njrat | hxxps://www[.]mediafire[.]com/folder/vkqbd2erubvi9/JV-Sender

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/vkqbd2erubvi9/JV-Sender

Score

10^/10

njrat hacked defense_evasion discovery evasion execution persistence privilege_escalation pyinstaller trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

acpanel.hackcrack.io:16164

Mutex

Windows Explorer

Attributes

reg_key
Windows Explorer
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe
744	powershell.exe
5536	powershell.exe
3296	powershell.exe
5176	powershell.exe
376	powershell.exe
208	powershell.exe
2316	powershell.exe
744	powershell.exe
5536	powershell.exe
3296	powershell.exe
5176	powershell.exe
376	powershell.exe
208	powershell.exe
2316	powershell.exe
3420	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4964	netsh.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	version.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 21 IoCs

pid	Process
5808	script.exe
1536	Setup.exe
116	Setup.exe
2544	script .exe
1300	svchost.exe
916	svchost.exe
5504	script .exe
5160	script.exe
5456	Setup.exe
5332	script .exe
5684	script .exe
5712	svchost.exe
5260	explorer.exe
3184	version.exe
1532	explorer.exe
1660	explorer.exe
4416	script.exe
5348	Setup.exe
5460	script .exe
3824	script .exe
3420	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5504	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
5684	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe
3824	script .exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe

Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5516	cmd.exe
2396	cmd.exe
1772	cmd.exe
116	cmd.exe
4560	cmd.exe
5632	cmd.exe
1560	cmd.exe
6068	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000c0000000234a2-695.dat	pyinstaller
behavioral1/files/0x000a000000023589-718.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3940	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5092	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
1624	msedge.exe
1624	msedge.exe
3440	identity_helper.exe
3440	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
5080	msedge.exe
5080	msedge.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe
5260	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeRestorePrivilege	5228	7zG.exe
Token: 35	5228	7zG.exe
Token: SeSecurityPrivilege	5228	7zG.exe
Token: SeSecurityPrivilege	5228	7zG.exe
Token: SeDebugPrivilege	1300	svchost.exe
Token: SeDebugPrivilege	916	svchost.exe
Token: SeDebugPrivilege	5712	svchost.exe
Token: SeDebugPrivilege	5260	explorer.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	5536	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	3940	taskkill.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	1532	explorer.exe
Token: 33	1532	explorer.exe
Token: SeIncBasePriorityPrivilege	1532	explorer.exe
Token: SeDebugPrivilege	3420	svchost.exe
Token: 33	1532	explorer.exe
Token: SeIncBasePriorityPrivilege	1532	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5260	explorer.exe
5260	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3652	1624	msedge.exe	84
PID 1624 wrote to memory of 3652	1624	msedge.exe	84
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 532	1624	msedge.exe	85
PID 1624 wrote to memory of 376	1624	msedge.exe	86
PID 1624 wrote to memory of 376	1624	msedge.exe	86
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87
PID 1624 wrote to memory of 1896	1624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/vkqbd2erubvi9/JV-Sender
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa198346f8,0x7ffa19834708,0x7ffa19834718
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3996
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Password.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,12765556321459505791,13706584102162669881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6020

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\JV-Sender\" -ad -an -ai#7zMap9092:80:7zEvent8788
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe
"C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5808
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1536
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5260
    - - \??\c:\windows\system32\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\gqvcwh5k.inf
        5⤵
        
        PID:220
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4964
- C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe
  "C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe"
  2⤵
  - Executes dropped EXE
  PID:2544
- - C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe
    "C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5504

C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe
"C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5160
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5456
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5712
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Executes dropped EXE
      PID:1660
- C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe
  "C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe"
  2⤵
  - Executes dropped EXE
  PID:5332
- - C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe
    "C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5684

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\JV-Sender\JV-Sender\configuration\subjects.txt
1⤵
PID:2624

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\JV-Sender\JV-Sender\configuration\mailist.txt
1⤵
PID:6028

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:208

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe
"C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4416
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe
  "C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe"
  2⤵
  - Executes dropped EXE
  PID:5460
- - C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe
    "C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.log

Filesize
408B

MD5
8e1e19a5abcce21f8a12921d6a2eeeee

SHA1
b5704368dfd8fc7aeafb15c23b69895e809fe20e

SHA256
22cf24d10cc11a9bb23268f18afbc8f3481c27e1feb4cb42ba5c8775e12720e3

SHA512
48365f858592d677ef5d0e2948f672234898e47a153eec32592a2e079353702a64e41e1aa59250f05bd690690b9edfb8455dfac90c6695fb7c0b6907a057fe78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
71KB

MD5
2b6e5d0202f05b0f9b7c7deb4452e765

SHA1
9135b7cac88626de29377964b793948ae87f15ca

SHA256
6579c4d11ea103c8bae30a9a89d07062e10abf1a25bbd3ed90e8d542ddc86085

SHA512
5dedab0ce442797ca28216bd1624410aa958d7a696e781ab27b423ae8ac47cef419c87ae87bd78e473343bbc9bb130e81ead7bb6ee980b1a650505d850048e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
83KB

MD5
af2f5c6481eb9644332e165008e62820

SHA1
fa7812602e77b173ba7f4fd9143968de7e892d8d

SHA256
959171b7b425a543ba0784b9cdefd97952856a1355d7e7c9f614856bb8872769

SHA512
445983106e3e9141219475cdf0eefeee10c44cc05d1fd209dc6fe3de95920635409c9d828e67fffe1fc33e4241a02437de0fc24b75b11f257952dcc84d50049c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
108KB

MD5
18a483acdd0418059c52bb5c4e0ec70b

SHA1
84e25015ada96f352f81115a4ad2cb349a8cbab9

SHA256
60704eaf7d3b646c5c23cd9b8e96f88fb4ebe495776a743b36be27891f52ecf0

SHA512
c0124b862df08ab4725435234941b5ed9c3566df40f0bbcffc3367ff3158225b9c9984e752a9c54ea4e37e72835b47dd9c4e02ebf971f34beeee95680b69675c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
71KB

MD5
4e396692209612a361b397a71d1182d5

SHA1
7e3510cecc0fc3589fb9e2588f32dbd6d9edd077

SHA256
08abed86af4e5f9fa8f16bf9012ccd5184e65e30ec659dd2639788cd34b6ee77

SHA512
2a1d6a1fee315864a3b547c794d137ca46db7e02fb6dc81ac3c3f10c8c012963b54cc307880dd662dee65c2e90fcef439ec67c9ec4330a1450c36050f20fcf2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fcaee0519f33dfbb827ddebe9fecfe1c

SHA1
c436b7b8b6d1e1f98d2c8d4145d52935b7b3ff2a

SHA256
4631ab1491db0eb415861d2ac809323db9dcd0170fe832155bb97d5de065867f

SHA512
5a9a45b58b4a44ecbcd759c604afb093f86278fcd861678172123fe1b9c4fd70946a3d2a9106648ed8016555115bf6cb0f7822d48c75a5644c5ef87d69723b08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
2bc3182c67043bbcf0651fab72b15ef2

SHA1
d94d4639be12bc811832d3a51cb6b555480dd709

SHA256
25a028dff0e7bfbdf1e02425f7d830a91659b6c72d2fc98fef2eef29ebae1c44

SHA512
d4bc4e67522c8db8ff11303f5480de39838dd3e632b68ee72bf29ce88b5f1d7c856843b5f1ee58231014203c6e3bb2cc8200213f6e2431d9495158baf4aa28f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
7b52186b67c79b06ef87833d2334c924

SHA1
ba38eae2c4e6a8a3c95e7d9e041ebe69a2c1434c

SHA256
126a663b7fd37faa9393720b731a82244a0121d28834344bc0c5a5478f85e33e

SHA512
7dd43ec8f0c63911a8dbb0a890796688feef6918980f7030d8c22a8ca0fc41256a3c09915e16bfdaa22512df34660c1360c7d574640cbfc3994a3f4aec0fd308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
693c2b7494bdd13eb7a148cf84912dc1

SHA1
9868670c4c552feb40aa7e92969581727c4de4cc

SHA256
02c3dc532c0e6929f0bf867417ac8b9c6880fecce3a3c1a5585ba26091f0a1ef

SHA512
8b842741c4581ea6d13b07f7cfdd666c1f3e82b29a58f43c14f836baf2d555c195257c3ea2a7c62c1c94de4355f57a9df2ded10617ffb899d8476fafd661b9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b94fb61389cb374ce10987375257c0b5

SHA1
d8ecc18192174d4f60fb64c66d10a95686998d48

SHA256
2569aff58a077653c09af529b8b46764deb7bfc376a91ef85c61a1335f548d58

SHA512
981328b2818913c3709e540bb58a31182c54bb770d56ec4a4e1813d4e58660d25f53dfde0865b6d57cd6f1da37104f4ee3b6d5c7b3a76f4533aac1babbefd17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
b7592b5873a8f0a08b74d95c55a00d20

SHA1
5305d8f55cc45e9b4d0540c9d3a84a9c7bf54605

SHA256
ab26244196c4f32f5a654b05c0d3161ed5692962cb978b28e5e0c0c7041a0e0d

SHA512
71f319f03fdb2548947abd7be1745ebd54ed738bdc4de115269d520af8b7083d7751b935b8e873cb28d8d49838dd8a21cfb7dfc0c0a714e625dca00eb53432bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
1664299dbd688ff6bc2c410493ee73df

SHA1
eff9180658606c27e47a74b8b6a3ab9eec128296

SHA256
62e33c3e8ca0c973570f100c034590bff7b0e0bbbb82138a82e8b44042ea96c3

SHA512
cca01354baa2d935d08800f35ec45da75021df374d0577e467ed431925ce26b371439e0844fed6b11e67697c0beb7f3262ce0087e299bd6c502231903757e309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6b657fb3da8037d30f1d720bb6d2e549

SHA1
1a2623d57bc568c54a440300adf195d4a260576c

SHA256
e00a867f59997a134e6ba67c0c2765168036fde64413f977cabd5a2edad5e4c5

SHA512
8ef76122847cc6273f7a2ea303bf5a6ed91206710a6df0c131e947ce942b1bab14980ee887e0eb281b3c0559899499e43b9568bf1d526b000ef7fe75958f51bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d50f58830a7a264862d864b111274cc4

SHA1
c518b9698ab7f135bc23273760bd83d251a5c5ad

SHA256
50b7b273dc12e733d91e87853455c623683d8edf8f1def7ede5fb1eb1aca3777

SHA512
7e833b8c21974e85302eb378efa80668b877db52c287b6cece8569e90464b10c059da6d2e9e264a86e4c5bbbc05bd76caac261a8f83667d60fb323319c126e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57de4a.TMP

Filesize
1KB

MD5
3130a7de8ffc645264df86e86eadcfca

SHA1
635cfc63b3a20b2c09eafcb087226a0d747a6ab1

SHA256
ae8ef8bba6d6e3c86c564ab500adc4fd8b0f53f3536c6ffb4907d1191ca5b4ea

SHA512
20f66b52ad72625edd13d801795552e0504ed7859dc4eed34ccf48d97ed62fbff14c062dfc45d7552d11b4e57542c59daa7732ce9cabc50c0fb40fb6550d96b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f129c839a5d2c16b141a6eff825acb58

SHA1
53c83dba7edfba6424083b038140656bf7323435

SHA256
e47b89fb4c54757c06a828cdd8c235fa6b32eec9829e01c071d34dc547ad1941

SHA512
665cb47055be542123f18a683ed4f710c79324127604b700a6a56243fcc885994d01d25e006f43425f82b3cd2ead0879d303a81790c5b358c43b7cbfab449cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b247775ad6e39486afb589b5817d3ac2

SHA1
43ba219602dd1c02eb1d06dc63412f2aceaa7eca

SHA256
3917fe56c0354481c7e79f5b547390250c8135ddada234708e28b979ebda003d

SHA512
3471475af70f0e064cc84291589804e9ca542fdc55d301c6b1d90d43be6c418d58ca07a37bc9005121f3d279a1bb38edb50b42bf985b4c2dfbb5bd1051356d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f99156deaa43bd1e3c4956ebaca43e0f

SHA1
236762bcb221c7dc0fbebe7d4f34a26646267798

SHA256
0cc5d70620770e4327a56c120694880d49273f40544fa3d9f4d8b5430f1e8156

SHA512
511c2816a0db18efcddafb3042588e8180b00c184a7ba2907aea98411bbd21f6ac9e003fd0910863a1aebd81ccd6d71e9a6710151d5bdb741585ef16092d6576

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
375KB

MD5
8e4f8329f0837d6a3801dd96973a05fe

SHA1
7309226e370a33000c08653504f2ac5786944b2b

SHA256
0d8f6fc81065fc6f20ea5b9de9a85fbfffe2deb1f2055f1b304b5b0f3e99407d

SHA512
9df93293a5fec2a2fca0838f43b24af8347f229884fab4338f7804ef0050b0aba02235ae2368ffef7dd42640420b42f69eaf974f5107bdab0bf0a8c9b39671cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\_brotli.cp312-win_amd64.pyd

Filesize
802KB

MD5
9ad5bb6f92ee2cfd29dde8dd4da99eb7

SHA1
30a8309938c501b336fd3947de46c03f1bb19dc8

SHA256
788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8

SHA512
a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\_bz2.pyd

Filesize
83KB

MD5
5bebc32957922fe20e927d5c4637f100

SHA1
a94ea93ee3c3d154f4f90b5c2fe072cc273376b3

SHA256
3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62

SHA512
afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\_cffi_backend.cp312-win_amd64.pyd

Filesize
178KB

MD5
0572b13646141d0b1a5718e35549577c

SHA1
eeb40363c1f456c1c612d3c7e4923210eae4cdf7

SHA256
d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7

SHA512
67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\_ctypes.pyd

Filesize
122KB

MD5
fb454c5e74582a805bc5e9f3da8edc7b

SHA1
782c3fa39393112275120eaf62fc6579c36b5cf8

SHA256
74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1

SHA512
727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\base_library.zip

Filesize
1.3MB

MD5
68f96a1f0b49d240b392ebb7ea147939

SHA1
5d8aa0cccc0f744f17e546ef7120308016cb5438

SHA256
29556cc179d145e9f64d287f0455991bd62a8dc4304e20429f83a1a40959fd09

SHA512
b326d5feb4f9b3d76254240dc3b0d16cb60c0a47d75ab7a1742fe7bb0bdfafff00a9d24a4c84559f1b2b04d23fd4f53d3b8d654532cb7c57c60bb83041331d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\python3.dll

Filesize
66KB

MD5
a07661c5fad97379cf6d00332999d22c

SHA1
dca65816a049b3cce5c4354c3819fef54c6299b0

SHA256
5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b

SHA512
6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\python312.dll

Filesize
6.6MB

MD5
d521654d889666a0bc753320f071ef60

SHA1
5fd9b90c5d0527e53c199f94bad540c1e0985db6

SHA256
21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

SHA512
7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\select.pyd

Filesize
30KB

MD5
d0cc9fc9a0650ba00bd206720223493b

SHA1
295bc204e489572b74cc11801ed8590f808e1618

SHA256
411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019

SHA512
d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25442\unicodedata.pyd

Filesize
1.1MB

MD5
cc8142bedafdfaa50b26c6d07755c7a6

SHA1
0fcab5816eaf7b138f22c29c6d5b5f59551b39fe

SHA256
bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268

SHA512
c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0h4enjw1.ofn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
252KB

MD5
e5d01a5a8cc5c5ca9a5329459814c91a

SHA1
00ec50ab1cdab87816ec0f3e77fa8ad00ea9c067

SHA256
612bbbf476228032ebab743100c98dae7f01a1dc854298cd8ece588351acb3c6

SHA512
2d0d0d964e9100b0586043b16f91532e0f81347ef3697dee7ab0cd90469e6c118ac58e630d9a7fe0a84f5c275440813aeede0e0c44cacf316f59cb760081ab07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip

Filesize
124KB

MD5
287c4ef4138442be3996d52619f9e7d3

SHA1
2a64f031df9e950aec105ac2eaf6cf0932bda940

SHA256
686f17451faf52211e0b477c8b4dee8666eebc7332e5b429fa7f478aeece5b00

SHA512
a980b88c60bc4f5d8a6a233a24faf20aa4de697475492945208ddbe628f55a6f4a88ca945f6d1fdf147bd62e02cb103537b56083413e82763f74fcb9696cb6d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe

Filesize
319KB

MD5
794d834f4a9a70041b3cad4d0002030f

SHA1
facc1ed8ade82799866c8414406d80549c190a9b

SHA256
2ee18c24d8d7d58e740e3b12b8eacb747d2deb2139db95c4c9bb40930b40911b

SHA512
2b1a9d2a423c4ed1365b960fd706346620af4820312f67a177cf399bbf81d38acaf49830d21d3b7822072a2b1de08c028ca0855414ef7d0a53853d099736f565

Download Submit
C:\Users\Admin\Downloads\JV-Sender.zip

Filesize
12.2MB

MD5
4f87503277e991c0522fb27ac5b916e7

SHA1
ff6b2210c587f080f331d87c2facba4cc0eba0dc

SHA256
1763202138dd09f8000f1086a42dfaf1e207c4dafeecb91a5088617d310861ac

SHA512
99af29c6ce5e0df8e9f0c67c2d36e58787a50cc7c2fc3d3a0f4cba69971d4f0be0207db6f23b42bb08f6bcb51a9be0bee1fdd497687c94c45b1821e3f86c158e

Download Submit
C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script .exe

Filesize
12.1MB

MD5
f805eb1200e7c6c1f19f4a0d40eae320

SHA1
b33b927d6082fc4bce9fbe1c4c4de6b64e8ee67b

SHA256
7768ddf6ef020dfdecbdfb87e91ad844e5fe1d1000ce4e1bb90fd55f26da6c4c

SHA512
4d0d1250595fe59b20b48c1bcfe1a55f3fbc5cc283c7ff76609bbfb33f8990e31fa47c55d418dc323cc8bbc404ef8632e04900f46afca8d211d40a446e959c35

Download Submit
C:\Users\Admin\Downloads\JV-Sender\JV-Sender\script.exe

Filesize
12.6MB

MD5
8c1e54ac324ce689c7edcc0cac372fac

SHA1
8fced71e5fd2eea8a5b1f5d69937b35ef8d2adc9

SHA256
23a69c78e651b8c02340b57447bf706ad381d95b02e87deb3f895ca525ab539e

SHA512
7354ec6f1cddedbc158b81cd096dd850c847dde2d979e1367d47ea1a276ba8a05fe4712e6f888ff587baa27937d6232e04df91f9742ad6d85480af7dd0137831

Download Submit
C:\Users\Admin\Downloads\Password.txt

Filesize
23B

MD5
6249cddf35e31793f57589e0bac8d728

SHA1
bb9f5f9c3be32b44b47279d1a0270c5a6b9a22ad

SHA256
b2c665656fa5a9baa8128db8654644529ea5acaddff9e8559c9b5f9cdae35590

SHA512
8c1f35b5bd24ce2534b86cd7b134d8904a67f044d43c833f172ddadaa33f8b2aa101058123465eaa59570dff31f1225e74e2be949fbf4883a06ddb332e4a83e2

Download Submit
memory/3420-862-0x000002B20A880000-0x000002B20A8A2000-memory.dmp

Filesize
136KB

Download
memory/5260-858-0x00000000018F0000-0x00000000018F8000-memory.dmp

Filesize
32KB

Download
memory/5260-859-0x0000000001A20000-0x0000000001A2C000-memory.dmp

Filesize
48KB

Download
memory/5808-699-0x000000001D380000-0x000000001D41C000-memory.dmp

Filesize
624KB

Download
memory/5808-698-0x000000001CEB0000-0x000000001D37E000-memory.dmp

Filesize
4.8MB

Download
memory/5808-697-0x000000001C3C0000-0x000000001C466000-memory.dmp

Filesize
664KB

Download