d26fa7e729bcb29ca402aab21d59c17c9c3c1123c3261e93dc71a65579af4986

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2023 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Learix_2.0_Fps.bat
Size

56KB
MD5

00c34bd8bd72d2efdd70fe6737687246
SHA1

165c93db4ef01a071281c7b334a8bd940d53d45f
SHA256

d26fa7e729bcb29ca402aab21d59c17c9c3c1123c3261e93dc71a65579af4986
SHA512

3ce8e8f0d948c18472a64c6160565dd94cf3202f2f750a2b15c9800462f57004fd39c266513cd4d5ababf7818fe9b4f87b060b7f802cf72abaea5f3a7a2467ce
SSDEEP

1536:qW5X449tht1MF+VZKQ9u+7XGq2D3Kutht1MF+Vqz:qkI49tht1MF+VZBYMXNu3Kutht1MF+V0

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 29 IoCs

description	ioc	Process
File created	C:\Windows\System32\ Debloat	cmd.exe
File created	C:\Windows\System32\ Remove Tweaks	cmd.exe
File created	C:\Windows\System32\ 6	cmd.exe
File created	C:\Windows\System32\ [ X to go Back ]	cmd.exe
File created	C:\Windows\System32\ [	cmd.exe
File created	C:\Windows\System32\ Game Booster	cmd.exe
File created	C:\Windows\System32\ [	cmd.exe
File created	C:\Windows\System32\ 1	cmd.exe
File created	C:\Windows\System32\ 4	cmd.exe
File created	C:\Windows\System32\ 5	cmd.exe
File created	C:\Windows\System32\ Fps Tweaks	cmd.exe
File created	C:\Windows\System32\ Fps Regedit	cmd.exe
File created	C:\Windows\System32\ [	cmd.exe
File created	C:\Windows\System32\ Cleaner	cmd.exe
File created	C:\Windows\System32\ Options	cmd.exe
File created	C:\Windows\System32\ [ X to Exit ]	cmd.exe
File created	C:\Windows\System32\ Service Disabler	cmd.exe
File created	C:\Windows\System32\ Windows Booster	cmd.exe
File created	C:\Windows\System32\ 3	cmd.exe
File created	C:\Windows\System32\ ]	cmd.exe
File created	C:\Windows\System32\ Updates	cmd.exe
File created	C:\Windows\System32\ [	cmd.exe
File created	C:\Windows\System32\ 7	cmd.exe
File created	C:\Windows\System32\ _________________________________________________________________________________	cmd.exe
File created	C:\Windows\System32\ [	cmd.exe
File created	C:\Windows\System32\ 2	cmd.exe
File created	C:\Windows\System32\ [	cmd.exe
File created	C:\Windows\System32\ Memory Optimizer	cmd.exe
File created	C:\Windows\System32\ Version 2.0	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1308	3448	cmd.exe	85
PID 3448 wrote to memory of 1308	3448	cmd.exe	85
PID 3448 wrote to memory of 3692	3448	cmd.exe	86
PID 3448 wrote to memory of 3692	3448	cmd.exe	86
PID 3448 wrote to memory of 4476	3448	cmd.exe	87
PID 3448 wrote to memory of 4476	3448	cmd.exe	87
PID 3448 wrote to memory of 668	3448	cmd.exe	88
PID 3448 wrote to memory of 668	3448	cmd.exe	88
PID 3448 wrote to memory of 3464	3448	cmd.exe	89
PID 3448 wrote to memory of 3464	3448	cmd.exe	89
PID 3448 wrote to memory of 3956	3448	cmd.exe	90
PID 3448 wrote to memory of 3956	3448	cmd.exe	90
PID 3448 wrote to memory of 1564	3448	cmd.exe	91
PID 3448 wrote to memory of 1564	3448	cmd.exe	91
PID 3448 wrote to memory of 4076	3448	cmd.exe	92
PID 3448 wrote to memory of 4076	3448	cmd.exe	92
PID 3448 wrote to memory of 5044	3448	cmd.exe	93
PID 3448 wrote to memory of 5044	3448	cmd.exe	93
PID 3448 wrote to memory of 3872	3448	cmd.exe	94
PID 3448 wrote to memory of 3872	3448	cmd.exe	94
PID 3448 wrote to memory of 320	3448	cmd.exe	95
PID 3448 wrote to memory of 320	3448	cmd.exe	95
PID 3448 wrote to memory of 264	3448	cmd.exe	96
PID 3448 wrote to memory of 264	3448	cmd.exe	96
PID 3448 wrote to memory of 2980	3448	cmd.exe	97
PID 3448 wrote to memory of 2980	3448	cmd.exe	97
PID 3448 wrote to memory of 4588	3448	cmd.exe	98
PID 3448 wrote to memory of 4588	3448	cmd.exe	98
PID 3448 wrote to memory of 4444	3448	cmd.exe	99
PID 3448 wrote to memory of 4444	3448	cmd.exe	99
PID 3448 wrote to memory of 4856	3448	cmd.exe	100
PID 3448 wrote to memory of 4856	3448	cmd.exe	100
PID 3448 wrote to memory of 4784	3448	cmd.exe	101
PID 3448 wrote to memory of 4784	3448	cmd.exe	101
PID 3448 wrote to memory of 4252	3448	cmd.exe	102
PID 3448 wrote to memory of 4252	3448	cmd.exe	102
PID 3448 wrote to memory of 4816	3448	cmd.exe	103
PID 3448 wrote to memory of 4816	3448	cmd.exe	103
PID 3448 wrote to memory of 380	3448	cmd.exe	104
PID 3448 wrote to memory of 380	3448	cmd.exe	104
PID 3448 wrote to memory of 4156	3448	cmd.exe	105
PID 3448 wrote to memory of 4156	3448	cmd.exe	105
PID 3448 wrote to memory of 3752	3448	cmd.exe	106
PID 3448 wrote to memory of 3752	3448	cmd.exe	106
PID 3448 wrote to memory of 4792	3448	cmd.exe	112
PID 3448 wrote to memory of 4792	3448	cmd.exe	112
PID 3448 wrote to memory of 4944	3448	cmd.exe	113
PID 3448 wrote to memory of 4944	3448	cmd.exe	113
PID 3448 wrote to memory of 4732	3448	cmd.exe	114
PID 3448 wrote to memory of 4732	3448	cmd.exe	114
PID 3448 wrote to memory of 3992	3448	cmd.exe	115
PID 3448 wrote to memory of 3992	3448	cmd.exe	115
PID 3448 wrote to memory of 4032	3448	cmd.exe	116
PID 3448 wrote to memory of 4032	3448	cmd.exe	116
PID 3448 wrote to memory of 3812	3448	cmd.exe	117
PID 3448 wrote to memory of 3812	3448	cmd.exe	117
PID 3448 wrote to memory of 2220	3448	cmd.exe	118
PID 3448 wrote to memory of 2220	3448	cmd.exe	118
PID 3448 wrote to memory of 5056	3448	cmd.exe	119
PID 3448 wrote to memory of 5056	3448	cmd.exe	119
PID 3448 wrote to memory of 1224	3448	cmd.exe	120
PID 3448 wrote to memory of 1224	3448	cmd.exe	120
PID 3448 wrote to memory of 664	3448	cmd.exe	121
PID 3448 wrote to memory of 664	3448	cmd.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Learix_2.0_Fps.bat"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\system32\mode.com
  mode 128,33
  2⤵
  PID:1308
- C:\Windows\System32\reg.exe
  Reg.exe query "HKU\S-1-5-19\Environment"
  2⤵
  PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:4476
- C:\Windows\System32\findstr.exe
  findstr /v /a:08 /R "^$" " Version 2.0 " nul
  2⤵
  PID:668
- C:\Windows\System32\findstr.exe
  findstr /v /a:08 /R "^$" " _________________________________________________________________________________" nul
  2⤵
  PID:3464
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:3956
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 1 " nul
  2⤵
  PID:1564
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:4076
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Fps Tweaks " nul
  2⤵
  PID:5044
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:3872
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 2 " nul
  2⤵
  PID:320
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:264
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Remove Tweaks " nul
  2⤵
  PID:2980
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:4588
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 3 " nul
  2⤵
  PID:4444
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:4856
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Updates " nul
  2⤵
  PID:4784
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:4252
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 4 " nul
  2⤵
  PID:4816
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:380
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Options " nul
  2⤵
  PID:4156
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ X to Exit ]" nul
  2⤵
  PID:3752
- C:\Windows\System32\findstr.exe
  findstr /v /a:08 /R "^$" " Version 2.0 " nul
  2⤵
  PID:4792
- C:\Windows\System32\findstr.exe
  findstr /v /a:08 /R "^$" " _________________________________________________________________________________" nul
  2⤵
  PID:4944
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:4732
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 1 " nul
  2⤵
  PID:3992
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:4032
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Cleaner " nul
  2⤵
  PID:3812
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:2220
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 2 " nul
  2⤵
  PID:5056
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:1224
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Game Booster " nul
  2⤵
  PID:664
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:4744
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 3 " nul
  2⤵
  PID:1460
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:2260
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Service Disabler " nul
  2⤵
  PID:2520
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:2060
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 4 " nul
  2⤵
  PID:1304
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:4900
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Fps Regedit " nul
  2⤵
  PID:1532
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:3760
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 5 " nul
  2⤵
  PID:4708
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:4240
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Memory Optimizer " nul
  2⤵
  PID:3288
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:4012
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 6 " nul
  2⤵
  PID:3616
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:1424
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Windows Booster " nul
  2⤵
  PID:1452
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ " nul
  2⤵
  PID:3220
- C:\Windows\System32\findstr.exe
  findstr /v /a:B /R "^$" " 7 " nul
  2⤵
  PID:2052
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " ] " nul
  2⤵
  PID:4424
- C:\Windows\System32\findstr.exe
  findstr /v /a:F /R "^$" " Debloat " nul
  2⤵
  PID:3180
- C:\Windows\System32\findstr.exe
  findstr /v /a:8 /R "^$" " [ X to go Back ]" nul
  2⤵
  PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\ Version 2.0

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [ X to Exit ]

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [ X to go Back ]

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ [

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ _________________________________________________________________________________

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 1

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 2

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 3

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 4

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 5

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 6

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ 7

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Cleaner

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Debloat

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Fps Regedit

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Fps Tweaks

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Game Booster

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Memory Optimizer

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Options

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Remove Tweaks

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Service Disabler

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Updates

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ Windows Booster

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ ]

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ ]

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Windows\System32\ ]

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads