umbral | a5e929a6859512632ededb0d04f9b706fcc8568f828047fae99f2767f4f6c783

Analysis

max time kernel
56s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

S500RAT.exe
Size

12.4MB
MD5

eca30bacd3085f447705c090cf780563
SHA1

86d0d579742aeae2bea804b065abfa9ebf02b952
SHA256

a5e929a6859512632ededb0d04f9b706fcc8568f828047fae99f2767f4f6c783
SHA512

9c6ca62412486459c36818756aeb694caa9c6520e3178534ce1e0c2017df78e8fe359ef9f2ee8faaa8791ebd1fea99edcb4c15315b7294e0366ab4f00d3107b3
SSDEEP

196608:PQb6doh5jCqj6dehxHTOf+Ce2XkuujHWRcQRO7F0p/GChj171pZqeYAtmk3BC:kionuqjtxVRA+BQQGprjbvqeYZwBC

Score

10^/10

umbral execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023418-6.dat	family_umbral
behavioral2/memory/3088-14-0x000001B6AA480000-0x000001B6AA4C0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3880	powershell.exe
4532	powershell.exe
2460	powershell.exe
3568	powershell.exe

Checks computer location settings 2 TTPs 20 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	S500RAT.exe

Executes dropped EXE 20 IoCs

pid	Process
3088	2.exe
4532	2.exe
3028	2.exe
1412	2.exe
3372	2.exe
1132	2.exe
5048	2.exe
1612	2.exe
5096	2.exe
1348	2.exe
4900	2.exe
2908	2.exe
4764	2.exe
4976	2.exe
4264	2.exe
4816	2.exe
4008	2.exe
1724	2.exe
1060	2.exe
2296	2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
67	discord.com
29	discord.com
30	discord.com
42	discord.com
55	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 4 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1492	wmic.exe
3196	wmic.exe
1676	wmic.exe
2576	wmic.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
3152	PING.EXE
464	PING.EXE
4716	PING.EXE
1560	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3088	2.exe
3880	powershell.exe
3880	powershell.exe
2356	powershell.exe
2356	powershell.exe
4388	powershell.exe
4388	powershell.exe
4928	powershell.exe
4928	powershell.exe
4696	powershell.exe
4696	powershell.exe
3372	2.exe
4532	powershell.exe
4532	powershell.exe
1908	powershell.exe
1908	powershell.exe
1844	powershell.exe
1844	powershell.exe
3748	powershell.exe
3748	powershell.exe
3172	powershell.exe
3172	powershell.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5096	2.exe
1932	powershell.exe
1932	powershell.exe
4772	powershell.exe
4772	powershell.exe
1940	powershell.exe
1940	powershell.exe
4816	powershell.exe
4816	powershell.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
2908	2.exe
2908	2.exe
3568	powershell.exe
3568	powershell.exe
3568	powershell.exe
4976	powershell.exe
4976	powershell.exe
4976	powershell.exe
868	powershell.exe
868	powershell.exe
868	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
1216	powershell.exe
1216	powershell.exe
1216	powershell.exe
4156	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	2.exe
Token: SeIncreaseQuotaPrivilege	1176	wmic.exe
Token: SeSecurityPrivilege	1176	wmic.exe
Token: SeTakeOwnershipPrivilege	1176	wmic.exe
Token: SeLoadDriverPrivilege	1176	wmic.exe
Token: SeSystemProfilePrivilege	1176	wmic.exe
Token: SeSystemtimePrivilege	1176	wmic.exe
Token: SeProfSingleProcessPrivilege	1176	wmic.exe
Token: SeIncBasePriorityPrivilege	1176	wmic.exe
Token: SeCreatePagefilePrivilege	1176	wmic.exe
Token: SeBackupPrivilege	1176	wmic.exe
Token: SeRestorePrivilege	1176	wmic.exe
Token: SeShutdownPrivilege	1176	wmic.exe
Token: SeDebugPrivilege	1176	wmic.exe
Token: SeSystemEnvironmentPrivilege	1176	wmic.exe
Token: SeRemoteShutdownPrivilege	1176	wmic.exe
Token: SeUndockPrivilege	1176	wmic.exe
Token: SeManageVolumePrivilege	1176	wmic.exe
Token: 33	1176	wmic.exe
Token: 34	1176	wmic.exe
Token: 35	1176	wmic.exe
Token: 36	1176	wmic.exe
Token: SeIncreaseQuotaPrivilege	1176	wmic.exe
Token: SeSecurityPrivilege	1176	wmic.exe
Token: SeTakeOwnershipPrivilege	1176	wmic.exe
Token: SeLoadDriverPrivilege	1176	wmic.exe
Token: SeSystemProfilePrivilege	1176	wmic.exe
Token: SeSystemtimePrivilege	1176	wmic.exe
Token: SeProfSingleProcessPrivilege	1176	wmic.exe
Token: SeIncBasePriorityPrivilege	1176	wmic.exe
Token: SeCreatePagefilePrivilege	1176	wmic.exe
Token: SeBackupPrivilege	1176	wmic.exe
Token: SeRestorePrivilege	1176	wmic.exe
Token: SeShutdownPrivilege	1176	wmic.exe
Token: SeDebugPrivilege	1176	wmic.exe
Token: SeSystemEnvironmentPrivilege	1176	wmic.exe
Token: SeRemoteShutdownPrivilege	1176	wmic.exe
Token: SeUndockPrivilege	1176	wmic.exe
Token: SeManageVolumePrivilege	1176	wmic.exe
Token: 33	1176	wmic.exe
Token: 34	1176	wmic.exe
Token: 35	1176	wmic.exe
Token: 36	1176	wmic.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	1812	wmic.exe
Token: SeSecurityPrivilege	1812	wmic.exe
Token: SeTakeOwnershipPrivilege	1812	wmic.exe
Token: SeLoadDriverPrivilege	1812	wmic.exe
Token: SeSystemProfilePrivilege	1812	wmic.exe
Token: SeSystemtimePrivilege	1812	wmic.exe
Token: SeProfSingleProcessPrivilege	1812	wmic.exe
Token: SeIncBasePriorityPrivilege	1812	wmic.exe
Token: SeCreatePagefilePrivilege	1812	wmic.exe
Token: SeBackupPrivilege	1812	wmic.exe
Token: SeRestorePrivilege	1812	wmic.exe
Token: SeShutdownPrivilege	1812	wmic.exe
Token: SeDebugPrivilege	1812	wmic.exe
Token: SeSystemEnvironmentPrivilege	1812	wmic.exe
Token: SeRemoteShutdownPrivilege	1812	wmic.exe
Token: SeUndockPrivilege	1812	wmic.exe
Token: SeManageVolumePrivilege	1812	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe
4156	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 3088	4304	S500RAT.exe	82
PID 4304 wrote to memory of 3088	4304	S500RAT.exe	82
PID 3088 wrote to memory of 1176	3088	2.exe	83
PID 3088 wrote to memory of 1176	3088	2.exe	83
PID 4304 wrote to memory of 824	4304	S500RAT.exe	85
PID 4304 wrote to memory of 824	4304	S500RAT.exe	85
PID 3088 wrote to memory of 3584	3088	2.exe	87
PID 3088 wrote to memory of 3584	3088	2.exe	87
PID 3088 wrote to memory of 3880	3088	2.exe	89
PID 3088 wrote to memory of 3880	3088	2.exe	89
PID 3088 wrote to memory of 2356	3088	2.exe	91
PID 3088 wrote to memory of 2356	3088	2.exe	91
PID 824 wrote to memory of 4532	824	S500RAT.exe	93
PID 824 wrote to memory of 4532	824	S500RAT.exe	93
PID 3088 wrote to memory of 4388	3088	2.exe	94
PID 3088 wrote to memory of 4388	3088	2.exe	94
PID 824 wrote to memory of 4416	824	S500RAT.exe	96
PID 824 wrote to memory of 4416	824	S500RAT.exe	96
PID 3088 wrote to memory of 4928	3088	2.exe	97
PID 3088 wrote to memory of 4928	3088	2.exe	97
PID 4416 wrote to memory of 3028	4416	S500RAT.exe	99
PID 4416 wrote to memory of 3028	4416	S500RAT.exe	99
PID 4416 wrote to memory of 4572	4416	S500RAT.exe	100
PID 4416 wrote to memory of 4572	4416	S500RAT.exe	100
PID 3088 wrote to memory of 1812	3088	2.exe	101
PID 3088 wrote to memory of 1812	3088	2.exe	101
PID 3088 wrote to memory of 1932	3088	2.exe	103
PID 3088 wrote to memory of 1932	3088	2.exe	103
PID 3088 wrote to memory of 4900	3088	2.exe	105
PID 3088 wrote to memory of 4900	3088	2.exe	105
PID 3088 wrote to memory of 4696	3088	2.exe	109
PID 3088 wrote to memory of 4696	3088	2.exe	109
PID 3088 wrote to memory of 1492	3088	2.exe	111
PID 3088 wrote to memory of 1492	3088	2.exe	111
PID 4572 wrote to memory of 1412	4572	S500RAT.exe	113
PID 4572 wrote to memory of 1412	4572	S500RAT.exe	113
PID 4572 wrote to memory of 2720	4572	S500RAT.exe	114
PID 4572 wrote to memory of 2720	4572	S500RAT.exe	114
PID 3088 wrote to memory of 2140	3088	2.exe	116
PID 3088 wrote to memory of 2140	3088	2.exe	116
PID 2140 wrote to memory of 3152	2140	cmd.exe	118
PID 2140 wrote to memory of 3152	2140	cmd.exe	118
PID 2720 wrote to memory of 3372	2720	S500RAT.exe	119
PID 2720 wrote to memory of 3372	2720	S500RAT.exe	119
PID 2720 wrote to memory of 2508	2720	S500RAT.exe	120
PID 2720 wrote to memory of 2508	2720	S500RAT.exe	120
PID 3372 wrote to memory of 5116	3372	2.exe	121
PID 3372 wrote to memory of 5116	3372	2.exe	121
PID 3372 wrote to memory of 2368	3372	2.exe	124
PID 3372 wrote to memory of 2368	3372	2.exe	124
PID 3372 wrote to memory of 4532	3372	2.exe	126
PID 3372 wrote to memory of 4532	3372	2.exe	126
PID 3372 wrote to memory of 1908	3372	2.exe	128
PID 3372 wrote to memory of 1908	3372	2.exe	128
PID 3372 wrote to memory of 1844	3372	2.exe	130
PID 3372 wrote to memory of 1844	3372	2.exe	130
PID 2508 wrote to memory of 1132	2508	S500RAT.exe	132
PID 2508 wrote to memory of 1132	2508	S500RAT.exe	132
PID 2508 wrote to memory of 2728	2508	S500RAT.exe	133
PID 2508 wrote to memory of 2728	2508	S500RAT.exe	133
PID 3372 wrote to memory of 3748	3372	2.exe	134
PID 3372 wrote to memory of 3748	3372	2.exe	134
PID 3372 wrote to memory of 116	3372	2.exe	138
PID 3372 wrote to memory of 116	3372	2.exe	138

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
468	attrib.exe
1804	attrib.exe
3584	attrib.exe
2368	attrib.exe

C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
"C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    - Views/modifies file attributes
    PID:3584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:1932
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1492
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\2.exe" && pause
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:3152
- C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
  "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    - Executes dropped EXE
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
    "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      4⤵
      Executes dropped EXE
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
      "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        5⤵
        Executes dropped EXE
        
        PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        
        PID:5116
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3748
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        7⤵
        
        PID:116
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        7⤵
        
        PID:4572
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        
        PID:1536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3172
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:3196
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\2.exe" && pause
        7⤵
        
        PID:2420
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        8⤵
        Runs ping.exe
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        7⤵
        Checks computer location settings
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        8⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        8⤵
        Checks computer location settings
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        9⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        9⤵
        Checks computer location settings
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5096
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:2696
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\2.exe"
        11⤵
        Views/modifies file attributes
        
        PID:468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1940
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        11⤵
        
        PID:4956
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        11⤵
        
        PID:3216
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:2904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4816
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        11⤵
        Detects videocard installed
        
        PID:1676
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\2.exe" && pause
        11⤵
        
        PID:3484
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        12⤵
        Runs ping.exe
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        10⤵
        Checks computer location settings
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        11⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        11⤵
        Checks computer location settings
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        12⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        12⤵
        Checks computer location settings
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        14⤵
        
        PID:4588
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\2.exe"
        14⤵
        Views/modifies file attributes
        
        PID:1804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4972
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        14⤵
        
        PID:2716
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        14⤵
        
        PID:4908
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        14⤵
        
        PID:376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1216
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        14⤵
        Detects videocard installed
        
        PID:2576
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\2.exe" && pause
        14⤵
        
        PID:2424
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        15⤵
        Runs ping.exe
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        13⤵
        Checks computer location settings
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        14⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        14⤵
        Checks computer location settings
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        15⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        15⤵
        Checks computer location settings
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        16⤵
        Executes dropped EXE
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        16⤵
        Checks computer location settings
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        17⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        17⤵
        Checks computer location settings
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        18⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        18⤵
        Checks computer location settings
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        19⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        19⤵
        Checks computer location settings
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        20⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        20⤵
        Checks computer location settings
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        21⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
        21⤵
        
        PID:4316

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1944

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\S500RAT.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
058a25b312ffea0ff1cb92e5f61700f3

SHA1
8391dae04f8726767497295e1d72f0c3b8c0eb05

SHA256
aa438b045e4fc715a9d7ea753f7a00b1ecd5b3a83fee4a914ad67924f927ab42

SHA512
3a77952a36d49d47586f7751accd06ffc49a12361e4de14c03fd755c31dc21fe5edc0cc9e4052ab4105b58121c8c07802a7fc288874ef11467d41c652ac82739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
af283a45e468abc28a9ac1c14af0a45d

SHA1
6d70a604e1a12e0df9b98a4bf57d335d78986c93

SHA256
141a5cbf854b091471384f71c93282c31d166a8676d43559c38086dd6e07229c

SHA512
05abb1f812dd979755e811928006974bccf076e8f618061e64db35b129bb78175a99bac6eefa5e11f6f3c4af94f60e9b7da4c4ba07fa740748ff47a4511d4db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af26bb84741edfe8f99931a648f1e3d4

SHA1
bb7605b32be7078fd0c81123c84721e8aa6395e9

SHA256
c71ce260e7918e45affa43bebed451b860445d539f010009810a96537da7963d

SHA512
596c7391775eb67cccb5fc0808855287d5d1cc31d4cc20c4578799d619ceb546d48bd524c43a351c59cb49fc2cd967bc1a07e10709320504030f9a957c1c3dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
47aec0ae6e0dfab5f91c35cd65d2c56a

SHA1
0bbe13618bdc0c402539cdfca81471aa501f5cad

SHA256
8f31385012b247db2cc50ecb164208fbbf5f8cdf7bfc951e8c2c8ad5fb04cf0b

SHA512
c4b7184a85c1d594012ba86390e651439d6cae63c76b94432faaaea410e4ef9bc62d88e68adf8f3abbe36e18ef9e4dc46c3e31a0d72089f98a22f04c8b4a8f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
23272afe282560b0a5abad03e415e79b

SHA1
d24997643237343f0db0d9ab70e445450c70c795

SHA256
b3e29a57ee8c2da3dd7df14e6fd34632246e41950f3efd9ce9d35f1797ece1c9

SHA512
bc013bbd6083ef858570cdcdc89f761177f298cc394a0acfc553b2decc61e056459a539037ed67af13c2c4851e20d8df92a1c23d3d0b818a2e585506f28053c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d04a2991e3807ca4a4073c023b2d20b3

SHA1
86aeb69fd3f1c1515feb18ed345191124735775f

SHA256
33cf5b77be962c1121404da98638346eaa2286b64e45ae71e3cb5e95671b000d

SHA512
90be20a64f603d7124a84e807d1dc5d6e36bc67caf6b9b282b2c918d1beb5b9f16abb4788dcc5a2df06ad1a6606c8929962962c3db51586cd00c976b7f79b8c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
2af06a6b36db9473e4a7d9c7ab72b70b

SHA1
8ef34b9b961e51bdd1b8d7d9db2ec1b0a4764645

SHA256
18a2aa7e245c6732f95fb7749b2b4d29007f2c56a9c5bfbc5e3c127bdfe5f158

SHA512
3495567a5d5af94ae27be51313d9e2630c52017d808042fe0d56baa34fa1d246eb15c253d14c77c77a1d8f2f1c81680e623044ae95415b095696e7fa141ac7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
df90d53775b01ed0875c81dca33a0c35

SHA1
c48dedb031902c3b73bd0f65c3a20d30ef02042a

SHA256
af239bf9ef4f2ad19422b5ee77faa2465d9a79aaabaa19557ff08123c0357227

SHA512
68d88f8c93e42f3c7b600da67d676e46289aab0601604856d6e97bd120bffbdbfea3ac56d009c5fcbd42cc466bf1c1d3895f57876adc9e24ce440b554db8c7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
966914e2e771de7a4a57a95b6ecfa8a9

SHA1
7a32282fd51dd032967ed4d9a40cc57e265aeff2

SHA256
98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba

SHA512
dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
009379a3a532af4d64c0bb9a5a49c692

SHA1
2bf6df4c309242398d482ebfcf8b8bbaf715ccdf

SHA256
ccadb3e5dd864341d0f77ecbc33cf0d1e79f7e82fcf601d01f8a8660ca42fb5c

SHA512
33f175fbb231bf3a01cffc2676cb2e1f72bbe8a5618eb0238f2666471fc738fb5b0307fd23f231196a4012e2592b74ab982bf4ce46c72fe2e326d9bc6d9a6ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe

Filesize
227KB

MD5
de0f463cfcf942610b612b164016b2e6

SHA1
5cbb5145184df571500cb9bca5d270354894db12

SHA256
733232e7823e2b9f845abb3c37d6346f2d0ca52ad170d5e835c8b60a7e5f9e02

SHA512
fa4cf17050d8602df09b3761b97d52c0fd1f4e101822f706bbf07d3644500d82122e31fea42ff91725a3a30aea71789e03c572413ad9e6d65d6c8e3537523f40

Download Submit
C:\Users\Admin\AppData\Local\Temp\DT1eedjRlRdZViT

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\GQ5sYBX0rMetdKH\Display\Display.png

Filesize
437KB

MD5
aa0df7161cc657b41c50f8c9f1f3c738

SHA1
4933c3d7e12c2ee10eaf2bd2d67c0eb58be9363e

SHA256
b9e41017f23437b75ba224d9c4880a1955c77a10212385b7eace567e511cc952

SHA512
1410826f6275f577ce0feda4350fc8fc267afaec148ec8b8d867c43553e37f4d9950c9a54bfb860d72c72c4371564771571bf681e63de04f161a5fcf1f67c6b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xf0icphl.ipn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aAC4sctTkLP3V2g

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mGsgsim1ZmFGoAN

Filesize
20KB

MD5
42c395b8db48b6ce3d34c301d1eba9d5

SHA1
b7cfa3de344814bec105391663c0df4a74310996

SHA256
5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

SHA512
7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

Download Submit
C:\Users\Admin\AppData\Local\Temp\mGsgsim1ZmFGoAN

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
memory/1932-209-0x000001C6E2950000-0x000001C6E2B6C000-memory.dmp

Filesize
2.1MB

Download
memory/1940-246-0x0000024BBABF0000-0x0000024BBAE0C000-memory.dmp

Filesize
2.1MB

Download
memory/1944-270-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-264-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-262-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-274-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-273-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-272-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-271-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-263-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/1944-269-0x00000196644F0000-0x00000196644F1000-memory.dmp

Filesize
4KB

Download
memory/2908-367-0x0000025F7DF40000-0x0000025F7E0E9000-memory.dmp

Filesize
1.7MB

Download
memory/2908-375-0x0000025F7DF40000-0x0000025F7E0E9000-memory.dmp

Filesize
1.7MB

Download
memory/3088-84-0x000001B6C4D90000-0x000001B6C4D9A000-memory.dmp

Filesize
40KB

Download
memory/3088-105-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/3088-14-0x000001B6AA480000-0x000001B6AA4C0000-memory.dmp

Filesize
256KB

Download
memory/3088-15-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/3088-16-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/3088-44-0x000001B6C4BB0000-0x000001B6C4C26000-memory.dmp

Filesize
472KB

Download
memory/3088-45-0x000001B6C4B60000-0x000001B6C4BB0000-memory.dmp

Filesize
320KB

Download
memory/3088-47-0x000001B6C4C70000-0x000001B6C4C8E000-memory.dmp

Filesize
120KB

Download
memory/3088-85-0x000001B6C5A80000-0x000001B6C5A92000-memory.dmp

Filesize
72KB

Download
memory/3880-29-0x0000016F7FA70000-0x0000016F7FA92000-memory.dmp

Filesize
136KB

Download
memory/4156-350-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-349-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-341-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-342-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-340-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-345-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-346-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-347-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4156-348-0x0000026E4FFA0000-0x0000026E4FFA1000-memory.dmp

Filesize
4KB

Download
memory/4304-0-0x00007FFF04093000-0x00007FFF04095000-memory.dmp

Filesize
8KB

Download
memory/4304-19-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/4304-10-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/4304-1-0x0000000000CB0000-0x000000000191E000-memory.dmp

Filesize
12.4MB

Download
memory/4772-233-0x000001EEEA110000-0x000001EEEA32C000-memory.dmp

Filesize
2.1MB

Download
memory/5036-195-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-190-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-192-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-193-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-194-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-186-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-196-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-191-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-184-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download
memory/5036-185-0x000001EF763B0000-0x000001EF763B1000-memory.dmp

Filesize
4KB

Download