

                                      232B

                                      MD5

                                      df53ac7d995994054f85ba1ee71928ed

                                      SHA1

                                      3da8fec67147b5a0530ee9ce8e955e61afc48dfd

                                      SHA256

                                      34050662e4cab1c7f267a346d8920d910078dbe399495072073607adec17a214

                                      SHA512

                                      cefc39401fd9860cbfa50b55798c4725a3d46521abddb48a9762d1d15295adfe90e21487abda8a55d91bdcb97ccc94f2b7ea59304223ea714f55e1e2d69fa839

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \System\System Info.txt

                                      Filesize

                                      2KB

                                      MD5

                                      974c3680bf58b70f4d81768649ad025d

                                      SHA1

                                      b5e69b721b968ae1ec2c76600888b6a77ff722c9

                                      SHA256

                                      4e66aa057cbc961c02aacde0a06b7556e958cf0441fe7d5f0164a4f36d642c66

                                      SHA512

                                      7b11d2187b8a6e6904f0a430a3ec11660697c18e43b87462e1d253d17fc88ebf8154e1b4641ce2f15f9ab626fd3176616b708413e7f8c15c398efe03f318d449

                                    • C:\Users\Admin\AppData\Local\Temp\   ‏ ‏ ‍‌ \System\Task List.txt

                                      Filesize

                                      11KB

                                      MD5

                                      c7662e4c157f4b0cdf087741209a8a9a

                                      SHA1

                                      c6aaddbcc29498bceceb35e905071183e053e7f7

                                      SHA256

                                      23c85c174adf90940a5e295a138503b9037cfcbbce9ebe9811b0baec266b005b

                                      SHA512

                                      0a5a6553e444fee482157a539d510a4fc3ed83b0e7cf5cf85164760d503329914f266c10a61c10e3ff5e493d553653c6ab806b9c81ece86718c527efd95ac70c

                                    • memory/4404-68-0x00007FFD8ADC0000-0x00007FFD8B226000-memory.dmp

                                      Filesize

                                      4.4MB

                                    • memory/4404-176-0x000001B37F410000-0x000001B37F785000-memory.dmp

                                      Filesize

                                      3.5MB

                                    • memory/4404-80-0x00007FFDA0070000-0x00007FFDA0088000-memory.dmp

                                      Filesize

                                      96KB

                                    • memory/4404-25-0x00007FFD8ADC0000-0x00007FFD8B226000-memory.dmp

                                      Filesize

                                      4.4MB

                                    • memory/4404-78-0x00007FFD9B0E0000-0x00007FFD9B0ED000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/4404-76-0x00007FFD9A2D0000-0x00007FFD9A2E5000-memory.dmp

                                      Filesize

                                      84KB

                                    • memory/4404-71-0x00007FFD9A110000-0x00007FFD9A1C8000-memory.dmp

                                      Filesize

                                      736KB

                                    • memory/4404-106-0x00007FFD9EF50000-0x00007FFD9EF6F000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/4404-141-0x00007FFD8AAA0000-0x00007FFD8AC1D000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/4404-158-0x00007FFD9EE50000-0x00007FFD9EE69000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/4404-159-0x00007FFD9EF40000-0x00007FFD9EF4D000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/4404-72-0x000001B37F410000-0x000001B37F785000-memory.dmp

                                      Filesize

                                      3.5MB

                                    • memory/4404-73-0x00007FFDA01A0000-0x00007FFDA01C4000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/4404-74-0x00007FFD8A720000-0x00007FFD8AA95000-memory.dmp

                                      Filesize

                                      3.5MB

                                    • memory/4404-66-0x00007FFD9A2F0000-0x00007FFD9A31E000-memory.dmp

                                      Filesize

                                      184KB

                                    • memory/4404-64-0x00007FFD9EF40000-0x00007FFD9EF4D000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/4404-62-0x00007FFD9EE50000-0x00007FFD9EE69000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/4404-60-0x00007FFD8AAA0000-0x00007FFD8AC1D000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/4404-58-0x00007FFD9EF50000-0x00007FFD9EF6F000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/4404-56-0x00007FFDA0070000-0x00007FFDA0088000-memory.dmp

                                      Filesize

                                      96KB

                                    • memory/4404-54-0x00007FFDA1C70000-0x00007FFDA1C9C000-memory.dmp

                                      Filesize

                                      176KB

                                    • memory/4404-174-0x00007FFD9A2F0000-0x00007FFD9A31E000-memory.dmp

                                      Filesize

                                      184KB

                                    • memory/4404-175-0x00007FFD9A110000-0x00007FFD9A1C8000-memory.dmp

                                      Filesize

                                      736KB

                                    • memory/4404-81-0x00007FFD8A200000-0x00007FFD8A318000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/4404-48-0x00007FFDA2E40000-0x00007FFDA2E4F000-memory.dmp

                                      Filesize

                                      60KB

                                    • memory/4404-188-0x00007FFD8A720000-0x00007FFD8AA95000-memory.dmp

                                      Filesize

                                      3.5MB

                                    • memory/4404-30-0x00007FFDA01A0000-0x00007FFDA01C4000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/4404-214-0x00007FFD8A200000-0x00007FFD8A318000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/4404-200-0x00007FFD8ADC0000-0x00007FFD8B226000-memory.dmp

                                      Filesize

                                      4.4MB

                                    • memory/4404-206-0x00007FFD8AAA0000-0x00007FFD8AC1D000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/4404-205-0x00007FFD9EF50000-0x00007FFD9EF6F000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/4404-201-0x00007FFDA01A0000-0x00007FFDA01C4000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/4404-215-0x00007FFD8ADC0000-0x00007FFD8B226000-memory.dmp

                                      Filesize

                                      4.4MB

                                    • memory/4404-230-0x00007FFDA01A0000-0x00007FFDA01C4000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/4404-243-0x00007FFD8A200000-0x00007FFD8A318000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/4404-242-0x00007FFD9B0E0000-0x00007FFD9B0ED000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/4404-241-0x00007FFD9A2D0000-0x00007FFD9A2E5000-memory.dmp

                                      Filesize

                                      84KB

                                    • memory/4404-240-0x00007FFD9A110000-0x00007FFD9A1C8000-memory.dmp

                                      Filesize

                                      736KB

                                    • memory/4404-239-0x00007FFD8A720000-0x00007FFD8AA95000-memory.dmp

                                      Filesize

                                      3.5MB

                                    • memory/4404-238-0x00007FFD9A2F0000-0x00007FFD9A31E000-memory.dmp

                                      Filesize

                                      184KB

                                    • memory/4404-237-0x00007FFD9EF40000-0x00007FFD9EF4D000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/4404-236-0x00007FFD9EE50000-0x00007FFD9EE69000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/4404-235-0x00007FFD8AAA0000-0x00007FFD8AC1D000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/4404-234-0x00007FFD9EF50000-0x00007FFD9EF6F000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/4404-233-0x00007FFDA0070000-0x00007FFDA0088000-memory.dmp

                                      Filesize

                                      96KB

                                    • memory/4404-232-0x00007FFDA1C70000-0x00007FFDA1C9C000-memory.dmp

                                      Filesize

                                      176KB

                                    • memory/4404-231-0x00007FFDA2E40000-0x00007FFDA2E4F000-memory.dmp

                                      Filesize

                                      60KB

                                    • memory/5076-82-0x000001F384A80000-0x000001F384AA2000-memory.dmp

                                      Filesize

                                      136KB