discordrat | hxxps://mega[.]nz/folder/4zkUCBrA#W1jc-wZGaAHyvSmCnivWDw

Analysis

max time kernel
1283s
max time network
1293s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 13:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://mega.nz/folder/4zkUCBrA#W1jc-wZGaAHyvSmCnivWDw

Score

10^/10

discordrat evasion persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzNTU2MDUxNjY3MjU1NzA1Ng.GZDFBY.fzBUGyBQFSJ9PEG02ojzoc_vkiKee7lffNWj3Q
server_id
1175458472670801940

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5136	NetSh.exe

Loads dropped DLL 64 IoCs

pid	Process
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe
1896	Yargi Hack FiveM+Spoofer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\visuals = "reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v visuals /t REG_SZ /d \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows-Updater.exe\" /f"	Yargi Hack FiveM+Spoofer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\visuals = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows-Updater.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 32 IoCs

Web Service

T1102

flow	ioc
139	discord.com
167	discord.com
183	discord.com
120	discord.com
145	discord.com
147	discord.com
119	discord.com
132	discord.com
175	discord.com
103	discord.com
104	discord.com
121	discord.com
133	discord.com
170	discord.com
188	discord.com
100	discord.com
168	raw.githubusercontent.com
169	raw.githubusercontent.com
138	discord.com
148	discord.com
182	discord.com
101	discord.com
117	discord.com
136	discord.com
189	discord.com
99	discord.com
102	discord.com
118	discord.com
171	discord.com
173	discord.com
174	discord.com
176	discord.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
772	tasklist.exe
6116	tasklist.exe
4300	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133591298682162284"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeDebugPrivilege	1896	Yargi Hack FiveM+Spoofer.exe
Token: SeDebugPrivilege	772	tasklist.exe
Token: SeDebugPrivilege	5984	Yargi Hack FiveM+Spoofer.exe
Token: SeDebugPrivilege	6116	tasklist.exe
Token: SeDebugPrivilege	6356	Set-Up.exe
Token: SeDebugPrivilege	6564	Set-Up.exe
Token: SeDebugPrivilege	5852	Yargi Hack FiveM+Spoofer.exe
Token: SeDebugPrivilege	4300	tasklist.exe
Token: 33	1368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1368	AUDIODG.EXE
Token: SeManageVolumePrivilege	6804	svchost.exe
Token: SeDebugPrivilege	6356	Set-Up.exe
Token: SeDebugPrivilege	5300	taskmgr.exe
Token: SeSystemProfilePrivilege	5300	taskmgr.exe
Token: SeCreateGlobalPrivilege	5300	taskmgr.exe
Token: 33	5300	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
1896	Yargi Hack FiveM+Spoofer.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1012	2044	chrome.exe	86
PID 2044 wrote to memory of 1012	2044	chrome.exe	86
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 4308	2044	chrome.exe	88
PID 2044 wrote to memory of 1072	2044	chrome.exe	89
PID 2044 wrote to memory of 1072	2044	chrome.exe	89
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90
PID 2044 wrote to memory of 3696	2044	chrome.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2520	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/folder/4zkUCBrA#W1jc-wZGaAHyvSmCnivWDw
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe429bcc40,0x7ffe429bcc4c,0x7ffe429bcc58
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4540,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5128,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4396,i,18405505680870060141,2872251169362496500,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3892

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:872

C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe
"C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe"
1⤵
PID:4412
- C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe
  "C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v visuals /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows-Updater.exe" /f"
    3⤵
    PID:2588
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v visuals /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows-Updater.exe" /f
      4⤵
      Adds Run key to start application
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows-Updater.exe""
    3⤵
    PID:1472
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows-Updater.exe"
      4⤵
      Views/modifies file attributes
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:772

C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe
"C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe"
1⤵
PID:6656
- C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe
  "C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6116

C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Set-Up.exe
"C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Set-Up.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6356
- C:\Windows\SYSTEM32\NetSh.exe
  "NetSh.exe" Advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:5136

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Tutorial.txt
1⤵
PID:6516

C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Set-Up.exe
"C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Set-Up.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6564

C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe
"C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe"
1⤵
PID:4640
- C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe
  "C:\Users\Admin\Desktop\Hack FiveM+Spoofer\Yargi Hack FiveM+Spoofer.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5864
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6804

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5300

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:5528

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1944

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
PID:3608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\276b50a8-d967-4960-893f-4499a105a125.tmp

Filesize
77KB

MD5
d7271ca55677991f82cb251e3d2cc92e

SHA1
37ad6dceefed74583a29c3d34d18012ea7b5d5ca

SHA256
ba1211054d4b36f75f3a4b40a20650feb6e2719dc56c7b64f191612c1a74ed0b

SHA512
b19fb144f59ed2e63fbcaf45c07974abe4010d7771f72e517570c62f5e490f638938282724585792ca587b92bda104494e691df77fe51dc8191fb1840a7cc4f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f5639eb276f1a9aafe45dfcd3d69e4aa

SHA1
cd769121f4fa1e76be315883199b6c05d0f34080

SHA256
e55abbefa34851a0df4d2371d380656554ffa583682cf59a33aac0ddae0f7b65

SHA512
746afbac323b4748a10290ff0cd0d3b178e0d44edaa7f22187d440a50e53693f9141883a583a752c70e7c4c0667b1950f8bc35b938045cfba698889c8a17f13f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

Filesize
36KB

MD5
f90ac636cd679507433ab8e543c25de5

SHA1
3a8fe361c68f13c01b09453b8b359722df659b84

SHA256
5b4c63b2790a8f63c12368f11215a4ffec30c142371a819a81180a32baeb2bce

SHA512
7641a3610ad6516c9ecd0d5f4e5fa1893c7c60ca3ba8ae2e1b3b0cc3a72f7f9bef4c776a1f2fc52f366bd28a419ae3594a6576e886e79a20ebd98b55b2acc967

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
cd48a757160f8a1ade67a867422a6e9d

SHA1
579d95ab11dad407c81a3bcc12bfef3db5b9f1b2

SHA256
bd0c45695382e60dd0005d357e29d2b50df942b52e1b88d7617553cc6aa602de

SHA512
4be41d07a6edb90dae12859da9955ab9ac6785d0cc72b5f8cf0135e326ce3c753a734ec5c91481eda9dab797c0ed535741a4008ecfd0d83b007e205fa3304d0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
48f47f1fd1834fe2745387b0e1627ef0

SHA1
6aaaea98da6fbdead3b7c0bcfff49282d6611bef

SHA256
2dfcd32c7349c51e1cc3c4908a1f313af662d7a24e63dc8fc557c9a30c9616ae

SHA512
203cb58f8edc8f4f96393fe411648a446c77599ff93f0c333d623375fd216ba5adba970a48e7c6408b329ddcd27b79bdb658fb0f706bc476fab579ff0d2e575f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
7e4bb4568ccc2ace29ff8f0d3be66f62

SHA1
eebd5c2b47ba46baa84f46a62449d9f994c33780

SHA256
4916b8d31efd6ccaab41128a7b8d09a3d825264c894313603c5849743b93326f

SHA512
89e5c95b46eee606060ff05e14dc2277e0dc9960755d2158ebea4970dcca99251956d772f7cb39b3ac9bc7cd79fd2f31b643e7c813dcc8e867d67445974bb924

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ed64c5075855cd8d14b038ee274605e9

SHA1
f45b362407050091ca45fdf9b2085e14337a424b

SHA256
e61ec8ee5a7596b2f18dfd2fa194b3a6a14c65445919cc7fbb105bfff710260e

SHA512
dabbb14ad0d6e7ce4316c37fd5535bf5c1a1aea4c1af97ddfef7f135608d02a9cf32e8be4a73de4dfa5218f7445edee6bfe1fd7e295f488fa0bf4ac3f9f4c557

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e6a0263fb53d392545f87eb147363e2f

SHA1
98f1737ec1d6db8c7e16ca2b508d65299b57b7b6

SHA256
2632314f5694cdbc48c372bfcaca2da65a9de6916e866ca72b30ad2701a3a9ef

SHA512
2c86e42e67797907a13ea5ed8cef880d55eb0ce3621e4d0b1cd39d59284420b23d267d8062b9e49c6e907d55245db8476ec9587668d893caabcabd0ea085ba44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
6034d7837cf00cc5e49daf7e36c37509

SHA1
793cbbf253de4dff772d21773a503ad6746c405d

SHA256
070f0b6acb288c524e4e5903d2161ec5b896c39cbe904dc7890997a99ce735a4

SHA512
8b36391319eaca60078a7cd0a9e4cbee50a7fac28cbf3904574903580c9f334696d74d7ef686922a8ccdb0422ce87c7a4b2f2452ca6fd6a728ea91782321f94d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
77KB

MD5
9190a6a739306f3fb4b0d87ac20f491e

SHA1
a3741e814910b84ce88088c30521148b52297d9d

SHA256
e65ed00ef13dab702b9ecafbc94f9862eb2b813a1f27848c71ea03500fb376e4

SHA512
dee826756489c1160a49a3b0c3ea70044aa7969d2b606a146436db433367b763c87fb4e68ff3def6c2d36ffc542119b645dc7e848a536182dcf4707141dce0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\PIL\_imaging.cp312-win_amd64.pyd

Filesize
2.5MB

MD5
0376776f076cd4f4ac15ec4d813c5470

SHA1
381f84735a11ace4673d8be53138e652d4415413

SHA256
a7ddf4d7cab08676bb88a42059353c5374600901b3ab880e17ee1a0d0150c380

SHA512
06d68b9e5daf90d05855bf2c57b6110bfc2f20f4731b023b5aaa39145fd3ab66525d39988b8516731045ad16a89eb0457487dd080aeb347ba24a2e47ece98bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_asyncio.pyd

Filesize
69KB

MD5
209cbcb4e1a16aa39466a6119322343c

SHA1
cdcce6b64ebf11fecff739cbc57e7a98d6620801

SHA256
f7069734d5174f54e89b88d717133bff6a41b01e57f79957ab3f02daa583f9e2

SHA512
5bbc4ede01729e628260cf39df5809624eae795fd7d51a1ed770ed54663955674593a97b78f66dbf6ae268186273840806ed06d6f7877444d32fdca031a9f0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_brotli.cp312-win_amd64.pyd

Filesize
802KB

MD5
9ad5bb6f92ee2cfd29dde8dd4da99eb7

SHA1
30a8309938c501b336fd3947de46c03f1bb19dc8

SHA256
788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8

SHA512
a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_bz2.pyd

Filesize
82KB

MD5
59d60a559c23202beb622021af29e8a9

SHA1
a405f23916833f1b882f37bdbba2dd799f93ea32

SHA256
706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e

SHA512
2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_cffi_backend.cp312-win_amd64.pyd

Filesize
178KB

MD5
0572b13646141d0b1a5718e35549577c

SHA1
eeb40363c1f456c1c612d3c7e4923210eae4cdf7

SHA256
d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7

SHA512
67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_ctypes.pyd

Filesize
122KB

MD5
2a834c3738742d45c0a06d40221cc588

SHA1
606705a593631d6767467fb38f9300d7cd04ab3e

SHA256
f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089

SHA512
924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_decimal.pyd

Filesize
246KB

MD5
f930b7550574446a015bc602d59b0948

SHA1
4ee6ff8019c6c540525bdd2790fc76385cdd6186

SHA256
3b9ad1d2bc9ec03d37da86135853dac73b3fe851b164fe52265564a81eb8c544

SHA512
10b864975945d6504433554f9ff11b47218caa00f809c6bce00f9e4089b862190a4219f659697a4ba5e5c21edbe1d8d325950921e09371acc4410469bd9189ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_hashlib.pyd

Filesize
64KB

MD5
b0262bd89a59a3699bfa75c4dcc3ee06

SHA1
eb658849c646a26572dea7f6bfc042cb62fb49dc

SHA256
4adfbbd6366d9b55d902fc54d2b42e7c8c989a83016ed707bd7a302fc3fc7b67

SHA512
2e4b214de3b306e3a16124af434ff8f5ab832aa3eeb1aa0aa9b49b0ada0928dcbb05c57909292fbe3b01126f4cd3fe0dac9cc15eaea5f3844d6e267865b9f7b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_lzma.pyd

Filesize
155KB

MD5
b71dbe0f137ffbda6c3a89d5bcbf1017

SHA1
a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f

SHA256
6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a

SHA512
9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_multiprocessing.pyd

Filesize
34KB

MD5
4ccbd87d76af221f24221530f5f035d1

SHA1
d02b989aaac7657e8b3a70a6ee7758a0b258851b

SHA256
c7bbcfe2511fd1b71b916a22ad6537d60948ffa7bde207fefabee84ef53cafb5

SHA512
34d808adac96a66ca434d209f2f151a9640b359b8419dc51ba24477e485685af10c4596a398a85269e8f03f0fc533645907d7d854733750a35bf6c691de37799

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_overlapped.pyd

Filesize
54KB

MD5
61193e813a61a545e2d366439c1ee22a

SHA1
f404447b0d9bff49a7431c41653633c501986d60

SHA256
c21b50a7bf9dbe1a0768f5030cac378d58705a9fe1f08d953129332beb0fbefc

SHA512
747e4d5ea1bdf8c1e808579498834e1c24641d434546bffdfcf326e0de8d5814504623a3d3729168b0098824c2b8929afc339674b0d923388b9dac66f5d9d996

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_queue.pyd

Filesize
31KB

MD5
f3eca4f0b2c6c17ace348e06042981a4

SHA1
eb694dda8ff2fe4ccae876dc0515a8efec40e20e

SHA256
fb57ee6adf6e7b11451b6920ddd2fb943dcd9561c9eae64fdda27c7ed0bc1b04

SHA512
604593460666045ca48f63d4b14fa250f9c4b9e5c7e228cc9202e7692c125aacb0018b89faa562a4197692a9bc3d2382f9e085b305272ee0a39264a2a0f53b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_socket.pyd

Filesize
81KB

MD5
9c6283cc17f9d86106b706ec4ea77356

SHA1
af4f2f52ce6122f340e5ea1f021f98b1ffd6d5b6

SHA256
5cc62aac52edf87916deb4ebbad9abb58a6a3565b32e7544f672aca305c38027

SHA512
11fd6f570dd78f8ff00be645e47472a96daffa3253e8bd29183bccde3f0746f7e436a106e9a68c57cc05b80a112365441d06cc719d51c906703b428a32c93124

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_sqlite3.pyd

Filesize
121KB

MD5
506b13dd3d5892b16857e3e3b8a95afb

SHA1
42e654b36f1c79000084599d49b862e4e23d75ff

SHA256
04f645a32b0c58760cc6c71d09224fe90e50409ef5c81d69c85d151dfe65aff9

SHA512
a94f0e9f2212e0b89eb0b5c64598b18af71b59e1297f0f6475fa4674ae56780b1e586b5eb952c8c9febad38c28afd784273bbf56645db2c405afae6f472fb65c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_ssl.pyd

Filesize
173KB

MD5
ddb21bd1acde4264754c49842de7ebc9

SHA1
80252d0e35568e68ded68242d76f2a5d7e00001e

SHA256
72bb15cd8c14ba008a52d23cdcfc851a9a4bde13deee302a5667c8ad60f94a57

SHA512
464520ecd1587f5cede6219faac2c903ee41d0e920bf3c9c270a544b040169dcd17a4e27f6826f480d4021077ab39a6cbbd35ebb3d71672ebb412023bc9e182a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_tkinter.pyd

Filesize
62KB

MD5
a7929fd434e8803dde0951e6aa306d6a

SHA1
b0cb108be0616678d68eb8328c065aa1fd38e563

SHA256
5c400b4bc0367e1eff93955973efb3f85ce5970080bb1953f4e80bdf6f23c5c7

SHA512
b8a83fd831ae393ae7bc23d86af79d224142af41837002883296d62b3fdc059a3794f1bb2ecd7714ca75003bd07cb3fc0617d99ffa3867068bfb3a44bf5cf215

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_uuid.pyd

Filesize
24KB

MD5
7a00ff38d376abaaa1394a4080a6305b

SHA1
d43a9e3aa3114e7fc85c851c9791e839b3a0ee13

SHA256
720e9b68c41c8d9157865e4dd243fb1731f627f3af29c43250804a5995a82016

SHA512
ce39452df539eeeff390f260c062a0c902557fda25a7be9a58274675b82b30bddb7737b242e525f7d501db286f4873b901d94e1cd09aa8864f052594f4b34789

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\_wmi.pyd

Filesize
35KB

MD5
c1654ebebfeeda425eade8b77ca96de5

SHA1
a4a150f1c810077b6e762f689c657227cc4fd257

SHA256
aa1443a715fbf84a84f39bd89707271fc11a77b597d7324ce86fc5cfa56a63a9

SHA512
21705b991e75efd5e59b8431a3b19ae5fcc38a3e7f137a9d52acd24e7f67d61758e48abc1c9c0d4314fa02010a1886c15ead5bca8dca1b1d4ccbfc3c589d342e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\base_library.zip

Filesize
1.3MB

MD5
630153ac2b37b16b8c5b0dbb69a3b9d6

SHA1
f901cd701fe081489b45d18157b4a15c83943d9d

SHA256
ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2

SHA512
7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\pyexpat.pyd

Filesize
194KB

MD5
f179c9bdd86a2a218a5bf9f0f1cf6cd9

SHA1
4544fb23d56cc76338e7f71f12f58c5fe89d0d76

SHA256
c42874e2cf034fb5034f0be35f7592b8a96e8903218da42e6650c504a85b37cc

SHA512
3464ece5c6a0e95ef6136897b70a96c69e552d28bfedd266f13eec840e36ec2286a1fb8973b212317de6fe3e93d7d7cc782eb6fc3d6a2a8f006b34f6443498de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\python3.dll

Filesize
66KB

MD5
6271a2fe61978ca93e60588b6b63deb2

SHA1
be26455750789083865fe91e2b7a1ba1b457efb8

SHA256
a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb

SHA512
8c32bcb500a94ff47f5ef476ae65d3b677938ebee26e80350f28604aaee20b044a5d55442e94a11ccd9962f34d22610b932ac9d328197cf4d2ffbc7df640efba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\python312.dll

Filesize
6.7MB

MD5
550288a078dffc3430c08da888e70810

SHA1
01b1d31f37fb3fd81d893cc5e4a258e976f5884f

SHA256
789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d

SHA512
7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\select.pyd

Filesize
29KB

MD5
8a273f518973801f3c63d92ad726ec03

SHA1
069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f

SHA256
af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca

SHA512
7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\sqlite3.dll

Filesize
1.4MB

MD5
c1161c1cec57c5fff89d10b62a8e2c3a

SHA1
c4f5dea84a295ec3ff10307a0ea3ba8d150be235

SHA256
d1fd3040acddf6551540c2be6ff2e3738f7bd4dfd73f0e90a9400ff784dd15e6

SHA512
d545a6dc30f1d343edf193972833c4c69498dc4ea67278c996426e092834cb6d814ce98e1636c485f9b1c47ad5c68d6f432e304cd93ceed0e1e14feaf39b104a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\tcl86t.dll

Filesize
1.7MB

MD5
b0261de5ef4879a442abdcd03dedfa3c

SHA1
7f13684ff91fcd60b4712f6cf9e46eb08e57c145

SHA256
28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e

SHA512
e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
e9117326c06fee02c478027cb625c7d8

SHA1
2ed4092d573289925a5b71625cf43cc82b901daf

SHA256
741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

SHA512
d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\tk86t.dll

Filesize
1.5MB

MD5
ef0d7469a88afb64944e2b2d91eb3e7f

SHA1
a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b

SHA256
23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da

SHA512
909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\unicodedata.pyd

Filesize
1.1MB

MD5
04f35d7eec1f6b72bab9daf330fd0d6b

SHA1
ecf0c25ba7adf7624109e2720f2b5930cd2dba65

SHA256
be942308d99cc954931fe6f48ed8cc7a57891ccbe99aae728121bcda1fd929ab

SHA512
3da405e4c1371f4b265e744229dcc149491a112a2b7ea8e518d5945f8c259cad15583f25592b35ec8a344e43007ae00da9673822635ee734d32664f65c9c8d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI44122\zlib1.dll

Filesize
141KB

MD5
b4a0b3d5abc631e95c074eee44e73f96

SHA1
c22c8baa23d731a0e08757d0449ca3dd662fd9e6

SHA256
c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e

SHA512
56bafd1c6c77343f724a8430a1f496b4a3160faa9a19ea40796438ae67d6c45f8a13224dcf3d1defb97140a2e47a248dd837801a8cb4674e7890b495aeec538e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46402\tcl\encoding\euc-cn.enc

Filesize
84KB

MD5
c5aa0d11439e0f7682dae39445f5dab4

SHA1
73a6d55b894e89a7d4cb1cd3ccff82665c303d5c

SHA256
1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00

SHA512
eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI66562\cryptography-42.0.2.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_1CF4FAC865764F859717E3EED9FA3E61.dat

Filesize
940B

MD5
e99875c8a3944d66593f969a109b80e4

SHA1
c586d6390636c682f63ed9cb15b1576bd957e575

SHA256
31c400edd2f0b18305b8d61e05c996572ac915228ca13a39ceeb9de20af911ff

SHA512
fc95d9b4e61ec91c0431e336d828ab1bbab26c05eec8d4d7ee448dab4fb611782ba730c5a646d682b949d4c264bf6bd60c4530691cea38dd650330f570f042d4

Download Submit
memory/1896-1459-0x00007FFE33790000-0x00007FFE337BA000-memory.dmp

Filesize
168KB

Download
memory/1896-1460-0x00007FFE24FE0000-0x00007FFE27096000-memory.dmp

Filesize
32.7MB

Download
memory/1896-1463-0x00007FFE33790000-0x00007FFE337BA000-memory.dmp

Filesize
168KB

Download
memory/1896-1464-0x00007FFE24FE0000-0x00007FFE27096000-memory.dmp

Filesize
32.7MB

Download
memory/5852-5564-0x00007FFE24FE0000-0x00007FFE27096000-memory.dmp

Filesize
32.7MB

Download
memory/5852-5563-0x00007FFE3F410000-0x00007FFE3F43A000-memory.dmp

Filesize
168KB

Download
memory/5984-3510-0x00007FFE33790000-0x00007FFE337BA000-memory.dmp

Filesize
168KB

Download
memory/5984-3511-0x00007FFE24FE0000-0x00007FFE27096000-memory.dmp

Filesize
32.7MB

Download
memory/6356-5574-0x000002079AFA0000-0x000002079B04A000-memory.dmp

Filesize
680KB

Download
memory/6356-4486-0x0000020780660000-0x0000020780678000-memory.dmp

Filesize
96KB

Download
memory/6356-5569-0x0000020782360000-0x000002078236E000-memory.dmp

Filesize
56KB

Download
memory/6356-4487-0x000002079AC20000-0x000002079ADE2000-memory.dmp

Filesize
1.8MB

Download
memory/6356-4488-0x000002079B420000-0x000002079B948000-memory.dmp

Filesize
5.2MB

Download
memory/6804-5600-0x000001CD88F40000-0x000001CD88F50000-memory.dmp

Filesize
64KB

Download
memory/6804-5584-0x000001CD88E40000-0x000001CD88E50000-memory.dmp

Filesize
64KB

Download
memory/6804-5616-0x000001CD91230000-0x000001CD91231000-memory.dmp

Filesize
4KB

Download
memory/6804-5620-0x000001CD91370000-0x000001CD91371000-memory.dmp

Filesize
4KB

Download
memory/6804-5619-0x000001CD91260000-0x000001CD91261000-memory.dmp

Filesize
4KB

Download
memory/6804-5618-0x000001CD91260000-0x000001CD91261000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads